How to Conduct a Physical Security Risk Assessment: A Methodology Guide for Bangladesh Enterprises

Executive Summary

Every physical security investment decision — whether to install CCTV, access control, intrusion detection, or entrance screening — should be preceded by a structured risk assessment. Without a risk assessment, security spending is informed by intuition, vendor recommendations, or imitation of peers. With a risk assessment, spending is informed by evidence: evidence of which threats are most likely, which assets are most valuable, and which countermeasures provide the greatest risk reduction per taka invested.

This methodology guide provides a complete framework for conducting a physical security risk assessment for Bangladesh enterprises, drawing on internationally recognised standards (ISO 31000, ASIS PSI) and adapted for the specific threat landscape, regulatory environment, and business context of Bangladesh's banking, manufacturing, healthcare, and commercial real estate sectors.

The guide covers scope definition, asset valuation, threat identification (with a Bangladesh-specific threat taxonomy), vulnerability assessment methodology, risk calculation, risk treatment and countermeasure selection, report format, and periodic review triggers. We conclude with a chapter on Bangladesh's specific threat landscape by industry — the threat profiles that SSAL's risk assessment practice has identified across hundreds of projects in the Bangladesh market.

Chapter 1: Why Risk Assessment Is the Foundation of Security Planning

1.1 The Cost of Skipping Risk Assessment

Organisations that deploy security systems without a preceding risk assessment make predictable errors. They over-invest in visible, aesthetic security (CCTV in visible locations, impressive reception checkpoint) while under-investing in the actual attack vectors they face (insider threat, back-door access, social engineering of reception staff). They install the system that their neighbour installed without knowing whether their neighbour's risk profile matches theirs. They buy the system the vendor recommends without having independent verification that it addresses their specific vulnerabilities.

The result: security spending that does not reduce risk proportionately. A BDT 50,00,000 security investment made without risk assessment may reduce the organisation's risk by 20%. The same investment made following a risk assessment, directing spending to the highest-risk areas with the most effective countermeasures, can reduce risk by 60–70%.

1.2 Risk Assessment as Regulatory Compliance

Bangladesh Bank ICT Security Guideline v4.0 explicitly requires that banks conduct periodic physical security risk assessments as part of their information security management process. BGMEA, RSC, and Accord compliance frameworks for garment manufacturers include workplace safety risk assessments with physical security components. PDPO 2025 requires Data Protection Impact Assessments (DPIAs) that overlap significantly with physical security risk assessments for facilities processing sensitive personal data.

For regulated Bangladesh enterprises, a documented physical security risk assessment is not just good practice — it is a compliance deliverable that must be available for regulatory inspection. SSAL's risk assessment reports are formatted to meet regulatory documentation requirements.

1.3 Risk Assessment as Investment Justification

A well-conducted risk assessment produces a prioritised list of security recommendations with estimated risk reduction values for each. This is the most effective tool for securing security investment budget approval from finance committees and boards. Instead of requesting "BDT 80,00,000 for a CCTV system," the security manager presents a risk assessment showing that the organisation's highest-rated risk (cargo theft from the Gazipur warehouse) has a BDT 2,40,00,000 annual expected loss, and that a specific combination of CCTV and access control countermeasures reduces this loss by 70% (BDT 1,68,00,000 per year) at a cost of BDT 45,00,000 (payback: 3.2 months). This is a compelling investment case.

Chapter 2: Scope Definition

2.1 Assets in Scope

The risk assessment scope defines what you are protecting. Asset categories for a physical security risk assessment:

People: Employees, visitors, contractors, customers. Harm to people (physical injury, threats, harassment) is the highest-priority security outcome in any risk assessment. Human safety takes precedence over asset protection in every countermeasure trade-off.

Physical assets: Buildings, equipment, inventory, cash, vehicles, IT hardware. Physical assets are the most commonly quantified security targets for financial ROI calculation.

Information assets: Physical files, printed documents, visual whiteboards, unattended screens, physical access to servers. Information theft through physical access is a significant and underappreciated threat in Bangladesh's corporate sector.

Reputation and brand: The reputational damage from a publicised security incident — a bank robbery, a data breach enabled by physical access, a workplace violence incident — can exceed the direct financial loss by orders of magnitude.

2.2 Locations in Scope

Map all locations that will be included in the assessment:

• All building floors and areas (include plant rooms, car parks, loading docks — often overlooked)
• All external perimeter (fence lines, external car parks, loading areas)
• All access points (main entrance, staff entrance, service entrance, emergency exits)
• All remote sites, branch offices, and satellite locations to be included

Define explicitly what is OUT of scope — public roads, adjacent buildings (which you cannot control), tenant-controlled areas in multi-tenancy buildings. Out-of-scope areas that present security risks must be flagged in the report for information even if they cannot be directly addressed.

