WAR IN IRAQ AND ONGOING THREAT OF TERRORISM COMPEL NEW URGENCY TO MISSION OF SECURITY AND PROTECTION C-level Executives, Companies Should Take Specific Actions to Protect Employees and Help Ensure Business Continuity in Volatile Global Climate New Surveys Reveal that Businesses Show Complacency, Lack Emergency Response Plans, Ignore Government Warnings Critical Actions for Chief Executive Officers New York, New York March 20, 2003 In terms of overall security in corporate America, little has changed since September 11, 2001. The war against terror now coupled with the war in Iraq requires that Chief Executive Officers, Chief Operating Officers and other C-level executives take immediate action to protect their organizations. We must recognize that the United States of America is vulnerable to attack, sabotage and espionage along with every state, municipality or community, said Ira A. Lipman, Chairman and President of Guardsmark, LLC. It is erroneous to make the assumption that we are safe just because we are in the United States of America. September 11, 2001, has clearly changed that, and with the war on Iraq, we need to understand that we must do more than ever before. Mr. Lipman recommends the following steps for senior executives: Ask the executive committee what conditions currently exist that would allow a successful, aggressive attack against the facility. Create an environment of cooperation and understanding about war, terrorism and the security mission. It is important to get all levels of the organization involved with this critical task. Have an immediate conference with the security director and give him or her what is needed to bring the security program to the appropriate level. The company must prepare a defense against the most credible threat that can impact business continuity. Dust off those security projects and recommendations that were rejected in previous years. Identify any departments that may have interfered with the security mission. The Chief Security Officer must have full, open communication with the CEO, COO or CAO. He or she needs access to the CEO in the case of a serious problem concerning policies or lack of funding.
Page 2 Methods to Secure the Workplace Businesses need front-line preparedness in the war on terrorism because they are on the front line. The 9/11 destruction of the World Trade Center showed that no target holds more appeal for terrorists than major corporate facilities. Workplaces remain top terrorist targets because of their high visibility, institutional symbolism and large concentrations of people. Private security is the first line of defense. There are three times as many private security officers as there are public safety officers. That means that private security forces are the ones most likely to provide the initial onsite response to a security breach or to a terrorist attack. Security is not a commodity. In order to create the most secure environment possible, a company should carefully choose the organization and the people responsible for protecting employees and corporate facilities. Following are steps that businesses should take to ensure a good front-line defense against potential terrorist attack or natural disaster: 1. Assess the Type of Risk the Company Faces Thoroughly review and analyze the types of risks that employees might face due to industry factors, geographic location, nature of occupation and all other key variables. Engage a risk-assessment team to assist with a security audit so that the company can be sure of getting a full, accurate assessment of its risks, as determined by professionals who have a thorough understanding of realworld threats. Implement and install the recommendations from the risk analysis. Failure to act on identified vulnerabilities can expose a company to legal liability. 2. Control Risk With Consistent Solutions Regulate access to business facilities. Gates, concrete barriers, bollards or even trees and planters can strengthen perimeter control around a building. Staff sensitive access points with trained security personnel. Install intrusion detection systems, or review existing systems and repair if necessary.
Page 3 Install durable locking hardware on all entrances and maintain strict control of all keys and pass cards. Install CCTV cameras at critical points throughout the facility. Log in all visitors by name, date, time and name of person visiting. Escort all visitors at all times. Reserve the right to inspect items carried in or out of the company premises. Prohibit any photography of the facility without company authorization. Protect and restrict access to elements of the organization that are sensitive to biological or chemical attacks, including water supplies, food preparation areas, and heating, ventilation and air conditioning systems. Identify shut-off controls for HVAC system. Include in the emergency response plan a specific person responsible for shutting down HVAC system in the event of a suspected chemical or biological attack. Ensure that all incoming mail and packages are handled at a centralized, secure location where they can be scrutinized. Inspect all incoming mail. Never accept unexpected packages. Positively identify all delivery personnel. Develop strict times for receipt of deliveries. Document all deliveries by time, date and name of delivery service. Remove all deliveries from the dock or delivery area immediately. Distribute and display U.S. postal information regarding suspicious packages. Mailroom employees should be trained to look for warning signs such as: Foreign substances Excessive postage Poorly written or incorrect addresses No return address, and Packages originating from an unfamiliar source Back up electronic and paper files in a secure, off-site location to help ensure business continuity. Include employee phone numbers and addresses. Establish an employee awareness program, ensuring that employees know whom to report to if they detect a suspicious person or incident.
Page 4 3. Implement Emergency Preparedness Plans Develop and practice an emergency response plan. Address acts of terror, including biological, chemical, radiological and conventional explosives attacks, as well as acts of violence in the workplace and natural disasters. Have a communication plan in place for contacting all employees in the event of disrupted phone service. Have an evacuation plan in place, taking into full account all relevant factors of building and site design. Designate a specific meeting location where personnel gather after evacuating the premises. Develop a building lockdown method to effectively complete the lockdown of the facility within 30 seconds. Develop specific plans to respond to any increase in homeland security threat levels. Develop a plan of communication and coordination with emergency response groups. Establish a liaison with emergency response groups. Know the capabilities and limitations of local emergency response groups. Assign responsibilities and identify successor personnel for essential tasks including evacuation, communication, fire safety and critical business operations. Communicate the preparedness plan to employees so each of them knows exactly what to do in case of evacuation. This briefing can take place during regularly scheduled safety and security meetings, coordinated by the security department, if applicable. Orchestrate frequent drills to ensure that employees not only know what to do but can also put that knowledge into action. Maintain adequate stores of basic supplies in the event that evacuation is not possible: e.g., drinking water, canned food, flashlights and batteries, and a transistor radio. These items can also support a skeleton staff remaining at the site. For larger organizations: Provide alternate communication methods, such as satellite telephones, to enable senior management to maintain contact if public communication is interrupted.
