The use of baseline measures in risk assessment

In the financial sector, risk management has become a well established method for ensuring that investments are made on a sound basis. Risk management of protective security is followed by many countries and organisations. Risk management promotes effective and appropriate methods of security. It directly correlates an asset's vulnerabilities to perceived risks rather than relying on prescribed “across the board” “physical security standards”. Whilst the principle of risk assessment is not in question, there may be some shortcomings as the result of the way it is implemented. Implementation of risk management touches all levels of the management chain. The success of risk management is as good as the practises that implement it. The management of risk must not be clouded by perceived conditions or agendas. The UK Government has approached the issues above through the incorporation of “baseline measures” within the risk management process. These measures are designed to ensure that the same level of protection is afforded to classified information and yet at the same time encourage security managers to use a risk management approach. It is designed to ensure that managers have considerable discretion as to the way in which protection is provided, while ensuring the agreed level of protection is achieved. Baseline measures apply to all government departments handling protectively marked, (“Classified”) material. The Ministry of Defence has extended these measures to encompass the protection of large items of classified equipment