SSBA Regulatory Scheme Training Workshop Tier 1 SSBAs

1
SSBA Regulatory SchemeTraining WorkshopTier 1
SSBAs
2
Welcome and Introductions
3
Speakers

• Dr Gary Lum Assistant Secretary
• Health Emergency Management Branch (DoHA)
• Letitia Toms Director
• Laboratory Capacity and Regulation Section (DoHA)
• David Tindall
• Protective Security and Coordination Centre (AGD)
• Dr Tony Willis
• Department of Foreign Affairs and Trade

4
(No Transcript)
5
Participant Introductions
6
Program OutlineDay One

• Setting the Scene
• International Schemes
• SSBA Guidelines
• Reporting and the National Register
• SSBA Standards
• Questions

7
Program OutlineDay Two

• Day One Summary
• Security Risk Assessment
• Suspicious Behaviour
• Security Risk Templates
• Day Two Summary
• Questions and Discussion

8
SSBA Training Workshop Objectives

• To introduce the
• SSBA Guidelines
• SSBA Standards
• National Register
• Develop an understanding of Security Risk
  Assessment Process
• Requirements to achieve compliance

9
Training Manual

• SSBA Regulatory Scheme training manual
• Presentation slides
• Fact sheets
• SSBA guidelines
• National Register forms
• SSBA Standards
• Security Risk Template

10
Evaluation

• Evaluation forms have been provided in your
  folder
• We would like you to complete the evaluation form
• You may choose to complete this form during the
  course of the day

11
Setting the Scene
12
Outline

• Introduction
• The COAG Report
• National Health Security Act 2007
• National Health Security Regulations 2008
• SSBA Fact Sheets

13
Introduction

• Terrorism
• Increased global risk of terrorism
• 11 September 2001
• Anthrax attacks in 2001
• Biological Weapons Convention
• Expanding knowledge of biotechnology
• Legitimate research and the dual use dilemma
  (legitimate and malicious use of the same agent)

14
COAG Review

• 2002 COAG review of hazardous materials
• 2006 Banks Report
• 2007 COAG Report recommended a regulatory
  scheme for security-sensitive biological agents
  (SSBAs)

15
The COAG Report

• Purpose
• Recommendations of the COAG Report
• Risk management principles were applied
• Balance between counter-terrorism concerns and
  industry interests
• Maintain access to SSBA for those with legitimate
  need

16
National Health Security Act 2007

• The National Health Security Bill was passed in
  Parliament on 20 September 2007
• Royal Assent on 28 September 2007
• Commencement
• Part 2 - commenced on 29 March 2008
• Part 3 - commences on 31 January 2009

17
National Health Security Act 2007 (2)

• Two main operative parts
• Part 2
• Surveillance arrangements to support responses to
  national and international public health
  emergencies
• Assist repatriation of victims of overseas mass
  casualty events
• Part 3
• Establishes the regulation of security-sensitive
  biological agents (SSBAs)

18
National Health Security Act 2007 (3)

• Amendments
• When is an SSBA an SSBA?
• - Confirming identification and start of
  regulation
• Health emergency response situation
• Background checking
• Clarification of definitions
• Reporting to law enforcement
• Inspector powers
• Winter 2009

19
National Health Security Regulations 2008

• The NHS Act enables regulations to provide
  further specific detail for the SSBA Regulatory
  Scheme
• Work in conjunction with the SSBA Standards to
  provide this operational detail

20
What is in the Regulations?

• The Regulations deal with
• Exempt entities (s40)
• Additional detail for inclusion on the National
  Register (s37)
• Additional reportable events (s48)
• Time frames for reporting (s42 and s48)
• Agencies that the Secretary may provide a report
  to (s85)
• Inspector identity cards (s64)

21
SSBA Fact Sheets

• Overview
• About Us
• Outline of the National Health Security Act 2007,
  the National Health Security Regulations 2008 and
  the SSBA Standards
• National Register
• Exemptions
• Security

