Protective Security Risk Analysis Capability Evaluation

Assess Your Professional Judgement

This capability evaluation examines how you approach protective security risk assessment in practice.

It does not test your ability to recall theory, terminology or numerical formulas.

It assesses how you interpret realistic scenarios, apply professional judgement and reach conclusions that could support operational and strategic decision making.

You will work through 15 scenario based questions covering:

Organisational Need

Threat Assessment

Vulnerability Assessment

Risk Assessment Reporting

Each question contains four responses. Select the answer that most closely reflects how you would approach the situation in practice.

Effective private sector protective security & counter terrorism begins before you assess the site.

Experienced practitioners first understand the operating environment, then the organisation, before designing proportionate protective security measures.

This capability assessment measures your professional judgement, with personalised results providing context, practical insight and clear development opportunities.

Before You Begin

Answer based on your current approach, not the answer you believe is expected.

The assessment takes approximately 4 minutes to complete.

What You Will Receive

Once completed, you will receive a personalised:

Capability Report

Your report will include:

• Your professional capability outcome

• A summary of what your responses indicate

• Your current strengths

• Priority development areas

• Professional insight

• A capability development pathway

• Recommended next steps

Important

For best results, do not game play the questions, answer with your current capability and understanding.

15 Q’s. Immediate Feedback. Free to Access.

Welcome to your Protective Security Risk Analysis Capability Evaluation

You have been commissioned to undertake a protective security risk assessment for a large organisation that is expanding its public facing operations. During the initial meeting, the senior leadership team asks you to identify what additional security measures they should introduce and requests recommendations as quickly as possible.

Which approach demonstrates the strongest professional judgement before beginning the risk assessment?

Discuss management concerns, examine previous security incidents and identify the areas that appear to present the greatest immediate security risk before developing practical recommendations for improvement.

Review the organisation's existing security arrangements, operating environment, previous incidents and management objectives before identifying the assets and activities requiring the highest level of protection.

Review the existing security measures, identify obvious weaknesses and recommend additional protective measures that appear suitable for the organisation's current operating environment and security arrangements.

Establish the organisation's purpose, strategic objectives, critical assets, legal responsibilities, operational priorities and acceptable level of risk before determining precisely what requires protection and beginning the formal assessment.

Following your initial meeting with the organisation, you have developed a clear understanding of its purpose, objectives and operating environment. You now need to identify what requires protection before assessing threats and vulnerabilities.

Which approach demonstrates the strongest professional judgement?

Identify the organisation's critical functions, people, assets, information, reputation, legal obligations, operational dependencies and strategic objectives, then determine what must be protected to sustain organisational resilience and success.

Identify the organisation's buildings, perimeter, equipment and existing security measures, then focus the assessment on protecting these physical assets throughout the operational environment.

Identify the organisation's people, buildings, information, equipment and daily operations, then assess each area to determine which assets appear most valuable or exposed.

Identify the organisation's critical assets, essential activities, information, people, infrastructure and supporting services, then consider how their loss would affect operational continuity and organisational objectives.

You have identified the organisation's critical assets, functions and operational priorities. Before assessing threats and vulnerabilities, you need to establish the protective security requirement that will guide the remainder of the assessment.

Which approach demonstrates the strongest professional judgement?

Determine the areas requiring greater protection, establish realistic security objectives and recommend measures that appear suitable for the organisation's current operating environment and resources.

Define the required level of protection for each critical asset and activity, taking account of operational priorities, legal responsibilities, available resources and the organisation's acceptable level of risk.

Establish clear protective security outcomes by defining what the organisation must continue to achieve before, during and after a security incident, ensuring recommendations remain proportionate, evidence based and aligned with organisational objectives.

Identify security improvements that reduce obvious weaknesses and recommend practical measures designed to increase the organisation's overall level of protection against foreseeable security incidents.

Having established the organisation's needs and defined what requires protection, you begin the threat assessment. During discussions, several managers suggest including every possible security threat so that nothing is overlooked.

Which approach demonstrates the strongest professional judgement?

Identify adversaries with the capability, intent and realistic opportunity to affect the organisation, using multiple intelligence sources, professional judgement and clearly documented assumptions to justify inclusion or exclusion.

