The BlackTrace Protective Security Assessment Framework

Stage 01

Define

Establish what must be protected, from whom, and to what standard.

Every engagement begins by establishing context rather than by inspecting controls: what the organisation is protecting, which functions depend on it, what obligations apply, and what a realistic adversary would be trying to achieve. Judgements formed before this point are assumptions. Define also fixes the governance of the engagement — scope, constraints, excluded areas, named contacts and stop conditions, recorded in writing before any assessment activity takes place.

• Scope, objectives and success criteria agreed in writing
• Sites, critical assets, dependencies and single points of failure identified
• Threat picture developed with the organisation and from open sources
• Regulatory, contractual and sector security obligations identified
• Previous findings, audits and known issues reviewed
• Rules of engagement, constraints and stop conditions agreed and authorised

Output  An agreed scope and assessment plan that both parties have signed.

Stage 02

Assess

Gather evidence on how protective security is designed, and on how it is practised.

Assessment covers physical, personnel and procedural security as one system. We examine governance and documented arrangements, then establish how they function on an ordinary working day — under staffing pressure, during contractor works, out of hours, and where responsibility passes between teams.

Adversarial method belongs to this stage. Where proportionate and authorised in writing, arrangements are tested from the position of a capable adversary; where it is not proportionate, the framework proceeds without it.

• Governance, policy, standards and procedure review
• Site survey: perimeter, built environment, access control, detection and response
• Personnel security: vetting, visitors, contractors, privileged access and culture
• Interview and structured observation of routine operation
• Where authorised: physical intrusion testing, hostile reconnaissance and social engineering
• Where explicitly authorised: validation of the technical exposure that physical compromise creates

Output  A documented evidence base: observations, artefacts, timelines and photography.

Stage 03

Analyse

Establish what the evidence means, and separate material risk from theoretical concern.

A list of weaknesses is not an assessment. Analysis establishes what each weakness genuinely enables in operational terms, how weaknesses in separate domains combine into a credible route, and where practice has diverged from design. Findings are set against recognised good practice and regulatory expectation, so the organisation sees not only what is weak but how far it sits from where it should be. Where the evidence does not support a finding, the finding is withdrawn.

• What each weakness enables, stated in operational terms
• Chained routes that isolated testing would not reveal
• Divergence between documented arrangements and daily practice, and its causes
• Comparison against recognised good practice and regulatory expectation
• Materiality assessed, so that theoretical concerns are not presented as real exposure
• Systemic causes identified — findings address controls and process, never individuals

Output  Findings, each traceable to the evidence that supports it.

Stage 04

Prioritise

Sequence improvement so that effort and expenditure go where risk reduction is greatest.

Recommendations are only useful if they can be acted on. Each is written as an instruction: what should be done, which function owns it, and what it achieves. Risk is rated against a defined scale published with the report, so ratings can be challenged and compared. Measures costing little are separated from those requiring capital investment, so a security team is not asked to choose between them.

• Risk rated against a defined, published scale
• Recommendations sequenced by risk reduction against effort and cost
• Each recommendation assigned to an accountable function
• Immediate low-cost measures separated from capital investment
• Indicative effort and dependencies stated
• Residual risk recorded where a recommendation is not adopted

Output  A prioritised improvement plan that a security team can take to a board.

Stage 05

Improve

Support the change, then evidence that it worked.

The framework closes by supporting improvement rather than concluding at the report: an assessment that is filed and not acted on has reduced no risk. We review proposed designs and procurement specifications before commitment, re-assess findings once closed, and repeat the assessment on a defined cycle so movement in maturity is measured rather than asserted.

• Remediation planning and advice during implementation
• Review of proposed designs, specifications and procurement requirements
• Re-assessment of specific findings once remediation is complete
• Repeat assessment on a defined cycle to evidence movement in maturity
• Comparable results across sites and across years
• Evidence suitable for internal audit, board assurance and regulatory engagement

Output  Evidenced reduction in risk, and a defensible record of the improvement.