• Disposal
• List of Biological Agents
• Domestic Legislation (new)
• International Conventions
• Dual Use (new)
• Frequently Asked Questions

22
International Schemes
23
SSBA Guidelines
24
SSBA Guidelines

• Confirmatory testing for SSBA and retention of
  samples sent for testing
• What is an Entity and what is a Facility
• Handling samples from a person or animal infected
  with an SSBA
• Loss of security-sensitive biological agent
• Non registered Entities or Facilities
• Reportable events
• Reporting to law enforcement and national
  security agencies
• SSBA in natural environment
• SSBA toxins
• The transport process
• Suspicious behaviour

25
SSBA Guidelines (2)

• Guidelines covered throughout the training are
• Loss versus Stolen
• Non Registered Stakeholders
• Reportable Events
• Reporting to Law Enforcement
• The Transport Process
• Suspicious Behaviour

26
SSBA Guidelines (3)

• Guidelines in detail
• What is an entity and what is a facility
• Handling samples from a person or animal infected
  with an SSBA
• Confirmatory testing
• SSBA in the natural environment
• SSBA toxins

27
What is an Entity and what is a Facility?

• This guideline provides information on
• What is an entity or facility for the purposes of
  reporting
• This guideline covers
• Defining an Entity
• Defining a Facility
• Leasing a Facility from another Entity

28
Handling Samples from a Person or Animal
Infected with an SSBA

• This guideline provides information on
• The handling of samples from a person or animal
  infected with an SSBA
• This guideline covers
• The NHS Regulations
• Treatment of a person who is infected with an
  SSBA
• Handling animals infected with an SSBA
• Handling samples from infected persons or animals

29
Confirmatory Testing

• This guideline provides information on
• If there is uncertainty about the identity of an
  SSBA and another entity or facility is required
  to confirm the identity of the SSBA
• This guideline covers
• Reporting requirements
• Handling of other samples following
  identification of an SSBA
• Confirmatory testing

30
SSBA in the Natural Environment

• This guideline provides information on
• SSBAs occurring in the natural environment
• This guideline covers
• Inadvertent possession of an SSBA occurring
  naturally in the environment
• Deliberate cultivation

31
SSBA Toxins

• This guideline provides information on
• The reportable quantities for toxins on the List
  of SSBA
• This guideline covers
• Reportable quantities for toxins on the List of
  SSBA
• When to register for Tier 1 and or Tier 2 if
  handling Clostridium botulinum

32

• Reporting and the National Register

33
Outline

• Who to Report to?
• National Register
• Data Collection
• Reportable Events
• Paper and Electronic Forms
• Initial Registration
• Incident Notification

• Administrative Changes
• Transfer In
• Transfer Out
• Destruction
• Regular Report
• Reference Material

34
Who to Report to?

• The NHS Act stipulates that reportable events
  must be reported to the Secretary
• These reports will be sent to the National
  Register

35
National Register

• Established by the NHS Act (s36)
• Supported by mandatory reporting (s37 and s38)

36
National Register (2)

• Secure IT database
• Record information on registered
  entities/facilities handling SSBAs
• Users must update their handlings of SSBAs
• Provision of information to intelligence and law
  enforcement agencies

37
Data Collection

• Initial registration will be on paper and sent
  via registered post or courier
• Notification of reportable events and
  annual/biannual reports can be submitted
  electronically via secure website or manually on
  paper
• No access to National Register good record
  keeping essential

38
Reportable Events

• Time frames for reporting set out in the NHS
  Regulations
• The time frame depends on the type of reportable
  event and if the SSBA handled is Tier 1 or Tier 2
• The time frames are
• Reporting events as they occur
• Regular reporting (biannually or annually)

39
Reportable Events (2)

• Reporting events as they occur These reports
  are required within 2 business days of event
• Handling a new SSBA
• Handling for a purpose not already registered
• Change of Responsible Officer or deputy details
• Transfer of SSBAs
• Disposal of entire holdings or resulting in less
  than the reportable quantity of toxins

