Which measure is essential in establishing an effective facility security plan?

• A. Installing appropriate security devices
• B. Performing an appropriate risk assessment
• C. Developing good security-related SOPs
• D. Not allowing staff to be in the facility outside of regular working hours

Answer: (B)

Identifying and understanding risks is the foundation of an effective facility security plan. A thorough risk assessment looks at what needs protection, what threats exist, and where weaknesses could be exploited, along with the potential consequences. This establishes a factual basis to determine which security controls are needed, how they should be prioritized, and where resources should go. Without this step, any security measures chosen—whether devices, procedures, or staffing rules—may miss critical gaps or overinvest in areas that aren’t the real risks.

Security devices are valuable, but they are most effective when their selection and placement are guided by identified risks rather than chosen in isolation. Similarly, security-related SOPs are essential for consistent responses, yet they should be built on the specific threats and vulnerabilities uncovered by the risk assessment. Limiting staff presence outside regular hours can reduce some exposure, but it doesn’t address broader risk factors like insider threats, unsecured access points, or data and material protection.