Attachment 16 - Security Audit Checklist.pdf

Attachment 16

Security Audit Checklist BARDA Program Protection Office

SITE IDENTIFICATION

1.1 Site Specifics

Site Name:

Site Address:

Primary Point of Contact:

Secondary Point of Contact:

Telephone Number:

Facsimile Number:

Email Address:

Date of Assessment:

Date of Last Assessment:

1.2 General Site Characteristics

Size of Facility:

• Acreage / Sq. Feet

• Number of Buildings

Number of Employees:

• Permanent

• Temporary

• Seasonal

• Sub-Contractor

Hours of Operation:

• Identify by Shift

Number of Visitors:

• Average Per Month

Surrounding Area:

• Residential

• Commercial

• Agricultural

• Industrial

IDENTIFICATION OF CRITICAL OPERATIONS / ASSETS

2.1 Description of Site Operations

Description of Site Operations:

• Purpose of Site

• Key Products/Services

• Key Customers or

Industries Supported

• Activities Posing Public

Health / Environmental Hazards

• Type, Quantity, and

Storage Medium of Select Agent / HAZMAT

Criticality of Site Operations:

• Proximity to Population

Areas of Concern

• Production of Critical

Resources

• Economic Impacts

• Environmental

Consequences

• National Security Impacts

• Symbolic Importance

• Other Socio-Political

Impacts

• Support to Other Critical

Infrastructure

Infrastructure Dependencies:

• Energy

• Telecommunications

• Transportation

• Water

• Other

Standard Operating Procedures (SOPs) for emergencies?

• Break-Ins

• Toxic Spills/Releases

• Hostage Situations

• Natural Disasters

• Terrorist Incidents

• Loss of Infrastructure

• Other

2.2 Significant Assets

Significant Assets Asset Characteristics Asset Location

2.3 Subcontractor Support

Company Name Company Address Support Provided

SECURITY

3.1 Security Administration

Yes No N/A Comments Does the company have a formal security plan in writing?

If so, is this plan available to all employees?

Does the company have a formal threat definition and assessment statement?

If so, is this statement available to all employees?

Is security awareness training provided to employees? If so, how often?

Are there security memoranda of understanding (MOU) or memoranda of agreement (MOA) in place with adjacent facilities?

Are there security memoranda of understanding (MOU) or memoranda of agreement (MOA) in place with local law enforcement?

Is there regularly scheduled liaison and information sharing between the company and local, state and federal law enforcement?

Is there a formal plan for receiving threat information?

Does the company have established threat elevation procedures?

Does the company have bomb threat procedures established?

Are security issues reported to

BARDA?

3.2 Security Force / Protective Services

Yes No N/A Comments How many employees comprise the facility security workforce? Specify whether these are company or contractor employees.

How many security force personnel are on duty at a time?

Are additional security personnel added when the threat level increases?

Specify.

Do any members of the security force have arrest authority?

Do security personnel have responsibility to investigate and report security-related incidents?

Are there time requirements for reporting an incident to senior management?

Are security personnel armed? What type of weapons do they carry / have access to?

If armed, how often do security personnel qualify with their weapons?

Are weapons adequately stored when not in use?

Are there minimum employment standards / testing for security personnel?

Do security personnel wear uniforms?

Is there a use of force continuum in place?

Is non-lethal use of force mechanisms used? (Pepper Spray / Taser / Baton)

Is there an in-service training program?

Is there a staffing plan in place for security personnel for: peak hours; non-peak hours; heightened alert situations?

Does the security force have access to vehicles?

Are all entrances / exits to the facility manned by security personnel?

Can all security personnel on shift communicate with each other, a supervisor and the command / control center?

Are periodic checks completed of areas such as: perimeter; HAZMAT; Select Agent; etc.?

Are records kept of security checks?

Do security personnel have standing orders for each post?

Does the facility have an emergency operations plan?

Does the facility have and emergency call-down notification plan?

3.3 Physical Security

Yes No N/A Comments Fences / Gates / Barriers / Locks Does the facility have fencing?

Is the facility completely enclosed by fencing?

Is existing fencing surrounding the facility perimeter in good repair?

Is the fencing alarmed?

Is the fencing reinforced or otherwise protected against vehicle access?

Is the area surrounding fencing clear of vegetation with a clearly identified “cleared zone”?

Are warning signs placed at the perimeter?

Are there gates controlling vehicular and/or pedestrian access?

Are gates manned 24/7?

Are gates controlled by a card reader system or other automated access control system?

Are fence/gate areas adequately illuminated?