40
Reportable Events (3)

• Reporting events as they occur These reports
  are required within 2 business days of discovery
  of event
• Loss
• Theft/attempted theft
• Unauthorised access/attempted unauthorised access
• Accidental release
• Infection with SSBA acquired from handling

41
Reportable Events (4)

• Regular reporting - These reports are required 6
  monthly or 12 monthly and include
• Changes in registration details that are not
  required to be reported as they occur
• Tier 1 agents reports must be provided by 30
  April and 31 October of each year
• Tier 2 agents reports must be provided by 30
  April of each year

42
Paper and Electronic Forms

• Initial Registration
• Incident Notification
• Administrative Changes
• Transfer In
• Transfer Out
• Destruction
• Regular Report

43
Initial Registration

• Start to handle SSBA
• Includes details of the
• Entity
• Facility
• Responsible Officer(s)
• SSBA held and purpose
• Declaration of compliance with Standards
• Paper-based form (no on-line option)

44
Incident Notification

• Complete this form for the following situations
• Loss of SSBAs
• Theft of SSBAs or sensitive information relating
  to SSBAs
• Attempted theft of SSBAs or sensitive information
  relating to SSBAs
• Unauthorised access to SSBAs or sensitive
  information relating to SSBAs
• Attempted unauthorised access to SSBAs or
  sensitive information relating to SSBAs
• Accidental release of SSBAs
• Infection with SSBAs acquired from handling

45
Incident Notification (2)

• Incident details
• Reporting details
• Subsequent action taken

46
Administrative Changes

• Complete this form for the following situations
• Start to handle a new SSBA
• New purpose for handling an existing SSBA
• Changes to Responsible Officer(s) details

47
Transfer In

• Complete this form if you have received an SSBA
• Includes details of
• Sending facility
• SSBA
• Successful/unsuccessful transfer
• What you intend to do with the SSBA

48
Transfer Out

• Complete this form if you have sent an SSBA
• Includes details of
• Receiving facility
• SSBA
• De-registration (if required)

49
Destruction

• Complete this form if you have destroyed your
  entire holding of an SSBA or destruction that has
  resulted in less than the reportable quantity of
  toxins

50
Destruction (2)

• Includes details of
• SSBA
• Method/date of destruction
• De-registration (if required)

51
Regular Report

• This form will need to be completed ONLY if any
  of the initial registration details have changed
  (not including the details that are reported as
  they happen)
• Entity details
• Facility postal address or email
• NB Change to facility physical address will
  require a new initial registration

52
Reference Material

• Fact Sheet
• National Register
• Guidelines
• Reportable Events
• Reporting to Law Enforcement and National
  Security Agencies
• The Transport Process

53
GuidelineLoss of SSBAs

• This guideline provides information on
• Loss vs stolen vs accidental release
• This guideline covers
• Legislation
• Loss vs stolen
• Accidental release

54
GuidelineReportable Events

• This guideline provides information on
• reporting requirements for reportable events
  under the NHS Act
• This guideline covers
• Reporting as events occur
• Regular reporting
• Reporting timeframes
• Process for reporting

55
GuidelineReporting to Law Enforcement and
National Security Agencies

• This guideline provides information on
• the process that should be undertaken to report
  an incident to law enforcement or national
  security agencies
• This guideline covers
• Incidents to report
• Who to contact
• Contact details
• When to contact agencies
• Information you may be asked to report

56
GuidelineTransport Process

• This guideline provides information on
• transport requirements for SSBAs
• This guideline covers
• Sending SSBAs
• Receiving SSBAs
• Transport checklist

57
POP QUIZ
58
Security Sensitive Biological Agent (SSBA)
Standards

• Requirements for entities handling Tier 1 SSBAs

59
Outline

• SSBA Standards
• Commencement
• What are the SSBA Standards?
• Requirements
• Part 1 Scope and Definitions
• Part 2 Risk and Incident Management

• Part 3 Personnel
• Part 4 Physical security
• Part 5 Information management
• Part 6 Transport
• Part 7 Inactivation and decontamination
• Part 8 SSBA management system requirements

