Business Security Advisory Group - Chief Security Officer (CSO)

Getting ahead

of the problems...

Business Security Advisory Group - Chief Security Officer (CSO)

Frequently Asked Questions

  • Part-Time CSO- “I’m the CFO of a small cap company and our CEO is being pressed by the Board of Directors and our external Auditors to more carefully consider our risk exposure to various security threats. We do not currently have a security manager. What can your firm do for us?”

    Assisting companies to better understand their risks and provide a cost-effective start-up security presence is a cornerstone objective of our firm. It most clearly leverages the rich experience each of us has gained and allows the client to approach its security needs in a more planful way. From the initial risk assessments through consideration of alternative approaches and building a deeper understanding of the need in the management team, we enable the client to meld the security program into its operations on a pace that makes good business sense. This approach also more clearly grounds the development of the security program on improved business processes as opposed to a new security presence.

  • Peer Review- “I’m a Security Director of a high technology company. We have been under fairly severe financial pressure for the past couple of years and I recognize my department’s obligation to do its part in cost containment. What can you do to help me?”

    We have been there in more ways than we like to remember! Maybe that’s the point. We believe we offer three important benefits in this area: first, we hit the ground running. You don’t have to educate us on best practices in security. This saves time ($) and the options we develop will likely be ones we have tried and know will work within your business culture and operational environment. Secondly, we believe our credentials provide strong credibility in the boardroom and with your team. We can be an effective advocate for our recommendations. Finally, objectivity based on experience rather than lack of knowledge.

  • Benchmarking- “We would like to benchmark several of our security programs with other companies with the objective of developing best practices. Do you have experience in this area?”

    Each of us has engaged in a variety of benchmarking exercises over the past decade or more. We take pride in having led global security organizations that were found to have best practices in physical security, information security, executive protection, workplace violence prevention, investigations and a host of related safeguards. We have an extensive network of trust-based security colleagues around the globe with whom we may engage in the identification of best practices.

  • Measuring Security’s Value- “We are doing a top-down review of all business support services and as the CSO I want to be able to demonstrate how we are adding value to the business. Do you have any experience here?”

    More than ever, the Security Organization needs to be a value center, not just a cost center. The influence and value of the security organization is directly proportionate to its measurable impact on the ability of the enterprise to manage and mitigate risk. Security adds value when its programs enable the business to do what would otherwise be too risky. Having been through similar reviews, we have developed a variety of measures and metrics that may be applied to a variety of security functions.

  • Risks to Reputation- “As a result of the Sarbanes-Oxley regulations, our board and senior management are increasingly concerned about having a deeper understanding of risks associated with business ethics and personal integrity. Do you have experience in these areas?”

    This is a key competency of our team. Sarbanes is far more than trust in the numbers. We recognize from experience that each client has a unique culture that is at the heart of a personnel integrity program. Several of us have established or served on inter-departmental Corporate Business Conduct committees, done top-down reviews of the related policy infrastructure, conducted literally thousands of internal investigations of suspected wrongdoing and worked for companies where the franchise was based on the maintenance of trust in the marketplace. We have established crime prevention programs consistent with the requirement of the U.S. Sentencing Commission Guidelines for Corporations, possess an strong understanding of the growing inventory of security-related regulations and have worked in multi-cultural environments that test the viability of business conduct policy.

  • International Risk- “As a result of 9/11, the Board of Directors and the Executive Management team decided to create a security responsibility and assigned it to me, the Environmental, Health and Safety Manager. The company is expanding its operations overseas and plans to have senior management teams visit the potential markets. Do you have experience in overseas operations and in protecting executives in foreign locales?”

    Comprehensive Executive Protection programs for all company employees traveling domestically and internationally are part of our core competencies. As former CSO’s of many of the largest global corporations, we have operated in war zones and other high risk areas formulating and implementing the security policies and programs for expanding offshore operations. Components of these programs included methodologies for the protection of ex-patriot and visiting executives and employees as well as critical business processes.

  • Business Risk Assessment- “We are a small firm which is looking to expand our business into the emerging markets in Eastern Europe and the Pacific Rim. We have unique products and have had inquiries from businesses in these areas to be our representative for marketing and distributing purposes. The problem is we do not know who these people and companies are and whether they have the financial substance and ethical business character to represent us adequately. Can you help us?”