2.3 Systems in Scope

Identify which existing security systems are in scope for the assessment:

• Existing CCTV (coverage, functionality, retention)
• Existing access control (technology type, coverage, integration)
• Existing intrusion alarm (zones, monitoring, response)
• Existing fire safety systems (to identify interaction with physical security)
• Security staffing (guard deployment, training, procedures)

Chapter 3: Asset Valuation

3.1 Tangible Asset Value

Assign a monetary value to each asset category:

Replacement value: The cost to replace a physical asset if destroyed or stolen. For equipment: purchase price. For inventory: cost price of goods. For IT hardware: current market replacement cost. For vehicles: current market value.

Business interruption value: The revenue loss from the asset being unavailable. A server room fire that destroys the core banking system for 3 days has a business interruption value equal to 3 days' revenue loss plus recovery costs — potentially BDT 10–50 crore for a large Bangladesh bank.

Information value: The value of data stored on or accessible through physical assets. A stolen laptop with unencrypted customer data has a liability value far exceeding the BDT 80,000 hardware replacement cost.

3.2 Intangible Asset Value

Reputational value: Difficult to quantify precisely, but estimable. A major security incident reported in the media costs at minimum the management time to respond, plus quantifiable impacts on customer retention, employee morale, and future business opportunities. For Bangladesh's banking sector, a robbery or data breach can trigger Bangladesh Bank scrutiny that restricts new branch approvals and product launches.

Criticality ranking: After valuation, rank assets by criticality — the combination of their value and the consequences of loss or compromise. A Tier 1 asset is one whose loss would be catastrophic (vault cash, core server, life safety systems). A Tier 3 asset is one whose loss would be inconvenient but recoverable (office furniture, perimeter cameras).

Chapter 4: Threat Identification

4.1 Threat Taxonomy

A threat is a potential event that could harm an asset. Categorise physical security threats systematically:

External threats — deliberate:

• Theft (burglary, robbery, shoplifting, cargo theft)
• Vandalism and sabotage
• Unauthorised entry (intruder, trespasser)
• Violent attack (robbery with violence, workplace violence, terrorism)
• Cyber-physical attack (attacking physical access controls to gain IT network access)

External threats — accidental:

• Vehicle collision (accidental vehicle impact on building or infrastructure)
• Natural disaster (flood, cyclone, lightning — all relevant in Bangladesh)
• Fire (external fire spreading from adjacent premises)

Internal threats — deliberate:

• Insider theft (employee stealing assets, cash, equipment)
• Insider sabotage (deliberate damage to systems, data destruction)
• Fraud facilitated by physical access (accessing records, manipulating systems)
• Information theft (photographing confidential screens, removing documents)

Internal threats — accidental:

• Employee injury (workplace accident)
• Accidental fire (from equipment malfunction, negligent smoking)
• Accidental data loss (leaving confidential documents visible, unsecured)

4.2 Threat Agent Profiling

For each significant threat, profile the likely threat agent (who would commit this threat):

Opportunistic criminal: No specific planning, acts on accessible opportunity. Most burglaries in Bangladesh's commercial sector are opportunistic — unlocked doors, accessible windows, absent security. Low sophistication; deterred by visible security measures.

Sophisticated criminal: Plans the attack, researches the target, identifies weaknesses before acting. High-value robberies and organised cargo theft fall in this category. Not deterred by visible cameras alone — requires multiple overlapping security layers.

Insider threat: Employee with authorised access who misuses it. The most difficult threat to prevent because the threat agent has legitimate presence and credentials. Requires role-based access control, audit trails, and behavioural monitoring.

Targeted attacker: Terrorist or violent actor with a specific target (a bank, a government office, a high-profile business). The most severe threat but the least common. Requires the most comprehensive security measures (vehicle barriers, hardened entrance, armed response) for high-risk facilities.

Chapter 5: Vulnerability Assessment

5.1 Physical Inspection Methodology

A vulnerability assessment identifies weaknesses in the physical environment, security systems, and operational procedures that could be exploited by a threat agent. The primary tool is a structured physical inspection:

Site perimeter inspection:

• Walk the entire perimeter fence or boundary. Document any gaps, damaged sections, or points where the perimeter can be easily breached.
• Assess external lighting coverage. Darkness is the primary enabler of nighttime intrusion — identify unlit or poorly lit perimeter sections.
• Assess CCTV coverage of the perimeter. Are all perimeter entry points covered? What is the image quality at night?
• Assess vehicle access control. Can a vehicle drive or be driven to the building exterior without interception?