60
SSBA Standards

• Requirements for handling Tier 1 SSBAs
• Differing requirements for handling Tier 2 SSBAs
• For example
• Must record entry and exit from facilities
  handling Tier 1 SSBAs
• Must record entry only for facilities handling
  Tier 2 SSBAs

61
Commencement

• Part 1 (Scope and Definitions) and Part 2 (Risk
  and Incident Management) commence 31 January
  2009
• Remaining Parts of the Standards commence 1
  July 2009

62
What are the SSBA Standards?

• SSBA Standards apply to any entity that handles
  one or more SSBAs and is not exempt
• Specify compliance requirements

63
Requirements

• The requirements cover
• Risk and Incident Management
• Personnel Security
• Physical Security including storage
• Information Management
• Transport
• Inactivation and Decontamination including waste
  disposal
• SSBA Management System

64
Part 1

• Scope and Definitions

65
Part 1 Scope and Definitions

• Sets out the overall scope of the Standards
• Normative references regarding other legislation
• Terms and definitions

66
Part 2

• Risk and Incident Management

67
Part 2Risk and Incident Management

• Minimum requirements for the risk assessment and
  risk management process
• Minimum requirements for incident management and
  review
• Risk assessment must be proactive rather than
  reactive

68
Risk and Incident Management (2)

• Risk Assessment
• Must undertake a risk assessment and produce a
  risk management plan regarding the SSBA handled
• Identifies the risk and mitigation strategies
  that will guide implementation of other security
  features
• Vulnerability assessment also required
• Risk assessment and risk management plan reviewed
  at least annually

69
Risk and Incident Management (3)

• Incident Management
• Define, report, record and analyse incidents to
  determine cause and to implement any corrective
  actions
• Review of risk plans recommended after
• Incident
• Changes in SSBA handled
• Changes in procedures
• Changes in national threat assessment
• Request of DoHA

70
Risk and Incident Management Summary

• Undertake a risk assessment and produce a risk
  management plan
• Risk assessment and risk management process
  important for determining controls for rest of
  Standards
• Incident management

71
Part 3

• Personnel

72
Part 3Personnel

• Requirements for personnel management to assist
  in addressing the risk associated with human
  behaviour

73
Personnel (2)

• Responsible Officers
• One Responsible Officer and Deputy Responsible
  Officer per facility
• Operational responsibility for overseeing the
  management of SSBAs in the facility
• Recorded on the National Register of SSBA

74
Personnel (3)

• Authorised Persons
• Authorised to handle SSBAs or access the facility
  where SSBAs handled, and/or access sensitive
  information related to the SSBAs
• Trained in requirements of NHS Act, NHS
  Regulations and the SSBA Standards
• Training records required

75
Personnel (4)

• Authorised Persons cont.
• Must not have been excluded from facility or
  directed not to handle SSBAs
• Background check
• National Criminal History check
• Politically Motivated Violence check
• Must seek approval in writing from person to be
  checked prior to conducting checks

76
Personnel (5)

• Recruitment
• Assess identity, qualifications and experience
• Must undergo background checks if handling Tier 1
  agents

77
Personnel (6)

• Approved persons
• Enable visiting experts, students, contractors or
  other personnel to handle SSBAs or have access to
  an area containing SSBAs
• Can be approved prior to becoming authorised
  (e.g. while waiting for background checks to be
  completed)
• Must be escorted at all times by an authorised
  person when handling or in facility handling Tier
  1 SSBAs

78
Personnel (7)

• Training and competency
• Identify, establish and maintain requirements and
  procedures for SSBA training
• Personal security awareness
• Define competency levels and maintain records
  that personnel have attained and maintain these
  levels
• Review competency requirements at least annually

79
Personnel (8)

• Behavioural Factors
• One of most difficult areas but one of most
  important
• Human reliability
• Management of personnel interaction with facility
  and equipment
• Communication and consultation
• Conflict management
• Avoidance of a blame culture
• Nature and extent of personnel reliability
  measures should be determined as part of the risk
  management process

