Implementing Project Security Practices
This guide was developed to assist with the implementation of findings of a joint Construction Industry Institute (CII) and National Institute of Standards and Technology (NIST) study completed in 2003 to determine best practices for project security of industrial projects. The study, a collaborative effort among industry, academia, and government, identified practices for implementation during the planning and execution phases of projects to make facilities more secure throughout their life cycles. The development of the practices is documented in a CII technical report, BMM 2004-10 (available through CII) and a Grant Contractor Report, NIST GCR 04-865, distributed by NIST. The technical report, while focused on practice development, also offers a methodology for assessing the level of implementation of the practices and thus a means for quantitatively assessing impacts on project outcomes. This guide is intended to assist in moving the practices from the realm of research to the field for implementation. While it does not provide specific guidance for the implementation of security procedures at the project level, it offers a framework for integrating security into the project delivery process in the context of likely threats facing the facility and consequences of security breaches.
Chapters 2 and 3 present the practices identified and offer a methodology for their use. Chapter 4 explains the scoring of the level of practice implementation and offers options for automating this process. Quantitative assessment of practice use enables meaningful comparisons across projects and perhaps ultimately, the establishment of norms for various types of facilities given their individual security settings. Organizations are encouraged to explore the tools presented in this chapter and to contribute to the establishment of norms for security implementation. For those who plan to utilize the security practices without assessing their level of implementation, reading chapters 1–3 and 5 is sufficient.
