How Corporate Security Changed After 9/11

1. How Corporate Security Changed After 9/11 John M. McCarthy Managing Partner Business Security Advisory Group www.bsag-cso.com

2. The Business Security Advisory Group (BSAG) specializes in a broad range of corporate security consulting services including : • Business continuity, • Risk assessment and management, • Regulatory compliance, • Strategic security planning and policy development. Getting Ahead of the Problems www.bsag-cso.com

3. Corporate Security’s responsibilities prior to 9/11 • Corporate Security’s responsibilities post 9-11 • Laws and regulations regulating the security industry post 9/11 • Corporate Security in the 21st Century

4. Investigations – violation of corporate policy and other corporate crimes • Physical security – gates, guards, guns • Executive protection – ensuring top executives and families were secure

5. Corporate Security generally a middle management responsibility • Corporate Security generally thought of as the “Corporate Cop” • Corporate Security plans and programs generally responsive or reactive to immediate incidents – no long term planning

6. Mostly reactive-incident happens, security responds – fire house mentality • Stove Pipe thinking – Security programs sometimes contrary to Business Unit’s business plans and goals • Law Enforcement Driven – security goal must be attained at all costs – no priorities

7. September 11, 2001 September 10, 2001

8. Three thousand civilians murdered • $80 Billion dollars in losses • 11 Million people in developing countries pushed into poverty. • Financial markets closed • Air transportation system grounded

9. Mail Processing – 86% • Travel – 85% • Protection of Employees – 79% • Protection of Infrastructure – 75% • Risk Assessment – 71% *3 Booz, Allen, Hamilton Survey – 11/01 • Protection of Offices and Physical Plants – 69% • Employee Morale – 69% • Supply Chain Distribution – 51% • Customer Security – 50% • Productivity – 47%

10. Corporate Security gets the attention of Executive Management • Corporate Security seen as a resource to the company not as a necessary evil • Corporate Security an advisor to Executive Management and Business Units concerning comprehensive security programs for personnel and corporate asset protection

11. Corporate Security reports to the “C” suite in many companies and is no longer a mid-level executive responsibility • Corporate security executives become more business oriented in management style and program content • Corporate Security becomes an enterprise function of the company

12. Emergency plans include crisis management, disaster recovery and business continuity developed in a proactive environment • Corporate Security executives now craft strategic and tactical security plans for business units. • Plans and programs consider business goals and budgets • All corporate security plans and programs are more proactive and include prevention of terrorist attack

13. The Public Sector recognizes its greater responsibility to protect its citizens and assets • Corporate Security deals more with federal, state and local officials as security regulations exponentially increase • Public and private partnerships flourish as both attempt to craft meaningful emergency proactive plans, protective processes, security laws and regulations

14. Corporate security plans and programs develop a legal compliance component as corporations comply with the new mandated legislation • Corporate Security’s programs are more restrictive and costly as both terrorism and legislative compliance are emphasized

15. Legislation* Access to Information Act Arming Pilots Against Terrorism Act Aviation and Transportation Security Act Bank Protection Act of 1968 Canadas Bill C-6 Childrens Online Privacy Protection Act (COPPA) Corporate Manslaughter and Corporate Homicide Act 2007(UK) Customs Modernization Act Cyber Security Enhancement Act of 2002 CyberCrime TreatyE-Signature Act European Union Data Protection Directive Executive Order 12958 – Information SharingExecutive Order 13224 – Doing Business w/ Terrorists Executive Order 13231 – Infrastructure Protection Executive Order 13234 –

16. Legislation (Continued) Citizen Preparedness Family Educational Rights and Privacy Act Federal Anti-Tampering Act Federal Computer Security Bill – H.R. 1259Federal Hazardous Materials Law Foreign Corrupt Practices Act Homeland Security Act International Emergency Economic Powers Act Maritime Transportation Security Act of 2002 National Information Infrastructure Protection Act Notification and Federal Employee Anti-Discrimination and Retaliation Act Patriots Act Personal Information Protection and Electronic Documents Act

17. Legislation (Continued) Presidential Directive 2 Presidential Directive 3 Presidential Directive 7 Presidential Directive 8 Public Health Security and Bioterrorism Preparedness & Response Act Robinson-Patman Anti-Trust Act Safe Explosives Act Safe Harbor Act The Occupational Safety and Health Act The Currency and Foreign Transactions Reporting Act Title 18 - Federal Sentencing Guidelines Trade Act of 2002 US Global Anti-Corruption Policy US The Currency and Foreign Transactions Reporting Act USA PATRIOT Act Voluntary Private Sector Preparedness Accreditation and Certification Program *Above information furnished by Security Executive Council

23. Vicarious corporate executive liability for violation of some of the criminal and environmental laws • Civil liability in money damages for tort law violations • Criminal liability for companies and employees in foreign venues for violations of international laws and regulations • Overarching federal statutes either mandate or furnish guidelines for fines and/or punishment for violation of statutes and regulations

24. CORPORATE SECURITY21st CENTURY • Corporate Security executives will be law enforcement and business qualified and also possess some technical security and management ability • Chief Security Officer will report to Executive Management and have complete unfettered access to the “C” suite • Corporate Security will have an enterprise component and deal with security matters in a manner business executives will understand

25. CORPORATE SECURITY21st CENTURY • Corporate Security plans and programs will be mostly pro-active and preventative anticipating security challenges and emergencies before they occur • Corporate Security will use the team concept and interact with all the business units and service departments to ensure cost effective corporate security policy is practically implemented company wide.

26. CORPORATE SECURITY21st CENTURY • Corporate Security plans and programs will have to deal with the reality of government regulation and develop innovative methods to keep current with the laws and effect compliance • Develop innovative methods to ensure security solutions are as multi-faceted as possible so that the cost and compliance components can be spread among other business units

27. CORPORATE SECURITY21st CENTURY Corporate Security will re-orient its goals from strictly law enforcement objectives to ones that includes a business component e.g. provide metrics for security services that: • Increase profitability • Reduce costs • Enhance the brand • Improve customer relationships • Reduce employee attrition

28. Drug Testing Programs • Employee Reduction Programs • Investigative and Interview Training • Background Inquiries • Expatriate Mobilization Programs • Workplace Violence Programs • Crisis Management Programs • Security Awareness Programs • Domestic and Global Evacuation Programs

29. QUESTIONS?