Physical Security Guidelines for Financial Institutions - ABS

1 Page 1 of 43 Physical Security Guidelines for Financial Institutions Physical Security Guideline for Financial Institutions Page 2 of 43 TABLE OF CONTENTS FOREWORD 3 INTRODUCTION 4 1. THREAT AND VULNERABILITY RISK ASSESSMENT 5 Vulnerability Assessment 5 Impact Analysis 6 Evaluating Risk 7 Risk Treatment 7 2. PROTECTION 8 Key Concepts - Layers Approach to Physical Security defence 8 Infrastructure 10 Systems 14 People 17 Procedures 18 3. DETECTION 19 system Detection 19 Monitoring 19 Detection Strategies 20 Security Intelligence 21 4.

2 RESPONSE 22 Preparation 23 Personnel Security 23 Protocols 23 Incident Response 24 APPENDIX: BUILDING MANAGEMENT ENGAGEMENT GUIDE 28 Physical Security Guideline for Financial Institutions Page 3 of 43 FOREWORD Since September 11, 2001, the threat of terrorism has increased globally. Governments around the world have stepped up counter-terrorism measures and are coordinating efforts through a combination of legislative, Financial and Security mechanisms. Terrorism-related incidents have risen both in frequency and severity and are also occurring in closer proximity to Singapore.

3 The Singapore Government, for its part, has various programmes in place to mitigate the risk of terrorism. They include border control to prevent the entry of radicalised individuals; restrictions on the import of various controlled items including arms, explosives and bomb-making materials; intelligence sharing with Southeast Asia neighbours, and public education on the need to stay vigilant. The Association of Banks in Singapore (ABS) has also addressed the threat to Physical Security posed by terrorism and its potential impact to the Financial industry.

4 The safety and Security of our employees is of utmost importance and we need to ensure that we have contingency plans in place in the event of a crisis that poses widespread systemic risk. On this note, an industry-wide business continuity exercise known as Raffles Exercise is conducted once every three years to test industry-wide cooperation and response to major operational disruptions affecting the Financial sector as a result of a terrorist attack. We included various Security incident scenarios, such as swarm attacks, hostage situations, bomb threats, vehicular ram attacks etc.

5 These exercises typically involve the relevant stakeholders such as regulators, ABS members and infrastructure provider. To ensure traction and follow through, a Standing Committee for Physical Security was established in 2017. The committee provides a mechanism for banks to share, collaborate and address the processes for better Physical Security and emergency responses. This guideline aims at consolidating and enhancing the Baseline Security Guidelines issued by the ABS in 2013.

6 This updated guideline provides additional guidance to advisories issued by the Ministry of Home Affairs (MHA) on matters ranging from Security measures to responses. They also complement the Guidelines on Enhancing Building Security (GEBSS) issued by MHA in 2013. The GEBSS provides comprehensive and specific technical information on Physical Security measures while the ABS Guidelines provide guidance from a functional perspective. Key elements are included and customised bearing in mind the environment and the type of buildings banks typically operate in Singapore.

7 The ABS encourages members to utilise these Guidelines to actively enhance the state of Security programmes in buildings they operate from, as well as to create awareness among employees in Security responses. They should also engage their landlords or building management to ensure coordinated responses and to proactively participate in relevant Security programmes. Safety and Security cannot be compromised. So let us all do our part to protect Singapore, customers and employees.

8 Ong-Ang Ai Boon, Mrs Director The Association of Banks in Singapore October 2018 Physical Security Guideline for Financial Institutions Page 4 of 43 INTRODUCTION The Financial service sector comprises over 1,200 Financial Institutions and is a critical component of Singapore s economy, contributing to about 25 to 30 per cent of the country s gross domestic product growth over the past years. Securing the environment of the Financial services sector is a continual and challenging effort.

9 We need to balance between the protection needs of the sector whilst maintaining the conducive and open business environment that has allowed the sector to thrive. Adopting a risk-based approach to developing a Physical Security programme will enable each Financial institution (FI) to manage its Security risks and protection needs in accordance with its circumstances and risk appetite whilst maintaining an environment that is conducive for its businesses. Singapore remains a prime target for criminals and terrorists to launch attacks on various critical infrastructures, with FIs amongst the top targets.

10 Criminals and terrorists target Singapore for its significant role in the global Financial industry. FIs in Singapore are typically located in office buildings, retail spaces such as shopping malls and town centres that are typically close to transportation hubs and busy public spaces. Such locations are typically targeted due to the high human density and are perceived as soft targets by terrorists as compared to a well secured government facility. The levels of protection recommended in this guideline and in the Ministry of Home Affairs (MHA) Guidelines to Enhanced Building Security in Singapore (GEBSS) establish a foundation reference for the deployment of additional protective measures as threat levels increase.