CPPSEC4007A: Assess Threat- Risk Management Assignment

Internal Code: MAS6739

Risk Management Assignment:

Task: All reasonable measures have been taken to ensure the accuracy of information contained within this document at the time of development through consultation with industry experts and review of current legislation, regulations, Standards, Codes of Practice, industry guidelines, ASQA, AQF and the national register for training. No responsibility will be accepted by the authors and/or publisher for any damage, injury or loss arising from information included or omitted from this document. Any sources or reference material listed in this document from third parties has been appropriately referenced and Affirm Training may not necessarily endorse the views or opinions of these third parties. Affirm Training acknowledges the original copyright owners of any referenced material and encourages them to contact Affirm Training in the event that their material contained in this document requires updating or further acknowledgement. The written consent of Affirm Training must be sought prior to reselling, reproducing or transmitting, in any form or by any means, electronic or mechanical, including photocopying, recording, or by an information storage and retrieval system of any part of this publication. Question: 1 Name one legislative instrument that is relevant to conducting a threat assessment in the workplace due to the obligation placed upon a PCBU for providing a safe working environment? Question: 2. How do these legislative requirements relate to Assessing Threat and why an organisation must implement strategies to minimise exposure to identified threats? Question: 3. Name the ‘Handbook’ that provides detailed information about the broad framework and core elements that should be included in a security risk management and threat assessment? Question: 4. What is the legislation that contains information on Australia’s terrorist offences? Question: 5. Consultation with the client/internal stakeholder on their operations, goals and objectives are essential in the threat assessment process. Explain what your clients operations are and what type of business they are? Question: 6. Explain what the client’s/internal stakeholders goals and objectives are for minimising exposure to terrorist attacks. Question: 7. During a threat assessment you will need to gather relevant information from reliable resources to ensure your threat assessment has been conducted considering due diligence. Examples of these are: Key Stakeholders, Industry Experts, Government Websites, Incidents Registers, Risk Registers, Existing Threat Assessments, Continuity Plans, Emergency Plans, Crowd Management Plans. Pick two of the examples and in your own words explain how they would benefit you in determining existing or emerging threats within the business. Question: 8. What is the name of the International Standard, which explains risk management in detail with supporting criteria used to determine the measurement of a risk? Question: 9. Refer to the Security Indicators on Page 24. Consider the client/internal stakeholders you are conducting the threat assessment for and score your client on the (7) indicators. Question: 10. When determining the threat to an organisation, the assessor may also review the examples below to determine potential or actual undesirable outcomes. Question: 11. What is the website you can refer to for the National Terrorism Threat Advisory System? Question: 12. What is the website where you can find information on ‘Publications’ about Australia’s Counter Terrorism Strategy, Active Shooter Guidelines for Places of Mass Gatherings, National Counter- Terrorism Plan, Australia’s Counter Terrorism Laws? Question: 13. Whilst there is much concern about the potential for the scale and type of attacks seen in Paris and Brussels to occur in Australia, it should be acknowledged that Australia possesses a unique geographical, socio-economic, political and legal landscape which separates it from the Western states, and these factors influence the nature and type of terrorist threat that may materialise. Question: 14. Context for identifying threats is based on an accurate understanding of the threats to operational environments and core business operations of the client. Based on the operational environment and SCALE Security Indicators on Page 24,Explain (2) threats that could occur in your organisation and the impact it would have on operations if they occurred. Question: 15. When conducting a threat assessment after an incident has occurred it is beneficial to also consider two things; the source of where the threat comes from and what may have caused that threat. Through conducting this assessment you can consider systems, processes and supporting documentation that could be implemented to minimise the impact in the future. Explain what may have caused the threat to occur. Question: 16. The SCALE process provides a structured and systematic method for assessing threat and vulnerabilities. Using the SCALE Indicators are there any areas or gaps you can identify that should also be considered? Question: 17. Explain what you would do if you were engaged to develop a threat assessment and was advised by your client/internal stakeholders that your content was vague and did not meet the scope of the project. Question: 18. During the consultation process with the client it is important to determine the format of reports and the assessment criteria that is to be used to measure the potential or level of actual threats and vulnerabilities. Question: 19. What does the acronym EVIL DONE stand for? Question: 20. What does the acronym CARVER stand for? Question: 21. What does the acronym SCALE Stand for? Question: 22. A SCALE assessment involves assigning a score out of five to each of 25 attributes of the first four components (SCAL). The total of these four scores measures the site’s underlying vulnerability to terrorist attack. What is the formula for determining the SCALE score? Question: 23. Explain what Qualitative means: Question: 24. Explain how you would systematically monitor and assess performance systems and processes. (Minimum 100 words ) Question: 26. Explain how changing roles, locations and stability of the operating environment may impact on effective monitoring. Question: 27. Consult with your client/internal stakeholders and determine what measures are in place for operational back-up systems if a terrorist attack occurred resulting in changes to normal operations. Is their system effective? YES / NO, why? Question: 28. Is the system and supporting documentation available to all key stakeholders that would be involved in the continuity plan? YES / NO, explain how this will cause an impact on normal operations if the terrorist attack was successful. Question: 29. Are the back-up plans capable of returning the business back to normal operations in a satisfactory time frame if there was a terrorist incident? YES / NO. Question: 30. What would you suggest to the client/internal stakeholders to improve based on the information received through the consultative process and/or review of systems? Question: 32. Consult with your client/internal stakeholders and determine the consequences to the business for the following threats. Credible bomb threat is received resulting in mass evacuation of the site. Question: 33. Consult with your client/internal stakeholders and determine a credible or perceived threat to their business. Determine with the client what contingencies would be for the threat and actions that the client would take. Provide details of the contingencies. Question: 34. Explain why it is important to determine with the client/internal stakeholders that the report satisfies the scope of work and the services agreed upon. Question: 35. If your client/internal stakeholders made a complaint about the quality of service, what would you reference to verify your work was sufficient to meet their needs? Question: 36. How would you respond to the client/internal stakeholders to ensure you continued a professional relationship? Question: 37. What are some methods you could use to collect, review, and verify client/internal stakeholders’s satisfaction? Question: 38. Explain how you will keep the information contained within your threat assessment, secure and confidential. Question: 39. Explain how you will ensure the information remains current and older versions are not referred to? Your project is to consult with the client/internal stakeholder and develop a threat assessment using the SCALE approach. Score the clients organisation on each of the SCALE Indicators. Provide a minimum 500-word summary of your findings with emphasis on any concerns that are identified and actions that could be taken.