What this is
What is a security risk assessment?
What is a security risk assessment?
An assessment of threats to people, premises, product and information, the controls in place, and the gaps between them. In an operational setting it spans workplace violence toward staff, unauthorised access, theft and, where food or pharmaceutical product is handled, deliberate contamination.
How does it relate to food defense?
Food defense under the FSMA Intentional Adulteration rule is a specific regime addressing deliberate contamination intended to cause wide-scale public health harm, organised around actionable process steps. A general security assessment is broader and does not satisfy it. Where both apply, they should reference each other rather than merge.
Scope
When is a security risk assessment required?
This assessment covers security threats across people, premises, product and information. Specific regimes sit alongside it.
Use this template when
- Threats to staff including aggression from the public, service users, contractors and colleagues
- Unauthorised access to premises, restricted areas and vehicles
- Theft of product, equipment, materials and data
- Site security supporting food defense, where a separate plan is also required
- Following an incident, a threat, or a change to site layout, occupancy or operating hours
Do not use it for
- The food defense plan under 21 CFR Part 121, which is a distinct regime organised around actionable process steps
- The workplace violence prevention plan, which in California has prescribed content and its own log
- Information security risk assessment, which addresses systems and data with its own methodology
- Lone working assessment, which addresses a specific exposure this may reference
- Physical access control administration, which implements the conclusions rather than reaching them
Compliance mapping
Which ISO 45001 cl.6.1.2 requirements does this satisfy?
Security spans an occupational safety duty, a fast-moving workplace violence regime, and product-specific requirements where food or pharmaceuticals are handled.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.6.1.2 | Hazard identification including violence and work organisation factors | Threats considered |
| Cal Labor Code 6401.9 | Written workplace violence prevention plan, violent incident log, training and post-incident investigation | Controls in place |
| OSHA General Duty Clause | Duty to address recognised hazards including workplace violence where feasible controls exist | Threats considered |
| 21 CFR Part 121 | Food defense plan with vulnerability assessment and mitigation strategies, where the IA rule applies | Controls in place |
| GFSI schemes | Site security and food defense requirements including access control and visitor management | Controls in place |
| CTPAT | Supply chain security criteria including yard security, seal verification and container inspection | Controls in place |
| ISO 27001 A.7 | Physical entry controls, securing offices and facilities, and working in secure areas | Controls in place |
| ISO 45001 cl.8.2 | Emergency preparedness covering security incidents alongside other emergencies | Outcome |
What it does not cover
- The food defense plan under the Intentional Adulteration rule, which is a distinct regime with its own required components.
- The workplace violence prevention plan, which where required has prescribed content, training and a separate incident log.
- Information security risk assessment, which addresses systems, data and access with a different methodology.
- Access control administration, which implements the conclusions rather than producing them.
- Lone working assessment, which covers a specific exposure this assessment should reference.
How to complete it
How to complete a security risk assessment, step by step
Order matters here more than in most assessments, because the default order produces the wrong controls.
Start with who is exposed to aggression, when, and with what support available. Counter staff, drivers, home visitors, night shift, lone workers and anyone handling refusals or enforcement. Premises and product follow. Assessments that start with the building reliably conclude with cameras and gates and leave the front desk unaddressed.
For each restricted area, who holds access, why, and when it was last reviewed. Access accumulates through role changes and project work and is almost never removed. The list of people who can reach the most sensitive area of a site is usually longer than anyone expects and older than anyone realises.
They are on site, frequently unescorted, and outside the induction and access systems that cover employees. In yards, delivery drivers are alone with vehicles and product for extended periods. Any assessment omitting them has left out the population with the most access and the least oversight.
Where a workplace violence prevention plan or a food defense plan is required, this assessment should feed them and reference them, not attempt to be them. Both have specified components and retention requirements that a general security assessment does not satisfy.
What auditors find
Most common security risk assessment findings
Security findings concentrate on the inside of the fence.
