Audit of Physical Security

Roles and responsibilities

Although roles and responsibilities are defined in documentation, there is an opportunity to strengthen their implementation in practice. For example, the RSO Terms of Reference contains a comprehensive listing of the various responsibilities to be carried out. However, we observed several instances where these roles are not being carried out consistently, including but not limited to, performing routine inspections (e.g. security sweeps) to support conformance to and promote awareness of physical security requirements; and maintaining an ongoing security/awareness program.

While each region has appointed an RSO that reports functionally to the DSO, the role is generally carried out on a part-time basis as the RSO typically carries out multiple other administrative roles outside of security. The roles and responsibilities are generally being carried out on a reactive basis and there were several instances where the RSOs did not find it attainable to proactively perform all defined roles and responsibilities. For instance, interviews demonstrated that carrying out RSO responsibilities such as conducting investigations, developing security design briefs and delivering security training are challenging due to high demands from a knowledge, experience and capacity perspective.

Moreover, each sector has an SSC that supports SAD in carrying out security-related responsibilities. Unlike RSO who are directly responsible for the delivery of various physical security activities, SSCs roles and responsibilities are more focused on promoting physical security awareness and coordinating the completion of physical security activities, such as reporting identified issues/deficiencies to SAD and following up on physical security requests (access card applications, incident reports etc.). While these roles and responsibilities are documented, we observed an example where an SSC was not fully aware of the responsibilities associated with the role.

The roles and responsibilities of the RSOs and SSCs are essential to managing a system of processes and controls to protect, detect, and respond to physical security-related risks/issues facing the Department, as well as raise awareness of physical security requirements. CIRNAC/ISC's ability to meet its physical security requirements at a department-level is dependent on regional and sectoral security personnel carrying out their defined roles and responsibilities.

Monitoring & oversight

The overall responsibility for managing the departmental physical security program falls under SAD; however, much of the conduct of physical security activities takes place at the regional level. While the Department has established mechanisms to provide oversight for the management of physical security and to communicate security related information to relevant stakeholders, departmental monitoring processes over the implementation of physical security requirements throughout the Departments is limited and informal. For instance, information sent from regions (e.g. incident statistics) is often not subject to headquarters monitoring and follow-up. In some cases, (discussed further in the Risk Management and Internal Controls sections), physical security requirements such as security sweeps and threat and risk assessments were not conducted at certain facilities, which may be attributable to limited oversight for these activities. 

Given the decentralized organizational structure, strong monitoring and oversight practices are essential to ensure that physical security activities are carried out in a coordinated and integrated manner across the departments and physical security controls remain current and address significant threats and risks. Specifically, strong monitoring and oversight practices would allow the Departments to identify, escalate and address exceptions where physical security requirements and responsibilities are not being met. In turn, this will promote and better enforce the implementation of individual responsibilities to carry out physical security activities across sectors and regions.

Departmental methodology

The development of TRAs may be either contracted to external security firms or conducted in-house by security practitioners within SAD. As per CIRNAC/ISC's Security Management Framework, the HTRA Methodology is to be adopted and consistently applied when developing TRAs for departmental facilities, including for the identification of assets and threats. While SAD has established a methodology for conducting TRAs, it is not aligned to the HTRA and has not been formally approved. Additionally, the methodology and criteria for assessment are not openly shared with relevant stakeholders, such as those responsible for making decisions on whether to accept or reject TRA recommendations (e.g. regional management).

Attaining senior management buy-in will strengthen the overall credibility of the TRA activity and reinforce the risk management of physical security. With improved transparency, relevant stakeholders will be made aware and fully confident in the process used to reach findings and recommendations.

Monitoring and follow-up

Departmental guidance on when to perform or update a TRA is not well established or communicated. Stakeholders, including regional management and headquarters security practitioners, were not aware of a defined policy statement or guidance on the conditions that should trigger the performance of a new TRA or an update to an existing TRA. In the absence of a well-communicated policy statement, it was unclear to stakeholders whether TRAs should be performed or updated on a regular and defined basis (e.g. every five years), as a result of emerging threats and risks identified at a regional or national level, or as a result of material changes to the physical work environment.