Is the perimeter monitored?

Are procedures in place to extend perimeter during times of heightened security?

Are procedures in place to provide additional stand-off distance to key facilities during heightened alerts?

Is access to roofs monitored?

Are locking mechanisms in place to prevent entry through any roof openings?

Are all utility / storage tanks / emergency infrastructure areas controlled / locked?

Vehicle Barriers Are speed control obstacles employed to prevent vehicles from running checkpoints or vehicle search areas during elevated alert levels?

Are passive vehicle barriers employed to protect critical components from Large- Vehicle Improvised Explosive Devices (LVIEDs) (e.g., Jersey barriers, buried ties, concrete planters, cables, etc.)?

Are delivery trucks routinely screened or inspected prior to entry?

During elevated threat levels, are passenger vehicles searched prior to being permitted to enter the facility?

Are explosives detection canines used at the facility?

Intrusion Detection/CCTV Does the facility have an exterior intrusion detection system (IDS)?

If so, does the IDS provide specific coverage for significant facility assets?

Is there back-up power for the alarms?

Does the facility have an interior intrusion detection system (IDS)? What assets are covered?

Is local law enforcement notified of alarms?

Do standing operating procedures cover response to alarms?

Are written records kept of all alarms and subsequent investigations?

Does the facility have a closed-circuit television system (CCTV) in place? If so, how many cameras?

Are all significant facility assets under CCTV coverage?

Does the CCTV system have immediate playback capability?

Is CCTV coverage administered inside any buildings with critical assets?

Explain.

Do CCTV assets monitor all entrances / exits to the facility?

Are CCTV assets monitored by security personnel 24/7?

Do CCTV assets have record / playback capability?

Do CCTV assets have pan, tilt, zoom capability?

Are CCTV recordings maintained at least 30 days?

Is employee parking areas monitored by

CCTV?

Is the perimeter monitored by CCTV?

Vehicle Searches Are delivery trucks routinely screened or inspected prior to entry?

During elevated threat levels, are passenger vehicles searched prior to being permitted to enter the property?

Are explosives detection canines used?

Access Control Are badges used to identify employees?

Is the issuance of badges controlled and accountability maintained?

Are passes or decals used to identify authorized vehicles entering the facility?

Are procedures in place to have unauthorized vehicles on the property or near the property perimeter towed?

Are access control devices (e.g., employee badges, swipe/proximity cards, biometric devices) used to gain entry to the facility?

Are access control devices (e.g., employee badges, swipe/proximity cards, biometric devices) used to gain entry to critical assets/areas within the facility?

Do employees have different levels of access to the facility based on their job?

Does the company employ measures to prevent employees from “piggy-backing” in to key facilities?

Are screening devices used to detect the presence of weapons, explosives, or other unauthorized items (e.g., dogs, metal detectors, x-rays)?

Does the company issue keys?

Does the company have a key control officer and accountability system?

Visitor Control Are visitors required to sign in with security?

Are visitors issued badges that identify them as visitors?

Are visitors required to be escorted?

Are records kept of visitors?

Are visitors allowed to drive / park on the facility?

Communications Does the facility have a security command center? If yes, please describe.

Are all systems (alarms, CCTVs, Communications, etc.) controlled by the command center?

Does the facility have direct communications channels with local law enforcement? If yes, please describe. If no, please describe how law enforcement is contacted in the event of an emergency.

Does the facility have a back-up security command center?

Do all security personnel have two-way radios with the ability to communicate anywhere on the facility?

Are communications encrypted?

HVAC

Have measures been taken to secure the HVAC system from potential CBRN threats?

Does the facility have the ability to shut down / close off the HVAC in case of emergency?

Lighting Is lighting adequate for the operation of

CCTV?

Is the perimeter of the facility well-lighted?

Is lighting sufficient for parking facilities?

Is there emergency backup for the facility lighting?

Are entrances / exits to buildings well illuminated?

Are entrances / exits to the perimeter of the facility sufficiently illuminated?

Are vehicle inspection / shipping / receiving areas sufficiently illuminated?

Are key / critical resources / infrastructure sufficiently illuminated?

Parking Is the parking facility controlled?

Is there a system in place to identify unauthorized vehicles? (Company issued decals / placards / etc)

Is the parking facility routinely patrolled by security personnel?

Is there a standoff distance between all parking and buildings?

Shipping / Receiving Are procedures in place to monitor / inspect incoming materials?

Are there contingencies that implement modified procedures to restrict shipping and receiving to mission critical products in times of heightened alerts?

