Physical Security Risk & Vulnerability Assessments

We follow a consistent, documented method so results can be compared over time and defended to oversight bodies. For a detailed walkthrough, read our guide to the physical security risk assessment process. In summary:

1) Define scope and objectives: the buildings, operations, and questions the assessment needs to answer.

2) Identify what you're protecting: people, critical operations, sensitive information, and key assets.

3) Assess threats: review incident history, local conditions, and the threats relevant to your mission and occupants.

4) Identify vulnerabilities: walk the site and review policies, staffing, and systems to find gaps.

5) Rank the risks: combine threat, vulnerability, and consequence so the most serious risks rise to the top.

6) Recommend countermeasures: practical options matched to each risk, with cost tiers.

7) Report, prioritize, and follow up: deliver the report and out-brief, and help you plan implementation.

Federal facilities follow the Interagency Security Committee (ISC) Risk Management Process. That process starts by setting the Facility Security Level, which determines a baseline set of countermeasures. A risk assessment then shows whether the baseline is in place and whether facility-specific risks justify adding to it or accepting a documented gap. For federal tenants and multi-tenant federal buildings, we structure findings around the Facility Security Level and ISC baseline countermeasures, so results fit the format facility security committees already use. Our ISC Risk Management Process guide explains the framework in plain language.

We assess the kinds of public buildings where staff and the public interact every day:

• Government offices and administrative buildings

• Courthouses (see our courthouse security assessments)

• Public counters and service centers where staff handle walk-in visitors

• Public works yards, shops, and utility facilities

• Multi-tenant buildings shared by several agencies or by public and private tenants

Assessment findings often feed directly into related work. Many clients follow up with occupant emergency plan development, a workplace violence prevention program, or a security design review for an upcoming renovation.

Pacific Advantage Group is vendor-neutral. We do not sell, install, or resell security equipment, so our findings are based on your risk, never on a product margin. When a procedural change, a training update, or better use of the systems you already own will reduce risk, that is what we recommend. When new equipment is warranted, we describe the requirement so you can compete it fairly. Contracting officers can find our details on the government buyers page.

Q: What is the difference between a risk assessment and a vulnerability assessment?

A: A vulnerability assessment identifies weaknesses, such as gaps in access control, screening, lighting, or procedures. A risk assessment goes further: it weighs those weaknesses against credible threats and the consequences of an incident, then ranks the results so you know what to fix first. Our engagements include both.

Q: How often should we reassess?

A: Reassess after a significant incident, a renovation, or a change in tenants or operations, and at the intervals your agency's policy requires. Federal facilities should follow the reassessment intervals set by the ISC Risk Management Process.

Q: What do you need from us?

A: A point of contact, access to the facility during and after operating hours, available incident logs, current security policies and emergency plans, any prior assessments, and time with key stakeholders for short interviews.

Talk to a security consultant: 971-213-8046 or use the contact form.