    Corporate and personal due diligence is a business requirement in the emerging countries since many new overseas companies are not familiar with American commercial practices. If these corporations who represent you do not operate in a responsible and ethical manner they could get you in serious difficulty. We have faced these issues many times as CSO’s and have the contacts in these areas and are able to determine the bona fides of existing and new companies in high-risk business areas. Through our network of public and private sources, we are able to get beyond the bureaucracies and red tape to make sure that the companies and people you deal with are legitimate business entities with no hidden agenda.

  • Business Continuity & Crisis Management- “We are a mid cap company looking to expand internationally and some markets we have targeted for development are in high-risk areas. In the wake of 9/11 and all the talk from Homeland Security about another terrorist attack, we fear that the domestic businesses may also be subject to severe disruption. Is there anything you can do to develop plans, programs and processes to keep our business running in case our company is incapacitated because of insurrection, natural disaster or terrorist attack?”

    9/11 was a terrible tragedy that taught us many lessons the hard way. We CSO’s who had business units in high risk areas had Crisis Management and Business Resumption plans we could use as a starting point to extricate our domestic business units from the horrors of this disastrous event. It is absolutely necessary that companies both foreign and domestic have practical and workable Crisis Management and Business Resumption plans in order to maintain some modicum of business continuity. Our team members have developed security recovery plans and programs for almost every type of business in some of the riskiest business environments in the world. We can develop your plans and programs, help you implement them and train your employees.

  • Transitioning the new CSO- “I am a new CSO in Fortune 100 Company and spent most of my adult working life in government service. I was a middle and top-level government manager for many years but this corporate security is new to me. When I examine the business units within the company I see some of the obvious security issues but being new to the corporate world, I am afraid the government approach may not be the efficient method to solve the issues. Can you help me?”

    Many of the CSO’s associated and affiliated with BSAG have government resumes and faced the same issues you are facing when they became heads of their security departments. The public service organizations in which we served (FBI, Secret Service and local law enforcement) gave us the basic tools with which to manage a corporate security organization but not the efficiencies needed to approach security as a business and sell it and the programs to the business units. These are acquired skills which come with experience. BSAG has a cadre of CSOs who can help you formulate strategic and tactical plans for your security group by accomplishing the following:

    • Identifying the security risks for your business units
    • Developing the security plans, programs and processes to meet the identified security risks
    • Present these plans and programs to the business unit management in a cost efficient and beneficial manner so that they will approve the plans and assist in their implementation.
    • Present the plans to appropriate managers and employees for implementation
    • Develop an audit plan to ensure the plans and programs reflect the needs of the company.
  • Due Diligence- “We are an international company dealing primarily in franchises with a relatively small corporate staff. Our chief legal officer is concerned we are not vetting potential franchisees sufficiently. What can we do to assure we are not doing business with the “bad guys?”

    Due diligence is a core competency of our team. Proper due diligence will establish who you are “really” dealing with – verify their personal background, their business history, their financial history and determine if they or any other business they have in interest in is on any government “watch list”. Completing a proper due diligence is an essential element to insure business continuity and minimizing unnecessary liability exposure.

  • Compliance Reviews- “We have a new CEO and our board of directors has instructed him to use corporate aircraft for all travel, business and personal. How often should we conduct an executive security analysis to satisfy the IRS Section 132 Code (Fringe Benefit Compensation)?”

    The IRS Code Section 132 requires an updated executive security analysis on a timely basis (generally defined as every four to five years) or anytime significant changes occur in personnel and/or locations. Section 132 requires that an “independent” qualified third party conduct the executive security analysis. This should include security at the workplace, security at the residence(s) [primary and vacation], security while traveling to the workplace, and security while traveling for business or personal reasons. We remind our clients the purpose of the executive security analysis is to satisfy the requirements of the IRS and should be written as such. A side benefit is gaining a fresh and experienced review of your executive protection program, but this is not the primary objective. The final document will contain a great deal of private and sensitive information and should not be disseminated on a wide basis. Our experience has shown that companies who complete this executive security analysis and comply with Section 132 realize significant costs savings.