TSA Pipeline Security 3.2: 3.2 Security plan elements

The plan should incorporate, in the format best suited to the organization, the recommended elements: system description; security administration and management structure (who is responsible and the duties of security personnel); risk analysis and assessment methodology including criticality assessments and SVAs; physical security and access control measures; equipment maintenance and testing; personnel screening (employee background checks with disqualification criteria and appeal process under Federal and state law, and contractor checks); communications for routine and emergency use, including equipment, methods between personnel, facilities and off-site responders, and notification of government and law enforcement; personnel training (equipment operation, awareness, incident recognition and reporting for staff and contractors); drills and exercises with after-action reports, lessons learned and improvements; security incident procedures (what constitutes a breach, investigation, who is notified, reference to the emergency response plan); NTAS response procedures for heightened threat; plan reviews; recordkeeping for assessments and sensitive security information with disclosure controls; cyber/SCADA system security measures (a separate cyber/SCADA plan incorporated by reference); essential internal and external security contact listings; security testing and audits with documented results; and outreach to neighbors, law enforcement, media and the public.