80
Personnel (9)

• Exclusion
• Exclude personnel if deemed necessary or
  following a direction not to handle
• Measures include
• Prompt removal of access to facility
• Prompt removal of access to sensitive information
• Immediate physical removal if necessary

81
Activity

• Individual Activity
• Reflect on what this part means for you in your
  workplace
• Table Activity
• Discuss your thoughts with your table
• Group Activity
• Each table is to outline their discussion

82
Personnel Summary

• Responsible Officer and Deputy Responsible
  Officer
• Authorised Persons
• Approved Persons
• Recruitment
• Training and competency
• Behavioural factors
• Exclusion

83
Part 4

• Physical Security

84
Part 4Physical Security

• Limiting access to both the SSBA and the facility
  in which it is handled (including storage)
• Requirements in part determined by risk
  assessment and risk management plan

85
Physical Security (2)

• Building housing facility and sensitive
  information
• Structurally sound
• Suitably protected against unauthorised access
• Secure areas containing SSBAs must have access
  control to only allow access for authorised or
  approved persons
• Doors locked when facility not attended
• Windows non-opening and sealed

86
Physical Security (3)

• Physical Access Controls
• Entry and exit recorded
• Entry/exit records maintained for 6 months
• Two forms of access control
• Access control systems tested at least every 6
  months
• Mechanism for prevention of tailgating
• Loss of physical security access controls (access
  cards, keys, etc) must be reported immediately on
  discovery of loss

87
Physical Security (4)

• Storage
• SSBAs must be stored securely
• For example, a dedicated freezer, dedicated
  locked area or locked containers within these
  areas
• Access to be controlled by Responsible Officer
• Level of security required determined by risk
  assessment

88
Activity

• Individual Activity
• reflect on what this part means for you in your
  workplace
• Table Activity
• Discuss your thoughts with your table
• Group Activity
• Each table is to outline their discussion

89
Physical Security Summary

• Perimeter controls
• Physical access controls
• Two forms of control
• Prevention of tailgating
• Record entry and exit
• Storage of SSBAs

90
Part 5

• Information Management

91
Part 5Information Management

• Identification of sensitive information and the
  handling of records
• Sensitive information includes information about
  the SSBA, who can access the SSBA, risk and
  management plans, and storage records
• Not intended to restrict the release of results
  from research, diagnosis or other legitimate uses

92
Information Management (2)

• Record Keeping
• Maintain records of all activities related to the
  Standards
• Develop policy for access, retention of records
  and for destruction

93
Information Management (3)

• Information Security
• Identify sensitive information
• Control access to such information (need to
  know principle)
• Permissions reviewed at least every 6 months
• Secure system for information and regular secure
  backup

94
Information Management (4)

• Inventory
• Identify which SSBAs are held and where stored
• Audit of inventory at predetermined intervals
  based on risk
• Maintain records of receipt, holding, transport
  and disposal for inspection
• Minimise quantities of SSBAs held
• Records maintained for 5 years

95
Information Management (5)

• Disposal of records
• Must have policy in place for record disposal
• Should include hard copy, electronic and other
  types of records relating to SSBAs

96
Activity

• Individual Activity
• reflect on what this part means for you in your
  workplace
• Table Activity
• Discuss your thoughts with your table
• Group Activity
• Each table is to outline their discussion

97
Information Management Summary

• Identify sensitive information
• Maintain records
• Secure sensitive information
• Inventory
• What SSBAs held
• Where stored
• Secure disposal of records

98
Part 6

• Transport

99
Part 6Transport

• Compliance with Dangerous Goods transport
  requirements
• Australian Dangerous Goods Code for Road and Rail
• Civil Aviation Safety Regulations
• Transport agents (external to entity)
• Must have a documented transport security plan

100
Transport (2)

• Verification and notification
• Sending facility must verify in writing that
  receiving facility will accept
• Sending facility must notify receiving entity of
  shipment details
• Receiving facility must notify sending facility
  of receipt of shipment

