Background
Nuclear sites are spending considerable time and money on upgrading security arrangements to meet more and more stringent corporate and regulatory requirements. Increases in operational security costs at nuclear facilities have risen steadily over recent decades; estimates now suggest that the operational security budget at nuclear power facilities has increased by a factor of x4 since 9/11; what used to cost 5 million now costs 20 million.
Much of the increase can be attributed to the cost of enhanced guarding arrangements, a higher ratio of armed guards or police being deployed at nuclear facilities, and greater attention being given to cybersecurity measures.
In spite of such expenditure, however, it remains difficult to analyse security costs in order to determine whether the security choices being made are also the best investment decisions and to demonstrate whether the balance of expenditure is right.
It’s a complex problem that starts with the national threat assessment, the design basis threat for the nuclear sector and the assumptions made about adversary capability and intent. It also depends on the risk appetite of the government, regulator and licensee and their assessment of the reputational and financial consequences of a successful attack on security.
We know that calculating a conventional return on investment (ROI) is challenging for nuclear security programmes because of the lack of real data, but that doesn’t lessen the need to prioritise and justify security expenditure – and to justify the balance between expenditure between security areas, such as physical protection, cybersecurity and security awareness/culture.
A lot can be learned from other business sectors, such as aviation, where the analysis of ROI and annualised loss expectancy (ALE) are required to justify whether a particular security investment is worthwhile. Although the nuclear industry operates in a different context, how organisations approach security expenditure analysis is comparable. Encouraging a wider discussion on nuclear security expenditure and reviewing security expenditure analysis originating from other sectors would support the development of financial models to help inform decision makers in the nuclear industry. Ultimately, it would lead to identifying metrics helping to ensure that security expenditure is targeted at the most effective measures and that unnecessary expenditure are reduced.
Objectives
The Security Awareness Special Interest Group (SASIG) and WINS partnered together to provide senior security professionals from all sectors with an opportunity to debate these issues, share best practices and new approaches, and encourage the development of financial models to help inform decision makers in the security industry.
This important joint initiative addressed such questions as:
- What is the current state of security expenditure and the trends that are being observed?
- What is the trend in nuclear security-related incidents, worldwide?
- What systems of risk assessment and investment justification methodologies are currently being used?
- How credible is it to allocate financial expenditure to each major element of the design basis threat? Would this provide useful information?
- How useful is modelling and simulation to help assess whether security expenditure is effective and efficient?
- What can we learn from the risk management approach to safety and other fields in the nuclear sector?
- What can we learn from other sectors that need effective physical protection, such as aviation security, and that are experiencing cyberattacks?
- Are there technological developments that could reduce the financial costs of security? Over what timescale might they be deployed?
Audience
This event was designed for a group of 50 delegates, including 25 representatives of the nuclear sector. This workshop targeted experts and leading thinkers in security matters, performance evaluations and financial matters.
Attendees included:
- Security managers from (but not limited to) the nuclear industry, financial services and critical national infrastructures
- Business managers who approve security expenditure
- Regulators and other governmental organisations
- Modelling and simulation vendors
- Academics
- Security experts, consultants and vendors