Additionally, monitoring is not being performed by headquarters on the completion of TRAs. Some CIRNAC/ISC facilities have undergone multiple TRAs, while certain other facilities have not been subject to a TRA at all.

Moreover, there is no formalized process for headquarters to follow up on the implementation of recommendations from TRAs performed internally or externally.  We observed instances where TRA recommendations were not tracked to resolution.

As per CIRNAC/ISC's Security Management Framework, action plans are to be created and approved when a TRA report recommends implementing safeguards to mitigate residual risk to an acceptable level. However, at the regional level, there were instances where recommendations were not implemented and there was no supporting action plan or risk acceptance document in place.

While we did observe strong regionally-driven follow-up practices in two regions, whereby action plans for TRA recommendations were established with targeted timelines, assigned accountabilities and active monitoring (including examples of active engagement with SAD), a formal monitoring and oversight process for TRAs has not been established for the entire Departments.

By not proactively monitoring and following up on TRAs, the Departments are not able to ensure that physical security risks are being managed continuously and effectively throughout the Departments. For instance, proactive monitoring can ensure that TRAs are conducted as needed and TRA recommendations are actioned in a timely and effective manner. Furthermore, through effective management and oversight of the TRA activity, CIRNAC/ISC will be better positioned to identify and mitigate pervasive gaps and vulnerabilities that could exist across the Departments.

Training & awareness

Appropriate and up-to-date training activities reduce the risk that physical security is inadvertently compromised by enabling employees to have the necessary knowledge and competencies to effectively perform their physical security responsibilities. Additionally, a departmental security awareness program helps ensure that employees at all levels are informed and regularly reminded of security issues and their security related responsibilities.^{Footnote 13}

CIRNAC/ISC has established a departmental security awareness program that covers physical security. For example, there is an annual security awareness week, whereby security tips and materials are emailed to all CIRNAC/ISC employees. Furthermore, security training material as well as indications that training is delivered to new RSOs exists. Security awareness training is also provided to new employees.

While there are training activities being delivered, there are opportunities to improve. For example, several RSOs expressed the desire for more training opportunities that would allow them to be better equipped to fulfill the broad array of responsibilities (e.g. conducting investigations, delivering regional security training activities) encompassed within managing the regional security activities. Training is essential for ensuring that security practitioners have the necessary knowledge and competencies to not only carry out their specific security related roles and responsibilities but to also transfer knowledge and promote awareness to all employees.

Additionally, staff members in regions often do not receive adequate training on physical security beyond the security briefing received when they first joined CIRNAC/ISC. Examples of job-specific training that could be provided include security training on how to deal with conflict situations involving public interactions as well as how to identify and avoid potentially dangerous situations while travelling. Training should be made available to employees who are exposed to duties and situations by which workplace violence could arise.^{Footnote 14}

Protection

Physical security is required to be fully integrated into the processes of planning and designing facilities.^{Footnote 15} To meet this requirement, CIRNAC/ISC's Security Management Framework specifies that security personnel are to be involved in the development of security design briefs, which is a document that aims to ensure that security considerations and requirements are factored into the planning and design phases for new facilities or renovations to existing facilities. However, instances where the security team was not involved in the planning and design of new facilities or facilities being retrofitted were identified.

While baseline physical security controls were generally observed to be in place at the regions visited, there were several instances of regional disparity in security measures and for which rationale was not known or documented. The following are examples:

• Configuration and safeguards for Registration Offices. Security measures provided for Registration Offices varied from facility-to-facility, including one facility that had no evacuation route to secure space, as well as no plexiglass or panic button in place to mitigate the threat of a hostile client. Additionally, Registration Offices in some regions are outside of the operational zones.
• Safeguards for delivery of treaty payments. Security measures in place for delivering treaty payments varied across regions. Specifically, we noted some regions with limited security measures (e.g. no security escort), which could increase the risk exposure for regional employees.
• Dedication to security roles. Some regions have created or are in the process of creating full-time positions for security roles, while other regions have these roles (e.g. RSO, Deputy RSO) performed part-time.
• Visitor access controls. Some facilities did not have processes in place for visitor sign-in, including having visitors verify their identity and sign a visitor log book. Additionally, visitors are not always provided with a visitor ID badge to identify themselves as an approved visitor to the facility.
• Presence of commissionaires at facilities. Commissionaires are posted at some, but not all CIRNAC/ISC premises, to monitor the control of access within the facility.