Are mail / packages coming into the facility screened in any manner? (Xray / Radiation)

Is access to the shipping / receiving area restricted?

Are shipping / receiving areas monitored by CCTV?

Construction / Renovation Has Mylar film been installed on all exterior windows to provide shatter protection?

Has blast protection / standoff distances been considered for new construction / renovations?

3.4 Personnel Security

Does the company complete background investigations on all employees?

Does the company have processes and procedures that are utilized to determine the trustworthiness of employees?

Verify date and place of birth Verify citizenship Verify education Verify previous employment for the past five years with interviews of previous supervisors, and/or co-workers

Interview two character references Verify residences for the past five years

Conduct national and local check of law enforcement agencies to identify any criminal activity

Review public records to identify any civil or criminal court records

Conduct financial credit checks Conduct a personal interview of the employee that addresses the employees trustworthiness and suitability

Insure that all subcontractors working on the contract or held to the same personnel security standards

Report derogatory information to the government as required

Are background checks performed on a periodic basis for current employees?

3.5 IT Security

Does the company have an IT Security Plan / Policy?

Does the company have Information Technology Security standards that meets federal requirements in protecting government information on all computer systems and networks containing government information associated with the contract?

Does the company have an IT Security training / education program?

Does the company employ and intrusion prevention system on the network?

Does the company employ an intrusion detection system on the network?

Are security-related events are logged by the system?

Does the company have redundant hardware to allow work to continue in the event of a single hardware failure?

Is there a company policy for setting / changing passwords?

Does the company backup information and store it in a secure location?

Does the company use updated anti-virus software on all systems?

Are sensitive, proprietary, government and trade secret data available on the network?

Are procedures in place to properly secure that information?

Is data encrypted for transmission?

Do all firewalls / routers / switches restrict access to known / trusted IP addresses?

Can authorized users access the network remotely?

Are security protocols used to verify the user?

Are audit logs reviewed routinely even if no unusual “events” are detected?

Does the company immediately block employee access to networks upon termination?

Do company employees utilize laptops?

Are laptop hard drives encrypted?

Are laptop hard drives and other media screened prior to removal from the facility for repair, travel, or other reason?

Does the company have a policy and device software in place to block downloads to CD/DVD; USB;

FireWire; and other removable media devices?

Does the company have a secure server room?

3.6 Information Security

Does the company have an Information Security Policy?

Have all employees signed a confidentiality agreement before being given access to proprietary / trade secret / government information?

Is sensitive information related to the contract properly marked and stored?

Are shredders or other appropriate destruction techniques used to properly dispose of sensitive information?

Is the “Need to Know” policy used?

3.7 Transportation Security

Yes No N/A Comments Does the company have a Transportation Security Plan?

Is a threat assessment done each time before movement of product?

Are BARDA security personnel informed of each shipment?

Are background checks completed on individuals transporting the product?

Is appropriate documentation such as driver’s license / safety inspection stickers / insurance / registration / shipping documents confirmed before each shipment?

Does a visual inspection of the transport vehicle and shipping container take place prior to shipment?

Is a pre-planned route designated?

Are drivers provided with emergency contact numbers?

Is there a standard operating procedure for drivers to use in case of emergency?

If so, what?

Is there a plan for primary (cell phone), secondary (radio), and tertiary (satellite tracking) means of communications?

Is the driver given a route briefing before transport to include: designated route; weather conditions; emergency re-routing; law enforcement contacts;

communications plan?

Does the service include non-stop, door-to-door delivery using two drivers with at least one always awake and present with the shipment?

Are by-pass and remote shutdown mechanisms installed on vehicles?

Are panic-buttons installed in vehicles?

Have theft-protection devices been installed to disable fuel, hydraulics, and/or electrical systems?

Are locks and seals installed on cargo?

Is there continuous shipment monitoring with two-way satellite capabilities?

Do the drivers call dispatchers at specific times during the shipment to provide update reports / locations?

What type of response capabilities has the transport company established in case of emergency?

What intervention capabilities have been coordinated?

What alliances does the carrier have along the chosen route for mechanical repairs and other assistance?

If in the U.S., is the carrier familiar with the controlling components of 49 CFR Parts 1 and 2, Federal Motor Carrier Safety Assistance Act (MCSAP) and the applicable motor carrier laws of the states included in the chosen route?

3.8 Select Agent

Does the company use / store Select Agent(s) as defined by the CDC?

Does the company manage, store and control the select agents and toxins IAW 42 CFR Parts 72 and 73, and 42 CFR Part 1003?

Does the company have a security plan for Select Agents?