Draft Security Manual for Private Industry
Draft Security Manual for Private Industry
Draft Security Manual for Private Industry
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
20130626_Assocham_Rahul Gangal.pptx1<strong>Draft</strong> <strong>Security</strong> <strong>Manual</strong> <strong>for</strong> <strong>Private</strong> <strong>Industry</strong>Key issues and approachJune, 2013
20130626_Assocham_Rahul Gangal.pptx5OUR ACHIEVEMENTS: We deliver tangible results – deeptrans<strong>for</strong>mation of our clients' business modelRoland Berger experiences in 2011/2012 - ExtractSTRATEGY & M&ANEW COLLABORATIVE MODELSSUPPORT AND SERVICES> Growth options <strong>for</strong> a Tier-1 supplier> Strategic review in the field of Cabin Interior> Market assessment <strong>for</strong> a new service offerings to Airlines> Strategic review of an Aerostructures Tier-1> Strategic plan <strong>for</strong> a new business of a A&D Tier-1 supplier> Strategic review of an A&D Engineering Service Provider> Securing of a strategic bid <strong>for</strong> a Systems Integrator> M&A scenarios <strong>for</strong> a Tier-1 in Aerostructures> Due diligences <strong>for</strong> <strong>Private</strong> Equity funds on A&DEngineering Service Providers> More than 12 Joint Improvement Plans between anaircraft OEM and a Tier-1 on key critical developmentprograms> Design of collaborative business models> Implementation of supplier support in aircraftmanufacturer FAL to support ramp-up> Supply Chain Readiness <strong>for</strong> industrialization <strong>for</strong> a majorSystems provider> Design of convergence plans between OEMand Tier-1> Strategic reviews / growth plans in the areas of Supportand Services> Development of Support & Services offer <strong>for</strong> a key militaryprogramme> Set-up of Joint Ventures in the area of Support andServices> Post Merger Integration in Services business <strong>for</strong> anAerospace plat<strong>for</strong>mist> Ramp-up of MRO activities <strong>for</strong> an OEMOPERATIONSPROGRAMME MANAGEMENTORGANIZATION> (Re)design-to-cost projects <strong>for</strong> OEMs and Tier-1s> Industrialization and manufacturing ramp-up preparation> Deployment of a modular plat<strong>for</strong>m policy <strong>for</strong> a leadingCabin supplier> Full strategic and operational review of an Enginemanufacturer> Trans<strong>for</strong>mation plan <strong>for</strong> an Aerostructure Tier-1 supplier> Recovery plan to meet Entry Into Service planning target> Marketing & Sales optimization <strong>for</strong> a Tier-1 supplier> Engineering efficiency plan <strong>for</strong> leading aircraftmanufacturer> Ramp-up securing plan <strong>for</strong> a large Tier-1 System Supplier> Recovery plans at different stages> Optimization of Planning on a major aeronautic program> New planning principles <strong>for</strong> a military aircraft manufacturer> Impact assessment of planning drift on a Space program> Recovery plan to reach technical per<strong>for</strong>mance target on amajor aeronautic program> Cost @ Completion optimization project> Deployment of a Programme Management function at amajor Tier-1> Benchmarking of Support & Services organizations inAerospace and adjacent industries> Organization of supplier management (Engineering andIndustrial activities)> Plateau organization in FAL to support industrial ramp up> Reorganisation of the Finance and Control function of aPrime> Reorganisation of the Engineering Centre of Excellence of aSpace Prime> International Engineering footprint strategy
20130626_Assocham_Rahul Gangal.pptx6Background to the issue : Need <strong>for</strong> a security guideline is wellestablishedThe current issue is largely an operational issue but one that is holding up business<strong>Security</strong> assessments are now proposed by the MHA <strong>for</strong> all industrial licence applicants> These guidelines are still under promulgation> Under the structure envisages, MHA will be required to do a "<strong>Security</strong> Assessment"> As a result of this, a signifcant number of IL applications are held up <strong>for</strong> clearance> There is a need <strong>for</strong> industry dialogue to help create a better understanding and appreciation of issues> From a global perspective, A recent study found that OEMs allocate nearly 2-3% of their annual turnover to maintainsecurity (incuding data and personnel security)
20130626_Assocham_Rahul Gangal.pptx7<strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong> Manufacturers : What is the globalexperience on the same?Need <strong>for</strong> a security guideline is well establishedWell established global process <strong>for</strong> all units addressing strategic manufacturing needs> Globally these guidelines encompass– Physical <strong>Security</strong>– Data <strong>Security</strong>– Personnel <strong>Security</strong>– Vulnerability and Risk Assessment– Business Continuity Measures> Globally these guidelines are– Clear and Established ✓– Understood ✓– Non-negotiable ✓– Self Certified and Auditable ✓– With extremely high penalties <strong>for</strong> violations ✓
20130626_Assocham_Rahul Gangal.pptx8<strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong> Manufacturers : What is the globalexperience on the same?Need <strong>for</strong> a security guideline is well establishedWell established global process <strong>for</strong> all units addressing strategic manufacturing needs> Globally these guidelines encompass– Physical <strong>Security</strong>– Data <strong>Security</strong>– Personnel <strong>Security</strong>– Vulnerability and Risk Assessment– Business Continuity Measures> Globally these guidelines are– Clear, Established and Understood ✓– Built into the business cases of Companies ✓– Non-negotiable ✓– Self Certified and Auditable ✓– With extremely high penalties <strong>for</strong> violations ✓NOT THE ISSUETHE ISSUE
20130626_Assocham_Rahul Gangal.pptx9<strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong> Manufacturers : What is the globalexperience on the same?Need <strong>for</strong> a security guideline is well establishedWell established global process <strong>for</strong> all units addressing strategic manufacturing needs> Globally these guidelines encompass– Physical <strong>Security</strong>– Data <strong>Security</strong>– Personnel <strong>Security</strong>– Vulnerability and Risk Assessment– Business Continuity Measures> Globally these guidelines are– Clear, Established and Understood ✓– Built into the business cases of Companies ✓– Non-negotiable ✓– Self Certified and Auditable ✓– With extremely high penalties <strong>for</strong> violations ✓NOT THE ISSUETHE ISSUE
