2.1 Assessment Plan, Stakeholders, Budget & Resources
Key Takeaways
- Write purpose, scope, and a critical-asset list before any walkthrough; a camera full of doors is not an assessment.
- Name real stakeholders—facilities, IT, HR, legal, EHS, operations, and an executive sponsor—plus escort and photography constraints.
- Budget the assessment itself: assessor labor, travel, after-hours access, meters, and drawings—not the future fence or camera project.
- The plan is a charter. The survey report is the later findings product with observations, ratings, and recommended measures.
- Starting fieldwork with no charter or asset list is the professional trap that misses pharmacies, fuel fills, and trailer-seal processes.
Assessment Plan Before Fieldwork
Physical security assessments do not begin at the first locked door. They begin when someone writes why the work exists, what is in scope, which assets are too important to discover by accident, who must participate, and what the assessor may spend on time and tools. Independent OpenExamPrep teaching for published PSP Domain 1 tasks treats that document as the assessment plan. The later survey report is a different product: it records observations, risk judgments, and recommended measures. Mixing those two products is how teams produce a photo album with no decision.
Trap: walking with no charter
The professional trap is a walkthrough that starts because a director said to start walking the hospital tomorrow. Without a charter or asset list, the assessor follows whatever is convenient: the pretty lobby, the unlocked conference room, the faded warehouse sign. Meanwhile the pharmacy anteroom, the generator fuel fill, and the unattended trailer-seal process never appear in the notes. A camera full of doors is not an assessment. Write the plan first, get the sponsor to accept it, then walk.
Purpose in one sentence the sponsor can defend
Purpose is the reason an executive will later fund or reject the recommendations. Typical drivers include a board request after a neighboring warehouse burglary, an insurer's condition of coverage, due diligence for a data-center colocation lease, a hospital wing that changes occupancy, or a shrink problem operations can already see in cycle counts. Purpose changes method. An insurer may care about forcible-entry paths and documented patrols. A hospital expansion may care about delayed-egress hardware, infant protection, and pharmacy control. A campus research lab may care about trusted insiders walking out with prototypes. If you cannot state the purpose, you cannot choose a model, a night survey, or even whether a light meter belongs in the kit.
Scope is a boundary, not a slogan
Name parcels, buildings, operating hours, and exclusions. State whether tenant clinics, telecom meet-me rooms, public sidewalks, contractor lots, and off-site third-party warehouses are in or out. State whether the assessor will work daylight, after hours, or both. A data center whose cages are customer-controlled needs an explicit rule: full interior survey with escort, observation from the aisle, or exclusion. A hospital medical office building owned by a separate legal entity needs the same honesty. Ambiguous scope produces busy fieldwork and a report nobody can implement.
Critical assets belong in the plan, not in a day-two surprise
Criticality is a planning input. Sit with operations before the site visit and list assets whose loss, delay, contamination, or disclosure would stop the mission or create intolerable harm. Then schedule the rooms and yards those assets live in. Do not wait until the second day on site to ask what actually matters here.
| Facility type | Critical assets to list in the plan | Key areas the plan should schedule |
|---|---|---|
| Hospital | Pharmacy vault and anteroom, infant or pediatric units, emergency-department behavioral rooms, generators and fuel, medical-gas manifolds, records rooms | Ambulance bay, loading dock, sterile processing, roof mechanical, stairwells used for delayed egress |
| Data center | Raised-floor halls, generator plant, fuel oil, UPS rooms, customer cages, media stores, network operations center | Loading dock and mantrap, visitor lobby, CRAH galleries, exterior yard, roof hatches |
| Warehouse | High-value cage, shipping office, trailer keys, yard inventory, hazmat lockup | Perimeter gates, driver lounge, empty-trailer lot, emergency exits, roof access |
| Corporate campus | Executive suite, research notebooks and lab servers, data closets, mailroom, any childcare or fitness space on site | Vehicle approaches, loading docks, after-hours entries, connecting tunnels or skybridges |
The plan should also list existing policies and records the team will pull before walking: access-control exception reports, visitor logs, incident and shrink reports, lock-and-key inventories, contractor badging rules, workplace-violence procedures, and any prior survey. Those documents tell you where to spend hours. A warehouse that already knows a large share of shrink is outbound deserves dock time, not a lobby critique. A hospital with repeated after-hours tailgating at the staff entrance deserves a night survey, not another daylight photo of the main revolving door.
