Protective Security
Risk Management

​Q1. What is Protective Security Risk Management?

​

Protective Security Risk Management (PSRM) is a structured approach to identifying, assessing, and managing security risks to people, information, and physical assets. It helps organisations understand what threats they face, how vulnerable they are, and the potential consequences, so they can make informed decisions about security measures.

​

In summary, In summary, PSRM ensures an adaptive, proportionate, and sustainable risk-based framework, built on thorough and ongoing security risk assessment. This enables organisations to remain protected in a cost-effective manner that maintains operational continuity and supports business success.

​

Q2. What are the elements to Protective Security Risk Management?

​

Identify Critical Assets and Systems – Determine what assets or systems, if lost or unavailable, would disrupt operations or significantly impact business objectives.

​

Categorise and Classify – Categorise the importance of assets and classify the sensitivity of information.

​

Identify Threats and Vulnerabilities – Understand who may wish to cause harm, what methods they might use, which assets they are targeting, and the potential impact.

​

Assess and Record Risk – Evaluate inherent and residual risks (after mitigation). Maintain security risk registers and critical asset registers, ensuring the senior risk officer is regularly briefed on significant changes.

​

Design and Implement Controls – Select and apply controls that are proportionate, cost-effective, and aligned with the organisation’s risk appetite, while avoiding unnecessary disruption to operations.

​

Assurance and Continuous Review – Maintain confidence in security measures through structured reviews, audits, and testing to identify and address gaps or failures.

​

Q3. What are the Principles of Protective Security Risk Management?

​

• Deter – Discourage or displace acts of crime / unauthorised activity.

• Detect – Identify and verify criminality / unauthorised activity.

• Delay – Slow down the progress of criminal acts / unauthorised activity reaching critical assets, including measures that obstruct crime in action.

• Mitigate – Minimise the potential consequences of crime / unauthorised activity.

• Respond – Take action to prevent criminal acts from succeeding, secure evidence ,and support the detention and prosecution of offenders.​

​