20130626_Assocham_Rahul Gangal.pptx10<strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong> Manufacturers : Nature of the issueexplainedThere are primarily three key questions that emergeIssue 1IL is sought by a variety offirms with differing levels of'sensitivity' of deliveredproduct> Components to Full Systems> Services to ManufacturingIssue 2<strong>Security</strong> Guidelines came as an add-onrequirement much after most firms hadalready concluded their discussionswith <strong>for</strong>eign partners and had applied<strong>for</strong> JVs> It is causing an Inordinate delay in the ILprocess> For some firms, their current securityarrangements are already on-par withglobal requirements, they too are stuckIssue 3Issue of cost of implementationof guidelines. Cost needs to bebuilt into the business case> What happens to companies <strong>for</strong>whom Defence relatedproduction is only a smallsubset of their overallproductionWhat are the differing standardsrequired <strong>for</strong> different classes offirmsWhilst self certification and an Affadavitstating intent to comply upon notification isa quick-fix, a lot of firms are held upHow to ensure costs ofcompliance are factored in thebusiness case or mitigated
20130626_Assocham_Rahul Gangal.pptx11Assocham Recomendations on <strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong>ManufacturersPhysical <strong>Security</strong>Criteria Superior Advanced BasicPhysical <strong>Security</strong>on the PerimeterSingle wall (12 feet) with barbed wire fencing andtrack upfront.Single wall (8 feet) with barbed wire fencing.Perimetric Wall with barbed wire fencing on top incases of independent units. For units operatingout of shared commercial spaces, defined spacewith its perimetric controlPerimetric ControlPerimeter and entry/exit points lighting and videostreaming by surveillance cameras to ControlRoom.Perimeter and entry/exit points lighting andvideo streaming by surveillance cameras toControl Room.Perimeter and entry/exit points lighting.Surveillance &Monitoring24X7 Video Monitoring, Recording and ArchivalFull campus outdoor and each room in buildings/workshop under surveillance.24X7 Video MonitoringEach room in buildings/ workshop undersurveillance.Specificareas in building/workshop undersurveillanceAccess ControlANPR & Continuous Video analytics – stationaryobject, fire etc including data recording andarchivalBiometric access control to each room of eachbuilding/ workshop areas with intruder alarm withdata logs of AccessElectronic access control to large definedspaces (manufacturing zone, warehouse,Office space etc) with data logsKey based access control with register in allrooms recording entry and exit.
20130626_Assocham_Rahul Gangal.pptx12Assocham Recomendations on <strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong>ManufacturersPerimetric and Access ControlCriteria Superior Advanced BasicControl Center Control Room with monitoring, recording <strong>for</strong> 30days and replaying facility.Control Room with monitoring, recording <strong>for</strong>10 days and replaying facility.Control Room with monitoring.Access control monitoring and card managementCommunication to Management and RespondersAccess control monitoring and cardmanagementCommunication to Management andRespondersCommunication to Management and RespondersData <strong>Security</strong>Criteria Superior Advanced BasicData <strong>Security</strong> ISO 27001 Compliant ISO 27001 Compliant<strong>Security</strong> - PersonnelCriteria Superior Advanced BasicData <strong>Security</strong> ISO 27001 Compliant ISO 27001 Compliant
20130626_Assocham_Rahul Gangal.pptx13Assocham Recomendations on <strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong>Manufacturers<strong>Security</strong> - PersonnelCriteria Superior Advanced Basic<strong>Security</strong>PersonnelChief <strong>Security</strong> Officer reporting to MD Chief <strong>Security</strong> Officer reporting to MD Chief <strong>Security</strong> Officer reporting to MD andmanning control roomPerimeter Patrol Entry/ Exit Gates Entry/ Exit GatesEntry/ Exit GatesQuick Response Team including FireFightingControl Room Manning, 24x7MedicsIT <strong>Security</strong> HeadQuick Response Team including FireFightingControl Room Manning, 24x7IT <strong>Security</strong> HeadIT <strong>Security</strong> HeadEmployees<strong>Security</strong>ClearanceDirectors Yes Yes YesEmployees Yes No NoConsultants Yes yes No
20130626_Assocham_Rahul Gangal.pptx14<strong>Security</strong> Guidelines <strong>for</strong> <strong>Private</strong> Manufacturers : Way ForwardApproaches that work… Globally… and could work in India as well> Promulgate the Guidelines and make them public. Also define the penalties> Companies can plan their security investments and build them into their business cases> Provide a tier-ed approach to requirement of <strong>Security</strong> Infrastructure> We have recommended a three tier approach : Basic, Advanced, Superior> The assessment of which bucket does an Assessee company fall in should be done at the time of the <strong>Security</strong>Audit which the MHA conducts currently in the early part of the Industrial licence process> Make the implementation of the guidelines easy> Companies should be able to create the <strong>Security</strong> Infrastructure and self certify> DOMW or a designated MHA department should be designated to have the powers to conduct security audit andvalidate the process> Some companies depending upon an environmental perception of risk could be asked to start commercialproduction only after a security audit by the designated security agency> <strong>Security</strong> certifications should be valid <strong>for</strong> a period of 2 years> Companies found defaulting should be debarred from the production activity of the specific iitem <strong>for</strong> which IL issought
20130626_Assocham_Rahul Gangal.pptx15It's character that createsimpact!