Stakeholders who can enable or stop the work
Physical security assessments are not a solo security-department activity. Name people, not only department titles. An unnamed stakeholder is an unscheduled escort, a confiscated camera, or a report that dies in legal review.
| Stakeholder | Why they are in the plan | Typical contribution | What breaks if they are omitted |
|---|---|---|---|
| Executive sponsor | Authorizes access, overtime, and later funding decisions | Charter signature and conflict resolution | Site staff treat the assessor as a tourist |
| Facilities / plant operations | Owns doors, power, roofs, and work orders | Floor plans, roof access, mechanical-room escorts | Missed generators, hatches, and after-hours paths |
| IT / OT | Owns cameras, badge systems, and often building-management interfaces | Badge extracts, camera maps, health reports | Dead cameras recorded as coverage |
| Human resources | Owns workplace-violence, terminations, and many contractor relationships | Termination checklist and staffing patterns | Insider paths and true occupancy ignored |
| Legal / privacy | Bounds photography, patient information, and privileged spaces | Rules for photos in clinical or legal areas | Unusable evidence or a stopped survey |
| EHS / life safety | Owns egress, hazardous materials, and drills | Occupancy, fire-door locations, chemical inventory | Security ideas that violate egress |
| Operations | Owns the mission: nursing, fulfillment, trading, compute | Asset criticality and peak-hour constraints | Assessments of rooms that are empty at 10:00 and packed at 02:00 |
| Tenants or customers | May control cages, clinics, or leased floors | Escort rules and confidentiality limits | Incomplete data-hall or pharmacy observations |
The plan should state escort rules, photography limits, union or clinical constraints, and who receives the draft. A hospital that forbids flash photography in a neonatal unit can still allow documented notes. A data center may forbid phones in the white space and require sketches. Those constraints belong in the plan so the method remains defensible when someone later asks how you missed a room you were never allowed to enter.
Budget the assessment itself, not the future fence
Budget the assessment, not the countermeasure program. Line items usually include assessor labor for planning, on-site work, analysis, and reporting; travel and lodging; after-hours differentials; rental or purchase of documentation tools; and optional specialists such as a locksmith, lighting designer, or blast consultant. A two-building corporate campus with after-hours coverage is not a one-day job. A hospital that requires an escort on every unit will burn labor faster than a warehouse with a single operations manager.
Do not hide travel. A regional assessor flying to a remote data center still needs a day to review floor plans and a day to write. Do not treat we already have cameras as zero cost: someone must pull video, maps, and device-health reports. A realistic plan states assumptions: number of buildings, nights on site, and whether a lighting survey is included. Do not put the recommended fence replacement or camera project in this budget. Remedy costs, if requested at all, belong in the later report as a rough order of magnitude after the facts exist.
Equipment and source documents the plan should name
Pack or arrange: a camera or phone used only as the site allows; a measuring wheel or laser distance meter; a light meter for exterior and interior lighting notes; a tape measure for door and hardware observations; a compass or mapping method for orientation; PPE the site requires; and printed or digital floor plans with a markup method. For hospitals, confirm whether devices must be wiped and whether patient information can appear in photo backgrounds. For data centers, confirm whether personal phones are banned in the white space.
The plan should request as-builts, door schedules, sequence-of-operations for delayed egress, camera inventories, and lighting as-builts. If those drawings do not exist, the plan should say the survey will capture field measurements instead of treating missing drawings as a surprise on Tuesday morning.
Plan output versus survey-report output
| Assessment plan (before fieldwork) | Survey report (after fieldwork) |
|---|---|
| Purpose, scope, critical assets, stakeholders, schedule | Observations, allowed photos or sketches, measured lighting, hardware notes |
| Methods and models to be used | Risk ratings, scenarios, and recommended measures |
| Budget for assessor time, tools, and travel | Rough-order costs for remedies only if the sponsor asked for them |
| Constraints: photos, escorts, privacy, union rules | Residual-risk discussion after proposed measures |
| Success criteria for the engagement | Prioritized findings the sponsor can fund |
Worked picture: at a suburban hospital, the plan might say the purpose is to support a new behavioral-health annex; the critical assets are the pharmacy, infant unit, emergency department, and generator plant; stakeholders include facilities, nursing, EHS, privacy, and the chief operating officer; the budget covers three days plus one night and a light-meter rental; photography is forbidden in patient-care areas. The survey report, written later, is where you record that the pharmacy anteroom door does not latch, that the fuel fill is unobserved, and that a delayed-egress device has a taped-over request-to-exit. Those findings cannot be invented during planning, and the charter cannot be invented after the walk.
Get the sponsor to accept purpose, scope, assets, stakeholders, schedule, resources, and method. Then walk.
A physical security manager is told to start walking a hospital tomorrow with no written purpose, asset list, or sponsor. What should happen first?
Which budget item belongs in the assessment plan rather than waiting for the survey report?
What is the primary output of the assessment plan, as distinct from the later survey report?