| Finding | Clause | What fixes it |
|---|---|---|
| Assessment addresses perimeter only, with no aggression exposure assessed. | ISO 45001 cl.6.1.2 | Assess people first; the perimeter does not constrain someone already inside. |
| California location without a written workplace violence prevention plan. | Cal Labor Code 6401.9 | Required since July 2024; there is no exemption for out-of-state headquarters. |
| Violent incident log absent or missing required fields. | Cal Labor Code 6401.9 | Maintain with the prescribed content, retained five years and viewable by employees on request. |
| Access lists not reviewed, with former employees or completed projects still holding access. | ISO 27001 A.7 | Review on a cycle and on role change; access accumulates and is never removed by default. |
| Contractors and delivery drivers outside the assessment scope. | ISO 45001 cl.8.1.4 | Include them; they have the most access and the least oversight. |
| General security assessment presented as a food defense plan. | 21 CFR Part 121 | They are different regimes; the IA rule requires specific components a security assessment does not contain. |
| No de-escalation training for roles exposed to aggression. | Cal Labor Code 6401.9 | Train the exposed roles; where a plan is required, training is a specified element. |
| Incidents not recorded because no injury resulted. | Cal Labor Code 6401.9 | Log every violent incident regardless of injury; that is the requirement and the trend data. |
| Assessment not reviewed after a change to hours, layout or occupancy. | ISO 45001 cl.6.1.2 | Extended hours and layout changes alter exposure; treat both as triggers. |
| Staff not consulted on which situations feel unsafe. | ISO 45001 cl.5.4 | Ask; the people at the counter know which interactions escalate. |
Case in point
Case in point: the regime that arrived without being noticed
California's SB 553 took effect on 1 July 2024, adding Labor Code section 6401.9. It requires nearly all California employers to establish, implement and maintain a written workplace violence prevention plan, keep a violent incident log with prescribed fields, provide initial and annual training, investigate incidents, and retain hazard and incident records for five years and training records for one year.
The exemptions are narrow: worksites with fewer than ten employees not open to the public, employees teleworking from a location of their own choosing, healthcare settings covered by a separate Cal/OSHA standard, and certain law enforcement and corrections facilities. There is no exemption based on where the organisation is headquartered.
Cal/OSHA was directed to propose a general industry standard by December 2025, with the standards board due to adopt one by the end of 2026. Federal OSHA convened a small business panel in 2023 but had not published a proposed rule as of early 2026.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- SAF-142
- Archetype
- Assessment
- Record ID
- SRA-2026-000
- Scoring
- Residual band
- Direction
- Low is good
- Singleton
- Yes
- Basis
- ISO 45001 cl.6.1.2
- Links
- Links Food defense, Access control
- Tags
- Security
- Sections
- 4
- Fields
- 46
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 3
Header
10 fieldsAssessment ID*
Auto sequence. Format SRA-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Security And Food Defense Are The Same Assessment
On a food site, the person who can get in unnoticed can also contaminate product. Assess both together rather than running two overlapping exercises.
Assessment Trigger*
Assessor*
Scope*
Threats considered
9 fieldsTheft Of Product*
- Low3 pts
- Medium1 pt
- High0 pts
Theft Of Equipment Or Fuel*
- Low3 pts
- Medium1 pt
- High0 pts
Unauthorised Access*
- Low3 pts
- Medium1 pt
- High0 pts
Deliberate Product Contamination*
- Not credible4 pts
- Low3 pts
- Medium1 pt
- High0 pts
Sabotage Of Plant*
- Not credible4 pts
- Low3 pts
- Medium1 pt
- High0 pts
Insider Threat*
The hardest to control and the most commonly ignored. Access, supervision and grievance handling all matter here.
- Not credible4 pts
- Low3 pts
- Medium1 pt
- High0 pts
Cargo Theft In Transit
- Not credible4 pts
- Low3 pts
- Medium1 pt
- High0 pts
Trespass Or Protest
- Not credible4 pts
- Low3 pts
- Medium1 pt
- High0 pts
Cyber Enabled Physical Impact
- Not credible4 pts
- Low3 pts
- Medium1 pt
- High0 pts
Controls in place
12 fieldsPerimeter Secure*
- Yes3 pts
- Partly1 pt
- No0 pts
Access Controlled At Entry Points*
- All points3 pts
- Some1 pt
- None0 pts
Visitor Handling Controlled*
- Yes3 pts
- Partly1 pt
- No0 pts
Restricted Areas Defined And Enforced*
- Yes3 pts
- Defined not enforced1 pt
- No0 pts
Key And Code Control*
- Documented and current3 pts
- Informal1 pt
- None0 pts
CCTV Coverage Adequate*
- Yes3 pts
- Partial1 pt
- None0 pts
Recruitment Screening Applied*
- Yes3 pts
- Partly1 pt
- No0 pts
Contractor And Agency Screening*
- Yes3 pts
- Partly1 pt
- No0 pts
Out Of Hours Arrangements*
- Robust3 pts
- Basic1 pt
- None0 pts
Ingredient And Water Points Protected*
Open silos, bulk intake and water tanks are the food defense points that matter most.
- Yes3 pts
- Partly1 pt
- No0 pts
Tamper Evidence On Product
- Yes3 pts
- Not applicable3 pts
- No0 pts
Reporting Route For Concerns*
- Yes3 pts
- Informal1 pt
- None0 pts
Outcome
15 fieldsHighest Control Level Applied*
- Eliminate4 pts
- Substitute4 pts
- Engineer3 pts
- Separate or isolate3 pts
- Administrative1 pt
- PPE0 pts
Residual Band*
- Low, 1 to 45 pts
- Medium, 5 to 94 pts
- High, 10 to 142 pts
- Very high, 15 to 191 pt
- Extreme, 20 to 250 pts
Risk Acceptable*
- Yes3 pts
- Marginal1 pt
- No0 pts
Further Controls Required
Risk Assessment
Risk ID
Format RSK-2026-00000.
