Home / Security Risk Assessment
Comprehensive security risk assessments for businesses and nonprofits
A comprehensive security risk assessment looks at everything that protects your organization: your people, buildings, information, operations and reputation, and the hiring, firing, policies and procedures around them. Greg Schneider, CPP, identifies what matters most, what threatens it and where the weak spots are, then gives you recommendations that fit your threat profile, your culture and your budget.
Greg Schneider, CPPFounder, Battle Tested Solutions. Certified Protection Professional since 2007
What is a comprehensive security risk assessment?
A comprehensive security risk assessment is a review of every asset your organization depends on, every threat that could reach those assets and every security measure that is supposed to stop it. It ends with written findings and recommendations.
It is wider than a physical security survey. A survey is narrower in scope and covers one site, or every site for a company with several physical locations. Both review guards, policies and procedures and how fast first responders can reach you in an emergency. A comprehensive assessment goes deeper: how critical each executive is to the company, online threats, vendor management, and the hiring and firing processes.
Who hires Greg for a risk assessment
- Owners of small and medium sized businesses
- Executive directors of companies and nonprofits
- Chief security officers
- Property managers
- Owners and directors of other security consulting firms
Security consulting services: risk assessments, anti-kidnap services, crisis management planning, travel security programs, physical security surveys, executive protection support services, and threat analysis and mitigation.
Not sure where you stand?
Businesses can start with the free workplace security self-assessment: 12 questions, about 5 minutes. Houses of worship have their own house of worship security assessment.
In a February 2024 video, Greg named the most common reason a company calls: an incident has already happened, such as a theft, a robbery, a violent crime or a theft of protected information. Then the owner says:
"I thought our company was in a secure area. We have an alarm system. We have cameras. How did this happen?" Greg Schneider, CPP
The five steps of a security risk assessment
Greg follows the same five steps on every comprehensive assessment.
Scope interview
Greg interviews the decision maker, or their assistant, to set the scope of work and list every asset the company has. To collect the facts he uses questionnaires, interviews, walks through the sites and internet research.
Asset identification
He identifies the assets that need protection and ranks who and what is most critical to the company's success and operation.
Threat assessment
He identifies every threat that can target those assets: man made, natural disaster or proximal, meaning a danger that comes from what is near you.
Vulnerability analysis
He looks at all of your security measures and finds the weak spots an attacker could exploit.
Findings and recommendations
You get the findings with recommendations based on your threat profile, your company culture and your budget.
Assets the security risk assessment covers
The scope interview lists everything the company could lose, not only the building.
- People, grounds and buildings
- Proprietary information
- Fleet of vehicles and equipment
- Cash on site and personal items
- Your products and service offerings
- Reputation
- Business operations and business continuity
Where the vulnerability analysis looks for weak spots
- The hiring process and the firing process
- Physical security and IT security
- Travel risk
- Security guards and executive protection agents
- Building operations
- Emergency response protocols
- Vendor and visitor credentialing: how access is given
A security risk assessment built on ASIS International guidance
Greg follows the guidance of ASIS International, the professional association for security management. ASIS awarded him the Certified Protection Professional (CPP) credential in 2007.
The federal Cybersecurity and Infrastructure Security Agency also publishes free physical security guidance for organizations. Read more about Greg Schneider's background, from the Israel Defense Forces to New York City.
Example: a security risk assessment at an acute care center
During an assessment at an acute care center, Greg found that the physical security measures were decent. The gap was people: public facing employees were not uniformly trained in de-escalation, and the staff did not run enough active shooter and assailant drills to respond competently in a crisis.
After the assessment, the site adopted a certifiable de-escalation training program across the whole site.
What the example shows
Physical security was not the weak spot. Training was. A comprehensive assessment looks at both, which is why it covers people and procedures, not only the building.
Greg also teaches tactical response training, including active shooter training and emergency response planning.
Security audits: testing a site the way a criminal would
Greg also runs security audits. An audit is narrower than a full security consultation: it checks that organizations handling sensitive documents and data meet their security compliance requirements for physical security, employee screening, and policies and procedures.
Greg tests each location the way a bad guy or criminal would, looking for the weak link that someone could exploit.
Weak links Greg looks for
- A back door left open
- Company trucks or vans left open
- Reception that does not ask for ID
- Video surveillance cameras that are down or not focused
- Guards who are out of shape and not alert
Related security risk checklists
Travelling executives face their own risks: the free travel security checklist covers 12 steps to finish before a trip. Nonprofits applying for FEMA funds can start with the Nonprofit Security Grant readiness checklist.
Ask Greg a security question
Not sure where to start? Send a short note about what you are protecting. Greg reads every message himself.
Prefer to talk? Call Greg at (650) 235-5459 or book a free 15-minute call.
Security risk assessment questions
What is the difference between a security risk assessment and a physical security survey?
A comprehensive risk assessment looks at everything: hiring and firing processes, policies, procedures and security officer capabilities. A physical security survey is narrower in scope and covers one site, or every site for a company with several physical locations.
Who hires Greg for a comprehensive risk assessment?
Owners of small and medium sized businesses, executive directors of companies and nonprofits, chief security officers, property managers, and owners or directors of other security consulting firms.
What do we get at the end of the assessment?
The findings, with recommendations based on your threat profile, your company culture and your budget.
What is a security audit?
A security audit checks that an organization handling sensitive documents and data meets its compliance requirements for physical security, employee screening, and policies and procedures. Greg tests the site the way a criminal would.
Which standards does Greg follow?
Greg follows ASIS International guidance. ASIS International awarded him the Certified Protection Professional (CPP) credential in 2007.
Does Greg do risk assessments outside California?
Yes. Battle Tested Solutions is based in Santa Clara, California, and Greg does on-site assessments anywhere in the United States, and work abroad.
How long does a security risk assessment take?
It depends on the size and complexity of the building or campus. Some clients have several buildings and campuses in different cities and states. Greg collects the facts through questionnaires, interviews, site walks and internet research, then writes up the findings and recommendations.
Are prices listed on the site?
No. Fees depend on the size and scope of the work, so Greg discusses them with you once he understands what you need.