5.2 Evaluating Technology, Personnel & Procedures

Evaluating Whether Current Measures Actually Work

Sponsors often stop a survey with four words: we already have security. Independent OpenExamPrep teaching for published PSP Domain 1 Task 4 knowledge on current-measure effectiveness is that those words are a claim, not a finding. Cameras, sensors, access-control systems, officers, and written procedures exist. The assessor's job is to test whether they currently protect the named asset, in the environment where they live, with the people who operate them. Whatever remains after an honest credit is residual vulnerability.

Technology that looks like coverage

Cameras that do not identify. A warehouse can have a camera over every dock and still be unable to identify a face or a license plate at 02:00. Distance, angle, infrared bloom, backlight from a truck, a PTZ parked on a parking lot, dirty domes, and retention of three days all produce the same residual: you might detect that someone was there and still have no identification for investigation or deterrence. Walk-test at the asset, at night, at the distance an adversary would stand. If you cannot distinguish a face or a plate on recorded video, do not write camera coverage. Write what the camera actually delivers: detection, observation, or identification—and which of those is missing.

Hospital cameras aimed at a nursing-station desk rather than an infant-unit exit, data-hall cameras that bloom under white LED and lose faces at the cage, and campus cameras that record a beautiful canopy while the staff door sits in darkness are the same class of finding. Count of cameras is not effectiveness. Identification at the asset is.

Sensors in the wrong environment. Passive infrared in a freezer, in a kitchen, or across a dock with plastic strip curtains will nuisance-alarm or go blind. Outdoor beams across a truck path will alarm on every trailer. Magnetic contacts on a rattling roll-up door will be shunted until someone fixes it, which becomes forever. Dual-tech sensors aimed at a HVAC diffuser, glass-break in a room with no glass, and fence detection on a section that is a decorative hedge are specified for a catalog environment, not this one. Test in the real climate, vibration, wildlife, and traffic of the site. A sensor that is in bypass is not a sensor.

Access control with shared PINs. A reader on the door is not control if every contractor uses the same four digits, if the PIN is written on the mullion, if last year's vendor code still works, or if the warehouse uses one code for fifty people. Shared PINs collapse attribution. The system cannot later say who opened the door. Forced-door and door-held-open events that nobody acknowledges are the sibling finding: the ACS is collecting noise, not a response. Check anti-passback only where it is claimed; many sites enable the feature in software and then disable it because operations complained.

Worked data-center example: mantraps with badge-plus-PIN look strong on a riser diagram. If the PIN is shared among the mechanical contractors who service CRAH units, the second factor is a group password. Residual vulnerability is unattributed after-hours access to the hall that the badge system will still call valid.

Personnel who cannot do the job the drawing assigned

Posts that cannot see the asset. An officer in a hospital lobby does not see the pharmacy vault on the third floor. A gatehouse that faces the visitor lane may have no view of the far fence or the fuel fill. A console operator watching sixty-four tiles has cameras and still has no detection. Line of sight, span of control, and what the person is actually tasked to do are the tests. If the post order says observe the high-value cage and the cage is around a corner, the post is false confidence.

Untrained temporary officers and receptionists. Weekend contract staff who do not know delayed-egress rules, infant-abduction procedures, or which doors must never be shunted will follow the last person who sounded confident. A temporary receptionist who badges anyone in a logo polo has converted visitor control into theater. Training records that list orientation completed are not effectiveness. Ask the person on post what they would do if a delayed-egress device went into alarm, if a visitor arrived for a lab that is not on the list, or if a contractor's badge failed. Wrong answers are findings.

Fatigue is a personnel finding. The same officer covering two warehouses on overtime cannot be in both. Vacancy filled by stretching posts is residual vulnerability, not a scheduling footnote. Record the hours, the vacancies, and the training of whoever is actually sitting in the chair on the night you walked.

Procedures that exist on paper

Property pass. A written rule that nothing leaves without a pass is ineffective if shipping never asks, if passes are photocopied, if the dock is unmanned at 19:00, or if trash and recycling are exempt in practice. Test at the dock during an outbound wave and during a quiet hour. Ask to see last week's passes and match them to actual shipments if operations will allow it. A campus research lab that requires a pass at the lobby and never asks at the loading door used for customer evaluations has a procedure that protects the wrong opening.

Key control. A policy titled key control next to a coffee can of master keys is not control. Look for an inventory, signatures, a lost-key procedure that includes rekeying when a master is missing, separation between grand master and change keys, and whether Facilities still has unmarked keys to the pharmacy or the cage. If the lock shop cannot tell you who holds the pharmacy key tonight, residual vulnerability includes insider and lost-key paths.

Visitor escort that is ignored. Escort rules fail in laboratories, data halls, and executive floors when a badged employee waves a visitor through because they know them, when the lab is too busy, or when the visitor badge is the same color as the employee badge. Watch the path. If an unescorted visitor can reach a prototype bench or a raised floor, the procedure's residual vulnerability is unescorted access, regardless of the policy binder.

Residual vulnerability after we already have security

Residual vulnerability is what remains after you credit existing measures for what they currently do, not for what they were purchased to do, not for what the vendor brochure promised, and not for what a peer site claims. Credit is earned by test: walk-test, night observation, interview plus log review, sampling of property passes, asking the temporary officer a procedure question. If a camera cannot identify, do not subtract CCTV from the risk as if identification existed. If a PIN is shared, do not subtract two-factor access. If an officer cannot see the asset, do not subtract manned post for that asset.

The sponsor objection is predictable: we already have cameras, officers, and a visitor policy. Answer with the table below, filled with this site's facts, not with a lecture about how security is never finished. The assessment is not a claim that nothing exists. It is a claim about what still works against the named threat to the named asset.

Worked hospital example: infant-unit cameras exist, delayed-egress hardware exists, and a receptionist exists. Night survey shows the camera aimed at a supply cart, the delayed-egress request-to-exit taped over, and the receptionist gone after 19:00 with the unit door on a nurse-held magnet. Residual vulnerability for infant abduction is not zero because the site has security. It is an unobserved, unalarmed, unstaffed opening.

Worked campus example: a research building has badge readers, a visitor SOP, and an officer at the campus gate. Prototype hardware still leaves in backpacks because property pass is not asked at the lab, and the gate officer cannot see the loading dock. Residual vulnerability is process theft that never crosses the ceremonial gate.

Do not let a technology invoice, a post order, or a policy PDF close a finding. Test current effectiveness. Write residual vulnerability in asset-threat-weakness language. That is the input the later risk analysis will need.