Building envelope inspection:

• Inspect every ground-floor window and door. Are all windows lockable? Are all external doors alarmed? Are any windows left open routinely?
• Inspect roof access points. Are rooftop doors locked and alarmed? Can the roof be accessed from adjacent buildings?
• Inspect service penetrations (HVAC ducts, cable entries). Can any be exploited as entry points?

Interior inspection:

• Test access control at every controlled door. Do all readers function? Are there areas where authorised access is overly broad (more people have access than the security zone warrants)?
• Check high-security areas: vault, server room, cash counting. Are all physical access requirements being consistently applied?
• Review reception and visitor management. Can visitors bypass the reception checkpoint? Are visitor logs maintained?

5.2 Gap Analysis Against Standards

Compare the current security status against the relevant security standard for the facility type:

Bangladesh Bank ICT Security Guideline v4.0: For bank branches — physical access controls, CCTV retention, MFA for restricted areas.

BGMEA/RSC/Accord: For garment factories — fire safety, emergency exits, workplace safety.

BEPZA regulations: For EPZ facilities — perimeter security, customs compliance, personnel screening.

ISO 27001 Annex A.11: Physical and environmental security controls for certified organisations.

Document each gap as a vulnerability: a specific weakness that increases the likelihood or consequence of a defined threat.

Chapter 6: Risk Calculation

6.1 Likelihood × Impact Matrix

Risk is the product of likelihood (the probability that a threat will be realised) and impact (the consequence if it is realised). Both factors are rated on a consistent scale:

Likelihood scale:

• 1 (Rare): Less than once in 10 years for this facility type
• 2 (Unlikely): Once in 5–10 years
• 3 (Possible): Once in 1–5 years
• 4 (Likely): Once per year
• 5 (Almost certain): Multiple times per year

Impact scale:

• 1 (Negligible): BDT < 1,00,000 loss; no operational disruption; no regulatory consequence
• 2 (Minor): BDT 1,00,000–10,00,000; minor operational disruption; no significant regulatory consequence
• 3 (Moderate): BDT 10,00,000–1,00,00,000; significant operational disruption; possible regulatory consequence
• 4 (Major): BDT 1,00,00,000–10,00,00,000; major operational disruption; regulatory consequence likely
• 5 (Catastrophic): BDT > 10,00,00,000; severe operational disruption; criminal liability possible

Risk rating = Likelihood × Impact (range: 1–25)

Risk ratings:

• 1–5: Low risk (manage with routine procedures)
• 6–12: Medium risk (specific countermeasures required)
• 13–19: High risk (priority countermeasures required)
• 20–25: Critical risk (immediate action required)

6.2 Risk Register

Document all identified risks in a risk register table:

The residual risk reflects the risk remaining after applying current controls. The assessment recommends countermeasures to reduce residual risk to acceptable levels.

Chapter 7: Risk Treatment

7.1 Risk Register and Countermeasure Selection

For each risk rated Medium or above, identify and evaluate countermeasures:

Risk treatment options:

• Risk reduction: Implement countermeasures that reduce likelihood (access control, alarm), reduce impact (suppression systems), or both
• Risk transfer: Insurance for high-impact, low-frequency risks (armed robbery, major fire)
• Risk acceptance: Formally accept low-rated risks where countermeasure cost exceeds expected loss value
• Risk avoidance: Eliminate the risk by changing the business activity (relocating a vulnerable operation, changing a process)

For each recommended countermeasure, quantify its risk reduction effect (reduction in likelihood or impact rating), estimate its cost, and calculate the cost-benefit ratio: risk reduction value (in BDT) ÷ countermeasure cost.

7.2 Residual Risk Acceptance

After all recommended countermeasures are applied, residual risks remain. Some risk is always residual — no security system eliminates all risk. Residual risks must be formally accepted by the organisation's management. Document the residual risk register with the authorised signatory confirming acceptance. This documentation demonstrates regulatory due diligence and protects management from personal liability if a residual risk event occurs.

Chapter 8: Report Format

8.1 Executive Summary

The executive summary is the section that board members, senior management, and regulators read. It must convey:

• The scope of the assessment (locations, systems, period)
• The overall risk profile of the organisation (high/medium/low)
• The top 3–5 priority findings and their risk ratings
• The top 3–5 recommended actions with estimated costs
• The requested authorisation for countermeasure investment

The executive summary should be no longer than 2 pages and should avoid technical jargon. Every risk should be expressed in terms of business impact, not technical vulnerability description.