Links to FDN-012 Risk ID
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Next Review Due*
Assessor*
Signature*
Site Manager*
Second Signature*
SAF-142 · record IDs look like SRA-2026-000 · Links Food defense, Access control
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The assessment covers four domains. What fails is the access list nobody reviewed and the aggression exposure nobody assessed.
Holds the assessment across people, premises and product, and links exposed roles to training and to the incident log where one is required.
Brings contractors, drivers and visitors into scope, with access tied to the work and expiring when it completes.
Reviews access lists on a cycle and on role change, since access accumulates through project work and is rarely removed.
Connects site security to the food defense plan where the Intentional Adulteration rule applies, keeping the two distinct but linked.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Glossary
Security Risk Assessment definitions and key terms
- Workplace violence
- Any act or threat of physical violence, harassment, intimidation or other threatening behaviour at the worksite.
- Violent incident log
- A record of every workplace violence incident with prescribed fields, retained five years in California, with identifying details omitted.
- Insider threat
- Risk from someone with legitimate access, which perimeter controls do not address.
- Actionable process step
- Under the food defense regime, a point where a significant vulnerability exists and mitigation can be applied.
- Escorted access
- A control requiring a visitor or contractor to be accompanied within defined areas, only effective where the escort is available.
- Access review
- Periodic confirmation that each person holding access still requires it, without which access accumulates indefinitely.
- De-escalation
- Technique for reducing the intensity of a confrontation, a specified training element where a violence prevention plan is required.
- Post-incident investigation
- Review following a violent incident, required as a plan element and distinct from a general incident investigation.
FAQ
Frequently asked questions about security risk assessment
Does a security assessment satisfy food defense requirements?+
No. The Intentional Adulteration rule at 21 CFR Part 121 requires a specific set of components: a vulnerability assessment identifying actionable process steps with reasoning recorded either way, mitigation strategies, monitoring, corrective action and verification. A general security assessment contains none of those in the required form, though it should feed and reference the food defense plan.
Who does California's SB 553 apply to?+
Nearly all California employers, with narrow exemptions: worksites with fewer than ten employees not open to the public, employees teleworking from a location of their own choosing, healthcare settings under the separate Cal/OSHA standard, and certain law enforcement and corrections facilities. There is no exemption based on headquarters location, so any California site brings the obligation.
What must be in the violent incident log?+
The date, time and location, a description of the incident, its classification, the type of violence, the consequences and actions taken, and who completed the log, with personal identifying information omitted. It is retained five years and employees may view and copy it within fifteen calendar days of a request.
Why start with people rather than premises?+
Because the threats that most often materialise involve someone already inside: aggression at a counter, a contractor with unescorted access, a driver alone in a yard. Perimeter controls do not address any of them. Assessments that begin with the building reliably conclude with cameras and leave the exposed roles unaddressed.
Should incidents without injury be recorded?+
Yes. Where a violence prevention plan is required the log covers every incident regardless of whether injury resulted, and even where it is not required, threats and near misses are the leading data. Recording only injuries produces a log that describes outcomes rather than exposure.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Lone Working and Security
Food Defense Plan
Assesses where product could be deliberately contaminated and sets out how that is prevented
Violence and Aggression Assessment
Assesses roles exposed to aggression from the public, hauliers or colleagues, and the controls in place
Lone Working Risk Assessment
Assesses tasks done alone, out of hours or out of sight, and how the person would raise an alarm
Lone Worker Check In Record
Records the agreed contact points during a period of lone working, and that each one happened
Security Incident Investigation
Records theft, break in, unauthorised access, tampering or threat
Access Control Review
Reviews who holds access to which areas and whether that is still justified
More in Security and Lone Working
Violence and Aggression Assessment
Assesses roles exposed to aggression from the public, hauliers or colleagues, and the controls in place
Lone Working Risk Assessment
Assesses tasks done alone, out of hours or out of sight, and how the person would raise an alarm
Lone Worker Check In Record
Records the agreed contact points during a period of lone working, and that each one happened
Security Incident Investigation
Records theft, break in, unauthorised access, tampering or threat
Access Control Review
Reviews who holds access to which areas and whether that is still justified
CCTV and Monitoring Review
Reviews camera coverage, recording retention, image quality and who can view footage
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- California Labor Code section 6401.9 and Cal/OSHA workplace violence guidance
- 21 CFR Part 121, mitigation strategies to protect food against intentional adulteration, FDA
- ISO 45001:2018 clauses 6.1.2 and 8.1.4
- ISO/IEC 27001 Annex A.7, physical and environmental security
- OSHA guidelines for preventing workplace violence
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.