While there is no expectation to have a "one size fits all" approach to security across the Departments, there is an expectation that security measures will be commensurate to the level of threats and risks identified. Rationale for disparities in security measures were not always provided or known by interviewees. Furthermore, there was a general expectation of staff interviewed that their office should have similar levels of security as other regional offices. It is essential to leverage the departmental risk management process (i.e. TRAs) to analyze identified threats and risks and ensure that physical security controls and measures are implemented according to the level of risk identified. Taking a risk-based approach will help to ensure that management is addressing their physical security needs on a prioritized basis.

Detection and response

Detection and response are important components in ensuring an active defence strategy against physical security threats, vulnerabilities and incidents. One process employed by the Departments to detect non-compliance with physical security requirements (as well as promote physical security awareness) is security sweeps of facilities, which are governed by the Departmental Physical Security Inspection Procedures and required to be conducted on a routine basis by the Directive on Departmental Security Management.^{Footnote 16} While the documented departmental procedures were considered to be sound, issues related to the frequency, assigned responsibilities and documentation of security sweeps were observed.

There were several instances where security sweeps were not being regularly performed at facilities. Furthermore, sweeps were generally carried out by employees with security roles (e.g. RSOs, headquarters security practitioners); however, there was one observed instance where the task was informally assigned to administrative staff and there were no documented results. Additionally, some sites visited had documented sweep statistics such as the amount and percentage of unsatisfactory results by function, while other sites visited did not have any documented sweep statistics. The Departmental Physical Security Inspection Procedures requires that sweep statistics (e.g. number of annual notices, most common deficiencies) be collected and reported to security personnel, and used to track long-term patterns.

When security sweeps are not carried out, instances and trends of physical security breaches may go unnoticed for a prolonged period, at both a regional and national level.

Another detection and reporting control employed by CIRNAC/ISC is the Security Services Information System (SSIS).^{Footnote 17} SSIS is the primary mechanism used to monitor and report on physical security activities across the departments (e.g. number of incidents in regions/sectors), however, it was noted by headquarters security practitioners that monitoring is generally not performed on the information uploaded to the system. Furthermore, there was a lack of clarity among regional stakeholders on how the information reported in SSIS was used by headquarters for monitoring and decision-making.

We also observed inconsistent practices in the data entry for SSIS. For instance, one region entered security incidents in infrequent batches as time permitted, and it was also noted by headquarters staff that regions did not always upload their incidents within the required timeframe (i.e. every 3 months). Additionally, we observed that the locking devices module (which tracks the departmental inventory of keys, alarms, secure telephones etc.) was limited in implementation (i.e. information not uploaded from regions), and not actively monitored and kept up-to-date.

If there are not consistent practices for uploading and monitoring information in SSIS, the reliability of the system as a central repository for monitoring and reporting on physical security activities may be impacted due to incomplete or inaccurate information.

In alignment with the DDSM, CIRNAC/ISC has established procedures for conducting administrative investigations into security incidents; however, we were informed of issues related to the implementation of these procedures.^{Footnote 18} While there are standard operating procedures specifying how security personnel should be informed of and involved in investigations, it was found that security is not always informed of and fully involved in administrative investigations (both at a regional and national level), including those carried out by Labour Relations.

It is important that there be communication and collaboration with security personnel in investigations so that security input can be leveraged for various activities (e.g. gathering evidence, conducting interviews, closing files) and security-specific responsibilities such as deactivating access cards and retrieving departmental assets for suspended or terminated employees can be fulfilled.