Identify credible threats using national guidance, sector intelligence, local information and organisational context, excluding threats that lack reasonable relevance or supporting evidence.

Include every conceivable threat within the assessment to demonstrate a comprehensive review, allowing management to determine which risks should receive the greatest attention afterwards.

Identify threats that have previously affected the organisation or similar businesses, then assess their relevance using available incident records and management experience.

During the threat assessment, management expresses concern about terrorism because of recent media coverage. However, there is little evidence that the organisation is currently an attractive target.

Which approach demonstrates the strongest professional judgement?

Assess whether credible adversaries possess the intent, capability and opportunity to target the organisation, considering intelligence, operating context and previous incidents before reaching a professional judgement.

Evaluate each credible adversary by analysing motivation, capability, target selection, operating methods and likely objectives, ensuring the threat assessment reflects evidence rather than perception or recent media attention.

Consider recent national incidents alongside management concerns, then determine whether existing protective measures remain appropriate for the organisation's current operating environment.

Treat terrorism as the principal threat because of its potentially severe consequences and recommend protective measures designed to strengthen security across the organisation.

Your threat assessment will be reviewed by senior leaders who expect a clear explanation of why particular threats have been included and others excluded. They want confidence that the assessment could withstand external scrutiny.

Which approach demonstrates the strongest professional judgement?

Present a list of identified threats supported by a numerical scoring matrix, allowing management to understand which threats appear to present the highest overall risk.

Produce an evidence based threat assessment that clearly distinguishes verified information, assessed judgement and remaining uncertainty, enabling decision makers to understand, challenge and defend every significant conclusion.

Explain how intelligence, organisational context and professional judgement were combined to identify credible threats, documenting assumptions, limitations and the reasons for each conclusion.

Describe each identified threat, reference the available intelligence and explain why the organisation should consider additional protective security measures where appropriate.

Having identified the organisation's credible threats, you begin assessing its vulnerabilities. The site has CCTV, perimeter fencing, access control, security officers and documented procedures. Management believes these measures mean the organisation has very few significant vulnerabilities.

Which approach demonstrates the strongest professional judgement?

Assess how a credible adversary could exploit people, procedures, physical security, technology and organisational behaviours, determining whether existing controls would prevent, detect, delay or respond effectively.

Review the existing security measures, identify any obvious weaknesses and recommend practical improvements where current security arrangements appear to require further enhancement.

Assess the effectiveness of physical security measures, operating procedures and security personnel to determine where existing arrangements may be improved or strengthened.

Assess how existing physical, procedural and personnel controls perform against each credible threat, identifying weaknesses that could realistically be exploited by an adversary.

The organisation has invested heavily in physical security, yet previous incidents have involved contractors bypassing procedures, staff allowing unauthorised access and poor reporting of suspicious activity.

Which approach demonstrates the strongest professional judgement?

Review existing procedures, staff responsibilities and access arrangements to identify where additional supervision or revised processes may improve security.

Recommend additional physical security measures to reduce opportunities for unauthorised access and improve protection across the organisation.

Assess how human behaviour, organisational culture, supervision, decision making, contractor management and security awareness combine to create exploitable vulnerabilities.

Assess whether organisational culture, staff behaviours, contractor management and procedural compliance create exploitable vulnerabilities.

The organisation asks whether its current security measures are adequate because they comply with recognised standards and have performed well during previous audits.

Which approach demonstrates the strongest professional judgement?

Compare existing security measures against recognised good practice, identifying areas where additional improvements could further strengthen organisational protection.

Confirm that existing security measures broadly satisfy recognised standards and recommend maintaining current arrangements unless significant changes occur.

Assess whether existing protective measures effectively reduce the vulnerabilities identified during the assessment, considering operational effectiveness rather than compliance alone.

Test whether existing controls would realistically prevent, detect, delay, respond to and recover from actions taken by each credible adversary.

Your vulnerability assessment will form a significant part of the final protective security risk assessment. Senior leaders want confidence that your conclusions are evidence based and capable of supporting important investment decisions.

Which approach demonstrates the strongest professional judgement?