101
Transport (3)

• Failure of shipment to arrive
• Receiving facility to contact transport agent to
  confirm location and expected delivery time
• If SSBA goes missing in transit, receiving
  facility must report to the following
  organisations
• Law enforcement agencies
• Sending facility
• DoHA

102
Transport (4)

• Successful shipment
• Receiving facility must confirm successful
  shipment
• Complete shipment
• No evidence of tampering
• Successful and unsuccessful transfers are
  reportable events

103
Transport (5)

• Transport between facilities when not using
  transport agent
• Transport between facilities of different
  entities
• Transport between facilities of the same entity
• Requirements
• Must be done by authorised persons
• Maintain record of movements
• Minimum requirement is that transport shall take
  place within a suitable secondary container
• Transport consistent with dangerous goods
  requirements if leave building

104
Activity

• Transport Scenario
• Form two groups on your table
• Discuss questions in your handout
• Group discussion of answers

105
Transport Summary

• Compliance with dangerous goods requirements
• Transport security
• Verification and Notification
• Successful shipment
• Transport by authorised persons

106
Part 7

• Inactivation and Decontamination

107
Part 7Inactivation and Decontamination

• It is not intended that all SSBAs are completely
  destroyed after use
• Allows for agents to be used for further research
  following inactivation
• Purpose is to ensure that the agent no longer
  qualifies as an SSBA, and that SSBAs cannot be
  accessed through an inadvertent release from
  waste products

108
Inactivation and Decontamination (2)

• Procedures
• Risk assessment to identify and develop effective
  decontamination and inactivation procedures
• Validation and verification data must be produced
  to ensure procedures are effective

109
Inactivation and Decontamination (3)

• Waste Management
• SSBAs shall not leave entity without being
  inactivated or destroyed unless being transported
  to another facility for further handling
• Waste decontamination procedures must be
  validated
• Risk assessment to determine procedures for
  secure waste destruction

110
Inactivation and Decontamination (4)

• Record Keeping
• Risk assessment to identify records that shall be
  kept
• Records of decontamination/inactivation and
  validation data kept for at least 18 months

111
POP QUIZ
112
Inactivation and Decontamination Summary

• Develop effective decontamination and
  inactivation regimes
• Waste management
• Record keeping
• Records of inactivation and decontamination
• Records of validation

113
Part 8

• SSBA ManagementSystem Requirements

114
SSBA ManagementSystem Requirements

• Establishment of systematic approach to the
  management of security of SSBAs
• Systems
• Develop, authorise and implement policy
  concerning management of SSBAs
• Continual assessment and improvement of SSBA
  management systems
• Communicate relevant information regarding SSBA
  management system and activities to personnel and
  other relevant parties

115
SSBA ManagementSystem Requirements (2)

• Top Management
• Ultimate responsibility for development and
  implementation of SSBA management system and
  policy
• Ensure availability of resources
• Appoint and empower the Responsible Officer and
  Deputy Responsible Officer
• Ensure that policy, controls and documented
  procedures are in place
• Tasks may be delegated to competent individuals
  with adequate resources to perform activities
  effectively

116
SSBA ManagementSystem Requirements (3)

• SSBA Management Committee
• Review group for SSBA risk and issues
• Reports to Top Management
• Contributes to the development of policy and
  procedures for SSBAs
• Review and approve protocols and risk assessments
  for work involving SSBAs
• Can be part of another committee

117
SSBA ManagementSystem Requirements (4)

• Checking and corrective action
• Performance management and analysis of data
• Identify, collect, store and analyse data to
  assess suitability and effectiveness of
  management system
• Records, documentation and data control
• Establish, control and maintain records,
  documentation and data to provide evidence of
  compliance with the Standards

118
SSBA ManagementSystem Requirements (5)

• Internal Inspection
• Internal inspection program established and
  conducted
• At least every 6 months
• May range from frequent checks on specific areas
  (e.g. storage of SSBAs, disinfectants, access
  records) to more extensive but less frequent
  inspections (e.g. facility as a whole)
• Separate to the external inspections conducted by
  DoHA
• Records maintained of findings and actions

