Security management is the identification of an organization's

asset In financial accounting, an asset is any resource owned or controlled by a business or an economic entity. It is anything (tangible or intangible) that can be used to produce positive economic value. Assets represent value of ownership that can b ...

s i.e. including people, buildings, machines, systems and information assets, followed by the development, documentation, and implementation of policies and procedures for protecting assets. An organization uses such security management procedures for information classification, threat assessment,

risk assessment Risk assessment is a process for identifying hazards, potential (future) events which may negatively impact on individuals, assets, and/or the environment because of those hazards, their likelihood and consequences, and actions which can mitigate ...

, and

risk analysis In simple terms, risk is the possibility of something bad happening. Risk involves uncertainty about the effects/implications of an activity with respect to something that humans value (such as health, well-being, wealth, property or the environ ...

to identify threats, categorize assets, and rate system vulnerabilities.

Loss prevention

Loss prevention focuses on what one's critical assets are and how they are going to protect them. A key component to

loss prevention Retail loss prevention (also known as retail asset protection) is a set of practices employed by retail companies to preserve profit. Loss prevention is mainly found within the retail sector but also can be found within other business environme ...

is assessing the potential threats to the successful achievement of the goal. This must include the potential opportunities that further the object (why take the risk unless there's an upside?) Balance probability and impact determine and implement measures to minimize or eliminate those threats. Security management includes the theories, concepts, ideas, methods, procedures, and practices that are used to manage and control organizational resources in order to accomplish security goals. Policies, procedures, administration, operations, training, awareness campaigns, financial management, contracting, resource allocation, and dealing with problems like security degradation are all included in this vast sector.

Security risk management

The management of

security risk In simple terms, risk is the possibility of something bad happening. Risk involves uncertainty about the effects/implications of an activity with respect to something that humans value (such as health, well-being, wealth, property or the environ ...

s applies the principles of risk management to the management of security threats. It consists of identifying threats (or risk causes), assessing the effectiveness of existing controls to face those threats, determining the risks' consequence(s), prioritizing the risks by rating the likelihood and impact, classifying the type of risk, and selecting an appropriate risk option or risk response. In 2016, a universal standard for managing risks was developed in The Netherlands. In 2017, it was updated and named: Universal Security Management Systems Standard 2017.

Types of risks

External

* Strategic: Competition and customer demand. * Operational: Regulations, suppliers, and contract. * Financial: FX and credit. * Hazard: Natural disasters, cyber, and external criminal acts. * Compliance: New regulatory or legal requirements are introduced, or existing ones are changed, exposing the organization to a non-compliance risk if measures are not taken to ensure compliance.

Internal

* Strategic: R&D. * Operational: Systems and processes (H&R, Payroll). * Financial: Liquidity and cash flow. * Hazard: Safety and security; employees and equipment. * Compliance: Concrete or potential changes in an organization's systems, processes, suppliers, etc. may create exposure to a legal or regulatory non-compliance. Risk options

Risk avoidance

The first choice to be considered is the possibility of eliminating the existence of criminal opportunity or avoiding the creation of such an opportunity. When additional considerations or factors are not created as a result of this action that would create a greater risk. For example, removing all the cash flow from a

retail Retail is the sale of goods and services to consumers, in contrast to wholesaling, which is the sale to business or institutional customers. A retailer purchases goods in large quantities from manufacturers, directly or through a wholes ...

outlet would eliminate the opportunity for stealing the money, but it would also eliminate the ability to conduct business.

Risk reduction

When avoiding or eliminating the criminal opportunity conflicts with the ability to conduct business, the next step is reducing the opportunity of potential loss to the lowest level consistent with the function of the business. In the example above, the application of risk reduction might result in the business keeping only enough cash on hand for one day's operation.

Risk spreading

Assets that remain exposed after the application of reduction and avoidance are the subjects of risk spreading. This is the concept that limits loss or potential losses by exposing the perpetrator to the probability of detection and apprehension prior to the consummation of the crime through the application of perimeter lighting, barred windows, and

intrusion detection system An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically either reported to an administrator or collec ...

s. The idea is to reduce the time available for thieves to steal assets and escape without apprehension.

Risk transfer

The two primary methods of accomplishing risk transfer is to insure the assets or raise prices to cover the loss in the event of a criminal act. Generally speaking, when the first three steps have been properly applied, the cost of transferring risks is much lower.

Risk acceptance

All of the remaining risks must simply be assumed by the business as a part of doing business. Included with these accepted losses are deductibles, which have been made as part of the insurance coverage.

Security policy implementations

Intrusion detection

Alarm device An alarm device is a mechanism that gives an audible, visual, combination, or other kind of alarm signal to alert someone to a problem or condition that requires urgent attention. Etymology The word ''alarm'' comes from the Old French ''a l'a ...

Access control

* Locks, simple or sophisticated, such as

biometric authentication Biometrics are body measurements and calculations related to human characteristics and features. Biometric authentication (or realistic authentication) is used in computer science as a form of identification and access control. It is also used t ...

and

keycard lock A keycard lock is a lock operated by a keycard, a flat, rectangular plastic card. The card typically, but not always, has identical dimensions to that of a credit card, that is ID-1 format. The card stores a physical or digital pattern that ...

Physical security

* Environmental elements (ex. Mountains, Trees, etc.). *

Barricade Barricade (from the French ''barrique'' - 'barrel') is any object or structure that creates a barrier or obstacle to control, block passage or force the flow of traffic in the desired direction. Adopted as a military term, a barricade denotes ...

. *

Security guard A security guard (also known as a security inspector, security officer, factory guard, or protective agent) is a person employed by a government or private party to protect the employing party's assets (property, people, equipment, money, etc.) ...

s (armed or unarmed) with wireless communication devices (e.g.,

two-way radio A two-way radio is a radio transceiver (a radio that can both transmit and receive radio waves), which is used for bidirectional person-to-person voice communication with other users with similar radios, in contrast to a broadcast receiver, whi ...

). *

Security lighting In the field of physical security, security lighting is lighting that intended to deter or detect intrusions or other criminal activity occurring on a property or site. It can also be used to increase a feeling of safety. Lighting is integral to cri ...

(spotlight, etc.). * Security Cameras. * Motion Detectors. * IBNS containers for cash in transit.

Procedures

* Coordination with

law enforcement agencies A law enforcement agency (LEA) is any government agency responsible for law enforcement within a specific jurisdiction through the employment and deployment of law enforcement officers and their resources. The most common type of law enforcement ...

. *

Fraud In law, fraud is intent (law), intentional deception to deprive a victim of a legal right or to gain from a victim unlawfully or unfairly. Fraud can violate Civil law (common law), civil law (e.g., a fraud victim may sue the fraud perpetrato ...

management. * Risk Management. * CPTED. * Risk Analysis. * Risk Mitigation. * Contingency Planning.