Page 29 - CITS Theft Guide

CITS Guide for Theft Prevention
- 29 -
10. Incident Response and Exercising
No defensive layer will reduce risk to zero, so every site should have a pre-planned, resourced, and
rehearsed response to a security incident, cognisant of the size and adversarial threat relevant to the site
or project.
10.1. Pre-Planned Response
A response plan should set out who is contacted and in what order (site management, the monitoring
provider, the police, and where relevant the client and insurer), what information should be recorded
(crime reference number, description and identification numbers of items involved, and photographic
evidence), and what immediate physical actions should be taken to reduce further loss.
10.2. Engaging Police and Emergency Responders
CITS recommends engaging local police and, where relevant, national units such as the National
Construction and Agriculture Theft Team (NCATT) or the National Rural Crime Unit, at the planning stage,
not only after an incident. This relationship supports faster response, better intelligence sharing, and,
where appropriate, participation in exercises.
10.3. Table-Top and Live Exercises
The response plan should be communicated to, and practised with, all relevant stakeholders. This can take
the form of a table-top exercise, talking through a simulated incident, or a live play exercise involving a
simulated intrusion, ideally involving local police and emergency responders. Exercising should be
proportionate to the size and threat profile of the site, but even a modest site benefits from a short table-
top run-through at project start-up.
10.4. Post-Incident Review
Every actual incident, near miss, or every exercise, should be followed by a short review capturing what
worked, what did not, and what should change in the site security plan, the Security Aspects Letter, or the
training programme described in Section 7.
11. Continuous Improvement and Governance Review
Security is not a fixed state but a continuing process. CITS recommends that the assessment described in
Section 4 is repeated whenever the site changes materially — at the transition between project phases,
following a change in the threat picture reported by police or industry bodies, or following any actual
incident or near miss — and that this guide itself is reviewed periodically against current legislation,
standards, and technology.