119
SSBA ManagementSystem Requirements (6)

• Control of Non-Compliance
• Must be identified and managed
• Actions taken to prevent reoccurrence
• Records of non-compliance and actions maintained
• Preventive Action
• Identify potential issues through risk assessment
  or other sources
• Take action to prevent occurrence

120
Activity

• Individual Activity
• Reflect
• What policies and procedures does your
  organisation already have in place that may be
  adapted to fit within the SSBA Regulatory Scheme?
• What committees do you have in operation that
  might take on a role here?
• Identify who you think your top management are?
• Do you have a quality assurance program already
  in place?
• Table Activity
• Discuss your thoughts with your table
• Group Activity
• Each table is to provide outline their discussion

121
SSBA Management System Requirements Summary

• Establish and document policy
• Top management
• SSBA Management Committee
• Checking and corrective action
• Records, documentation and data control
• Internal inspection
• Control of non-compliance

122
Copies of the SSBA Standards

• Available through the Department of Health and
  Ageing web site
• www.health.gov.au/ssba

123
Day One Summary

• Setting the Scene
• The COAG Report
• SSBA Fact Sheets
• SSBA Guidelines
• National Health Security Act 2007
• National Health Security Regulations 2008
• International Schemes
• SSBA Guidelines
• Reporting and the National Register
• SSBA Standards

124
Day Two
125
Summary Day One

• Setting the Scene
• International Schemes
• SSBA Guidelines
• Reporting and the National Register
• SSBA Standards

126
Program Outline Day 2

• Security Risk Assessment
• Suspicious Behaviour
• Security Risk Templates
• Day Two Summary
• Questions and Discussion

127
Security Risk Assessment

• PSCC Training Centre

128
Suspicious Behaviour
129
Security Risk Template
130
Security Risk Template

• DoHA has developed a Security Risk Template
• Aligns with the SSBA Standards
• A tool for assessing compliance
• Entities may use other tools
• Use is not compulsory

131
Security Risk Template (2)

• The SRT is a checklist to use after completing a
  security risk assessment to ensure all risks have
  been identified and treated

132
Security Risk Template (3)

• The SRT will assist
• Entities and facilities develop a security
  conscious work environment
• Check for compliance with the SSBA Standards

133
Using the Template

• Each section in the SRT covers critical areas
  within the SSBA Standards
• Questions require a yes/no answer
• It is important to provide comments in the space
  provided

134
Answering Yes

• If you answer YES to a question you will be
  required to provide details of
• How you are compliant with the SSBA Standards
• How you are mitigating the risk

135
Answering No

• If you answer NO to a question you will be
  required to provide in the comments section
  initial comments relating to
• The risk
• Why you have answered no
• All questions that have been answered with NO
  are transferred to the Risk Analysis Section at
  the end of the template

136
Risk Analysis

• The Risk Analysis requires you to
• Describe the risk
• Outline treatment options
• Provide time frames
• Identify personnel responsible for undertaking
  the treatment

137
Security Risk Template

• The Security Risk Template is divided into parts
• Personnel
• Physical security
• Information Management
• Transport
• Inactivation and decontamination
• SSBA management system requirements including
  incident management
• Risk Analysis

138
Recommended Policies, Procedures and Processes

• List of recommended policies, procedures and
  processes included at back of SRT
• Not exhaustive
• Guide only

139
Changing Risk

• The following events may prompt a review of the
  security risk assessment
• Following an incident
• When there are changes in SSBAs handled
• When there are changes in procedures
• When national threat assessments change
• At the request of DoHA

140
Day Two Summary

• Security Risk Assessment
• Suspicious Behaviour
• Security Risk Template

141
Evaluation

• Please complete the SSBA Training Workshop
  evaluation form provided in your folder

142
Thank You

• Further information on the SSBA Regulatory Scheme
  can be found at
• www.health.gov.au/ssba
• ssba_at_health.gov.au