Page 5 4. Screen Employees Terrorist threats can come from inside an organization as easily as from outside. Today, companies must be especially alert to the danger of sleepers enemy agents who establish themselves in society until called into action. A thorough employee screening process should include verification of: Legal work status as permitted by law Work history Educational institutions and degrees earned Professional accreditation, driving and criminal records Credit history as permitted by law Personal references Military discharge status (where applicable) Businesses should remember to screen non-staff workers as well. This calls for special care in selecting vendors such as external auditors, food service providers, temporary employees, building maintenance services, etc. 5. Maintain Open Communications Communicate risk. A company s first priority should be to increase employees awareness that the risk of terrorism is real and convince employees that security plans and precautions should be taken seriously. Manage fear. A company should hold employee seminars and publish bulletins to raise employee awareness of potential threats and of the efforts management is taking to counter those threats because nothing combats fear of the unknown like knowledge. Organizations should encourage personnel to create a family plan to reduce employees concerns for loved ones in the event of an emergency. Establish a toll-free hotline or a message board on the company web site or intranet to allow employees to voice concerns, express fears and provide information to management. This communication helps security people do a better job and helps stifle rumors that could damage organizational morale and effectiveness. Being on the front line in the war on terrorism as businesses are is not easy. But if businesses follow these basic five steps, they can substantially reduce their security risks and create a more secure environment for employees in the event of either a terrorist attack or a natural disaster.
Page 6 New Surveys Reveal Ongoing Complacency Businesses throughout the United States ignore color-coded warnings from the federal government, lack solid emergency plans, and are generally unprepared for another terrorist attack, according to new surveys examining the security procedures and attitudes about security from hundreds of security directors and workers around the nation. The surveys, taken from interviews with corporate security professionals and the general public and released today by Guardsmark, one of the world's largest security service companies, found that although security professionals and the general public realize there is a threat of more terrorism, their companies are generally complacent about the importance of workplace security and protection. In fact, 70% of security professionals and 54% of the general public say that their companies are very complacent about the importance of good security. Other Key Findings: 58% of security professionals and 66% of the public perceive that security in the workplace is too loose and relaxed principally because there has not been any terrorism in the United States lately. More than half of the American people - 54% - report that their companies are not doing anything to prepare for what could happen over the next several weeks. At the same time, 96% say the threat from terrorism today is serious, and 62% say that a war with Iraq increases the possibility of terrorism. Just 41% of the public feels their workplace is very safe and just 33% feel that where their family members work is very safe. Complacency is the key word, according to Ira A. Lipman. Security professionals and the public are acknowledging that new threats are out there, but they widely agree that their companies are too complacent with their own security. Security Professionals and the General Public Feel Safer At Home Than At Work By a wide margin, the general public and security professionals feel safer at home than in the workplace. In fact, by an 8 to 1 margin, security professionals said they feel safer at home than at work. Only 9% of security professionals and 7% of the general public say they feel safer at work; 66% and 70% respectively say they feel safer at home.
Page 7 Companies Are Lacking Effective Emergency Response Plans In response to questions about the steps being taken by companies in terms of security and protection, security professionals and the general public say that many common security measures are not required at their companies. -- 55% of security professionals responded that their companies are not creating backup facilities at other sites -- 45% are not conducting emergency drills -- 44% are not backing up files and documents at distant locales -- 41% are not creating more effective firewalls -- 40% have not conducted tighter background checks on new employees -- 6 in 10 security professionals say their companies are unprepared for a chemical or biological attack. Companies Unresponsive to Federal Government Warnings Companies are also ignoring warnings coming from the Department of Homeland Security. Less than 1/3-31% - say they take the Homeland Security Warning very seriously and a virtually identical number - 30% of security professionals and 27% of the general public - feel it is a very effective system. 61% of the public says a change in the colors does not lead to a change in policies or actions at their firm. First-Ever Guardsmark Security Index In the first-ever Guardsmark Security Index, commissioned because of the company s interest in determining perceptions and practice towards workplace security and based on the average responses of security professionals and the general public, companies received a score of 52 out of 100 based on the opinions from security professionals; companies received a 36 out of 100 based on responses from the general public. The indices are scored off of a scale of 0-100. 100 represents the perception that security arrangements have achieved optimal effectiveness; 0 represents the perception that the security arrangements have totally failed to achieve the desired results. Security professionals as well as the general public agree that businesses are not well prepared to face the increased threat of terrorism that would come as a result of war with Iraq, said Mr. Lipman. About the Guardsmark Security and Protection Surveys On behalf of Guardsmark, Penn, Schoen and Berland, a strategic marketing research firm, conducted 601 interviews among general population Americans, and 203 interviews with security professionals. The interviewing took place between Friday
Page 8 March 7, 2003 and Wednesday March 12, 2003. The margin of error of the general population sample is +/-3.99%. The margin of error of the security professionals sample is +/-6.92%. About Guardsmark, LLC Guardsmark operates in more than 400 cities throughout North America, employing 18,000 people, including more former FBI agents than any other company in the world. Guardsmark is the first security services firm to attain ISO 9001 registration at its U.S. home office and a growing number of branch offices. Ira A. Lipman, who founded Guardsmark in 1963, is the author of How to Protect Yourself From Crime, the most complete guide to self-protection in print. ### For further information or to arrange an interview, please contact: Jason Schechter, 212-484-7415 Lisa Wolford, 212-484-7058