Security situation report under DIN SPEC 14027. The five phases of clause 6

DIN SPEC 14027, the standard for physical corporate security initiated by the German Federal Ministry of the Interior ², devotes a field of action of its own to the security situation report. It means the continuous collection, assessment and presentation of all information that matters for the security situation of the organisation. That ranges from potential threats and concrete risks to incidents that have already occurred. Form and depth depend on the information needs of the recipients, and anything from a table of figures to a map is permitted ¹. The purpose is to detect threats early and create transparency so that management can take informed decisions.

The key word is continuous. A situation report in the sense of the standard is not a document produced once a year but a process with defined roles, sources, assessment rules and products. Scope and depth may be adapted to the organisation's security level, but all five phases must be completed.

Before the first item is assessed, the standard demands foundations. Top management bears responsibility, appoints a responsible function with the necessary competences and defines the circle of recipients. The minimum requirements for the report and the process must be documented in a set of rules covering scope, objectives, roles and interfaces. A monitoring system and a monitoring process are also required. At security levels A and B the monitoring system is mandatory, at levels C and D it is a recommendation. Organisations with a high protection requirement must additionally examine whether to set up a strategic situation centre. The standard does not demand the centre, it demands the examination.

The first phase answers the question of who needs which information, in what form, when and for what purpose. A plant manager needs something different from the board, the crisis team something different from the people responsible for travel security. The need may be permanent, such as continuous observation of the surroundings of a site, or limited in time, such as for a major event or a business trip to a crisis region. The interval at which top management is informed is also defined here. Anyone who skips this phase will later produce reports that nobody reads.

The second phase is the systematic and continuous collection of information. Sources are internal and external. Internally, employees, plant security, human resources or IT report. Externally, partner organisations, public authorities, service providers and openly available sources such as media and social networks come into play. The standard requires reporting sources to be identified, defined and documented, and it expressly allows an external service provider to be involved if the organisation cannot carry out the collection itself ¹. Besides the general situation, the organisation's own facilities, installations and service providers are among the things to be observed.

Collected items are not yet a situation report. In the third phase they are analysed, assessed and classified according to a defined system with thresholds. The standard refers to the five Ws for this. Who, what, where, when and why. Added to this are an assessment of the situation, a forecast where needed and an estimate of the impact on the organisation and its assets. It is important to recognise connections between items and recurring patterns. A single item says little, ten similar items in three months say a lot.

The fourth phase turns the assessment into products for the recipients, in a format defined in advance. As examples the standard names a weekly situation report and a quarterly threat catalogue. In practice, alerts on individual incidents and situation reports for specific occasions are added, such as for an event or a business trip. The standard requires the products to be prepared for their audience. Plain language, traceable sources and an explanation of what the information means for the organisation have proven useful for this.

Top management is informed at regular intervals and when the need arises, promptly where the protection requirement is very high. The situation report must also connect to other management systems and existing situation reports so that information does not disappear into silos.

The fifth phase closes the loop. The entire process is reviewed regularly to check whether it meets the need, whether the sources are still the right ones and whether the products reach their recipients. The findings of the situation report also feed into the protection requirement analysis, and a changed protection requirement is communicated to the units concerned. The result flows back into the first phase. This evaluation is the difference between a situation report that has frozen into routine after a year and one that grows with the organisation.

The security situation report does not stand alone. The standard names as interfaces the protection requirement analysis, which the situation report supplies with information on threat intensity, disruption, emergency and crisis management, event security, travel security, site security, know-how protection, supply chain security and the security management system ¹. In practice this means the responsible function should agree fixed handover points with the owners of these fields. When does the crisis team receive an ad hoc alert, when does an observation feed into the threat intensity of a site, who informs travel security about a changed situation in a destination country.

Three mistakes occur frequently in practice. First, source monitoring starts before the need has been clarified, with the result that a lot is collected and little is used. Second, the assessment system is missing, so every item appears equally urgent and the recipients become numb. Third, evaluation is forgotten, so sources become outdated and products miss recipients who have long since moved to other roles. All three mistakes can be avoided with the five phases of the standard if they are tackled in the prescribed order.

Of the five phases, the collection of information and parts of the assessment in particular can be supported technically. OSINT monitoring observes open sources in many languages around the clock, assigns items to topics and places, checks claims against independent reporting and condenses the result into a continuously updated situation report with source references. Determining the need, setting thresholds, internal sources and the assessment for the organisation itself remain the task of the responsible function. How the AegisSight Monitor supports the implementation of this field of action and what remains with the organisation is shown in the mapping on our page Security situation report under DIN SPEC 14027.