Cabinet Office Homepage

Security Policy No.6

This is the sixth of seven Security Policies within the HMG Security Policy Framework (SPF); outlining the mandatory security requirements and management arrangements to which all Departments and Agencies (defined as including all bodies directly responsible to them) must adhere. This policy deals with:

Counter-Terrorism

Introduction

Departments and Agencies are responsible for managing their assets – people, infrastructure and information. This includes reducing risk from terrorist attack to as low a level as is reasonably practicable. Here it is important to recognise that the visible level of security is a factor in terrorist targeting. Departments have legal obligations to protect employees and visitors. Departments must be resilient in the face of an attack and have in place physical security measures, proportionate with the threat and the assets to be protected and also contingency arrangements to facilitate the quick resumption of vital services (including contracted services). HMG is perceived by many terrorist groups as an attractive and ‘legitimate’ target, it is therefore of critical importance that Departments meet the obligations outlined in this framework.

CONTEST strategy

CONTEST is the Government's long term strategy for reducing the risk to the UK and its overseas interests from international terrorism. The strategy was published in July 2006 and more details can be found at: Counter-terrorism strategy [External website].

Risk management

Departments must employ a risk management approach to Counter-Terrorism (CT) protective security, although it is recognised that for certain areas (for example the protection of nuclear weapons and nuclear materials) CT security policy will be intentionally more prescriptive. It should be noted that CT measures are likely to complement other security measures and therefore should be considered in conjunction with general protective security risk management (please see Security Policy No. 5 – Physical Security and Security Policy No.7 – Business Continuity). However, there are some very specific baseline CT measures that all Departments must take and these are outlined in this policy.

Categorisation of the government estate

All Departments should be considered a potential target for terrorist attack or hostile interest. Government establishments fall into three risk categories according to the likelihood of being a target of a terrorist attack. These risk categories are HIGH, MODERATE, LOW.

Threat Levels

Threat Levels are designed to give a broad indication of the likelihood of a terrorist attack. The Threat Levels are LOW, MODERATE, SUBSTANTIAL, SEVERE and CRITICAL. The five levels reflect an assessment of probability of attack based on an analysis of terrorists' intentions, targeting priorities, capabilities and any evidence of current planning and timescales. Information on the national Threat Level is available on the Security Service website [External website].

Threat information and briefings

If an establishment is identified as being at immediate threat, the police and security authorities will inform the Department and may take control of the scene. This can be either pre or post-incident depending on circumstances and may require careful handling to avoid compromising intelligence. In order to ensure Departments have current information on the terrorist threat, the Centre for the Protection of the National Infrastructure (CPNI) and Cabinet Office Security Policy Division (COSPD) produce regular threat updates, some of which can only be seen on a ‘need to know’ basis.

Government Estate Response Level system

The Cabinet Office operates a system of response giving Departments a broad indication of the level of protective security readiness required at any one time. The Response Level is informed by the level of threat as well as specific assessments of vulnerability and risk to HMG but Response Levels tend to relate to sites, whereas Threat Levels usually relate to broad areas of activity. The three Response Levels are: NORMAL, HEIGHTENED and EXCEPTIONAL. Precise measures adopted for each individual site and at each Response Level are the responsibility of Departmental Security Officers (DSOs) in consultation with CPNI and specialist Counter-Terrorist Security Advisers, and must form part of CT planning. Measures are likely to include restricting access, increasing patrols and frequency of bag searching, however a more detailed description of incremental security measures is set out in the supplementary material within the framework.

Counter-Terrorist protective security policy and plans

Departments are best placed to assess the risks they face, and must develop their own security policies in an integrated manner, this must include a CT policy and plans. These should be produced in accordance with national security authorities' advice, and in consultation with local emergency services and should form part of business continuity plans.

Protective security measures

This framework provides detailed policy and guidance on all aspects of protective security and DSOs must refer to these when developing CT policies and plans, but in broad terms they need to ensure:

a. Physical security

That establishments (both new construction and existing), including non-government establishments which sustain HMG business, such as data centres, are suitably robust and offer an appropriate degree of protection against attack and hostile interest. Considerations may include protected spaces, glazing, stand-off, barriers, CCTV, public areas, internal communications, signage, Perimeter Intrusion Detection systems (PIDs), access points and control, building services (e.g. ventilation inlets) and parking areas.

b. Personnel security

There is adequate protection for all staff, as well as personal protection arrangements required for high-threat personnel such as Ministers and VIPs. National Security Vetting is a core element of ensuring trusted individuals are employed in sensitive posts. The Counter-Terrorist Check (CTC) plays an important part in CT vetting measures but other aspects of personnel security must be considered equally important, such as the Baseline Personnel Security Standard (BPSS) and ongoing personnel security management.

c. Information security

That all ICT systems, as part of the formal ICT accreditation process, consider and mitigate potential physical and electronic terrorist attack, and that CT plans include the need to protect electronic and paper based information from unauthorised access, compromise or destruction.

Assurance

Testing CT arrangements

Testing and exercises are essential elements in providing assurance – they ensure that staff are well versed in procedure, that equipment and communications are functioning and adequate and that arrangements with external bodies (e.g. emergency services, contractors, suppliers) are effective. They also provide an opportunity to identify and address problem areas. The testing of CT arrangements should form an important part of testing overall Business Continuity and emergency response plans.