8.2 Findings Table

The findings table presents all identified vulnerabilities, mapped to their risk IDs, with current control assessment and recommended countermeasures. This table is the operational reference for the security manager implementing the recommendations.

8.3 Prioritised Recommendation List

The recommendations section lists all proposed countermeasures ranked by priority:

• Priority 1 (Immediate — within 30 days): Critical risk mitigation actions
• Priority 2 (Short-term — within 90 days): High risk mitigation actions
• Priority 3 (Medium-term — within 12 months): Medium risk mitigation actions
• Priority 4 (Long-term — within 24 months): Low risk enhancement actions

Include for each recommendation: description, estimated cost, risk reduction (change in risk rating), responsible party for implementation, and target completion date.

Chapter 9: Bangladesh-Specific Threat Landscape

9.1 Banking Sector

Bangladesh's banking sector faces a distinctive threat profile: physical cash handling at branch level creates robbery risk; ATM skimming and physical ATM attacks (jamming, card trapping) are prevalent; server rooms and data centres at headquarters face both external intrusion risk and insider threat from IT staff with privileged access; and regulatory inspection risk (Bangladesh Bank) is significant for banks with documented physical security gaps.

Priority threats: ATM-related fraud and theft, branch robbery, insider data theft, and server room physical access.

9.2 Garment Manufacturing (RMG) Sector

Bangladesh's BDT 40,000 crore RMG export industry faces specific physical security threats: cargo theft at loading docks (finished garments are high-value, portable, and readily saleable); fire safety risk (historical high-profile incidents such as Tazreen Fashion Fire and Rana Plaza have made fire safety a primary risk); internal theft of raw materials (fabric, accessories); and access control for compliance auditors from Accord, RSC, and international brands who require documented security procedures.

Priority threats: cargo theft, fire (safety and security), internal material theft, and compliance audit findings.

9.3 Healthcare Sector

Hospitals and clinics face pharmaceutical theft (a significant financial and patient safety risk), patient confidentiality breaches through physical access to records, workplace violence from distressed patients or family members, and equipment theft (medical devices are high-value and portable). Blood bank and pharmacy storage areas require the highest-priority physical access control.

9.4 Government and Diplomatic Sector

Government offices face terrorism and politically motivated attack threats (Bangladesh's political environment creates specific risks at certain periods), civil unrest (crowd gathering and building access threats), official document security, and corruption-related internal threats (bribery facilitated by unauthorised access to decision-making areas).

Chapter 10: Periodic Review — When to Re-Assess

10.1 Scheduled Review Triggers

Physical security risk assessments are not one-time documents — they must be reviewed periodically and updated when conditions change. Schedule annual reviews minimum. Bangladesh Bank ICT Security Guideline v4.0 implicitly requires annual security review for banks.

10.2 Event-Triggered Review

Re-assess immediately following:

• A security incident at the facility or at a comparable facility in the same sector
• A significant change in the physical environment (renovation, new construction adjacent, change in facility use)
• A change in security personnel or security management
• A significant change in asset values (major equipment purchase, expansion of cash handling operations)
• A new regulatory requirement imposing physical security obligations
• A post-incident review that identifies systemic security failures

Conclusion

A structured physical security risk assessment is not a compliance checkbox — it is the analytical foundation for every security investment decision. Organisations that conduct rigorous, documented risk assessments allocate their security budgets to the highest-impact countermeasures, demonstrate regulatory due diligence, and build security programmes that genuinely reduce risk rather than simply adding visible security theatre.

SSAL conducts physical security risk assessments as a standalone service and as the first phase of every security system design project. Our assessment methodology is aligned with ISO 31000, ASIS PSI, and Bangladesh Bank ICT Security Guideline v4.0, and our reports are formatted for both operational use by security managers and regulatory presentation to Bangladesh Bank, BGMEA, RSC, and other oversight bodies.

About SSAL

Smart Safety & Automations Ltd. (SSAL) is Bangladesh's leading enterprise security consultancy and solutions provider. Our certified security risk assessors have conducted assessments for major financial institutions, garment manufacturers, healthcare organisations, and government departments across Bangladesh.

Start your physical security programme with a professional risk assessment.

• Website: www.smartsafety.com.bd
• CTA: [Get Free Consultation] [Talk to Our Expert] [Request a Quote]