Demonstrate how each vulnerability could be exploited by a credible adversary, explain the effectiveness of existing controls and justify every conclusion.

Explain how vulnerabilities were identified through observation, evidence, interviews and professional judgement, demonstrating why each finding could reasonably affect organisational security.

Summarise the identified vulnerabilities, assign appropriate risk ratings and recommend improvements that appear practical within the organisation's available resources.

Describe the identified vulnerabilities, explain how they affect current security arrangements and recommend improvements supported by recognised protective security guidance.

You have completed the organisational needs assessment, threat assessment and vulnerability assessment. Several vulnerabilities have been identified, but available intelligence indicates that some threats remain unlikely to occur. Senior management asks whether the organisation should invest in additional protective security measures.

Which approach demonstrates the strongest professional judgement?

Assess how credible threats, exploitable vulnerabilities and potential consequences combine to create organisational risk, recommending measures that provide proportionate and justifiable improvement.

Recommend additional protective security measures wherever vulnerabilities exist, reducing the organisation's overall exposure regardless of the assessed likelihood of each identified threat.

Apply professional judgement by evaluating organisational need, credible threat, exploitable vulnerability, existing controls and potential consequences, ensuring every recommendation is evidence based, proportionate and operationally justified.

Compare identified threats and vulnerabilities before recommending practical improvements that appear proportionate to the organisation's current operating environment and available financial resources.

Your assessment identifies several recommended improvements, but the organisation has limited resources and cannot implement every recommendation immediately. Senior leaders request advice on which actions should be completed first.

Which approach demonstrates the strongest professional judgement?

Prioritise recommendations according to organisational need, threat relevance, vulnerability exploitation and likely consequence, achieving the greatest overall reduction in risk.

Recommend improvements that address the most obvious vulnerabilities while balancing operational impact, available funding and management priorities.

Recommend implementing the least expensive improvements first, allowing visible security enhancements while planning for more significant investment during future budget cycles.

Prioritise recommendations using evidence, organisational objectives, credible threat, exploitable vulnerability, proportionality and operational benefit.

During the assessment, intelligence regarding one potential threat remains incomplete. There is insufficient evidence to confirm whether the threat is developing or whether recent activity is entirely unrelated.

Which approach demonstrates the strongest professional judgement?

Record the available information, explain the uncertainty and recommend reviewing the assessment should additional intelligence become available.

Increase the assessed threat level until additional intelligence becomes available, ensuring the organisation adopts the highest practical level of protective security.

Clearly distinguish confirmed information, assessed judgement and remaining uncertainty, explaining how each influences the assessment while identifying intelligence requirements.

Assess the available evidence, identify assumptions and explain how uncertainty influences the current judgement while recommending proportionate monitoring.

The completed assessment will be presented to the Board of Directors following a significant increase in public concern regarding terrorism and hostile activity. Senior leaders require confidence that your conclusions are credible, balanced and capable of withstanding external scrutiny.

Which approach demonstrates the strongest professional judgement?

Explain how organisational need, threat assessment, vulnerability assessment and professional judgement combine to support each recommendation.

Present the identified threats, vulnerabilities and recommended improvements, ensuring each conclusion is supported by recognised protective security guidance where appropriate.

Present a comprehensive assessment supported by recognised risk matrices, numerical scoring and detailed appendices demonstrating the extent of the completed analysis.

Produce a balanced, evidence based assessment that explains not only the conclusions reached, but also the reasoning behind them, enabling senior decision makers to understand.

Following completion of your protective security risk assessment, the Chief Executive asks a simple question. "How do I know this assessment provides a reliable basis for making important organisational decisions?"

Which response demonstrates the strongest professional judgement?

The assessment examines organisational needs, identified threats and existing vulnerabilities, providing recommendations intended to strengthen security using recognised professional practice.

The assessment integrates organisational objectives, credible threats, exploitable vulnerabilities and proportionate recommendations, ensuring conclusions are supported by evidence and professional judgement.

The assessment follows recognised protective security guidance, considers current security arrangements and includes practical recommendations supported by an established risk assessment methodology.

The assessment provides a transparent, evidence based judgement that explains organisational need, credible threat, exploitable vulnerability, existing controls, residual risk and recommended actions.