Practical Consulting for Security, Readiness, and Compliance
SPG helps organizations assess risk, meet ISC and Department of War (DoW) requirements, document risk decisions, and improve readiness. Every engagement is structured around a written scope, documented findings, prioritized recommendations, and agreed deliverables.
Assessments
Risk Assessment
- Customer Need
- Leaders need a defensible, documented picture of risk to justify security decisions, budgets, and priorities.
- What SPG Does
- SPG conducts a full Threat, Vulnerability, and Risk Assessment (TVRA). For federal facilities, the FSL Determination comes first, followed by threat, vulnerability, and consequence evaluation, the Baseline LOP, and the countermeasures needed to reach the necessary Level of Protection (LOP). Federal facilities follow the ISC Risk Management Process; DoW activities follow DoDI 2000.12 and the DoD Antiterrorism Officer Guide.
- Typical Deliverables
- Signed and locked TVRA report; FSL Determination; Baseline LOP and necessary LOP; prioritized countermeasure recommendations; Corrective Action Plan (CAP).
- Customer Benefit
- A standards-based, prioritized basis for risk decisions and resource requests.
Vulnerability Assessment
- Customer Need
- Organizations need to know how well existing protective measures, procedures, and personnel actually perform.
- What SPG Does
- SPG conducts an on-site evaluation of existing countermeasures, access control, procedures, and site conditions against credible threats, documenting where protection falls short of the required Level of Protection (LOP).
- Typical Deliverables
- Signed and locked Vulnerability Assessment report; prioritized findings; recommended countermeasures; Corrective Action Plan (CAP).
- Customer Benefit
- A clear, ranked list of what to fix first.
Criticality Assessment
- Customer Need
- Not every asset carries the same consequence. Protection resources should go where loss would hurt the mission most.
- What SPG Does
- SPG identifies and ranks people, functions, facilities, systems, and information by mission importance and consequence of loss, so protection priorities match what matters most.
- Typical Deliverables
- Critical asset list; criticality ranking; consequence summary; recommendations that feed the Risk Assessment.
- Customer Benefit
- Protection priorities tied directly to mission impact.
All-Hazards Threat Assessment
- Customer Need
- Planning must account for the threats a specific location actually faces: natural, technological, and human-caused.
- What SPG Does
- SPG evaluates natural, technological, criminal, and intentional threats relevant to the facility, its location, and its operations, using publicly available open-source reporting and authorized sources.
- Typical Deliverables
- Signed and locked All-Hazards Threat Assessment; threat ratings; planning considerations for plans, exercises, and countermeasures.
- Customer Benefit
- A current, location-specific threat picture for planning and preparedness.
Antiterrorism Program Review
- Customer Need
- Antiterrorism programs must show that required program elements are in place, current, and working.
- What SPG Does
- SPG reviews the antiterrorism program against DoDI 2000.12 and the DoD Mission Assurance Assessment (MAA) Benchmarks, covering program management, plans, training, exercises, and vulnerability management.
- Typical Deliverables
- Signed and locked Antiterrorism Program Review report; program findings; Corrective Action Plan (CAP); program improvement roadmap.
- Customer Benefit
- Documented program readiness and a clear corrective path before a higher-headquarters assessment.
ISC Compliance
- Customer Need
- Federal facilities must meet Interagency Security Committee (ISC) standards and keep records to prove it.
- What SPG Does
- SPG reviews ISC Risk Management Process compliance: FSL Determination, Baseline LOP, countermeasure implementation, risk acceptance documentation, and Facility Security Committee (FSC) records.
- Typical Deliverables
- ISC Compliance review report; compliance checklist; Corrective Action Plan (CAP); documentation support.
- Customer Benefit
- A defensible compliance record and a clear list of remaining actions.
Special Event and Residential Assessments
- Customer Need
- Events, VIP visits, and residences carry short-term or personal risk that a facility assessment does not cover.
- What SPG Does
- SPG assesses special events, temporary venues, and residences for threats, vulnerabilities, and protective measures matched to the event or household.
- Typical Deliverables
- Special Event Assessment or Residential Vulnerability Assessment; protective measures recommendations.
- Customer Benefit
- Practical protection planned before the event or exposure.
Risk Decisions and Governance
Risk Acceptance
- Customer Need
- When a countermeasure cannot be fully implemented, the decision to accept, mitigate, or transfer that risk must be documented and approved.
- What SPG Does
- SPG prepares risk acceptance documentation that records the decision, the rationale, interim measures, and the approving official, and tracks each item to a final disposition: Accepted, Mitigated, or Transferred.
- Typical Deliverables
- Risk Acceptance Justification Form (RAJF) package; disposition tracking; updates to the Corrective Action Plan (CAP).
- Customer Benefit
- Accountable, auditable risk decisions.
Facility Security Committee Consulting Services
- Customer Need
- Facility Security Committees (FSC) need sound structure and records to make and document security decisions.
- What SPG Does
- SPG helps establish or strengthen the FSC: Organizational Structure, Charters, Meeting Minutes, and ISC procedures.
- Typical Deliverables
- FSC Organizational Structure; FSC Charter; Meeting Minutes templates and records; ISC procedures.
- Customer Benefit
- A functioning FSC with defensible decision records.
Plans, Exercises and Preparedness
Physical Security Planning
- Customer Need
- Facility leaders need to understand which protective measures warrant attention and in what order.
- What SPG Does
- SPG reviews facility protection, access control, security procedures, and operating conditions, then develops a phased improvement plan.
- Typical Deliverables
- Physical Security Plan; protective measures recommendations; phased security improvement roadmap.
- Customer Benefit
- A documented basis for security planning and resource decisions.
Emergency Preparedness, Plans and Exercises
- Customer Need
- Plans only work if people know them and they have been tested.
- What SPG Does
- SPG develops or reviews emergency plans, including the Occupant Emergency Plan (OEP), Active Shooter Plan, and Antiterrorism Plan, and designs and conducts Tabletop Exercises (TTX).
- Typical Deliverables
- Occupant Emergency Plan; Active Shooter Plan; Antiterrorism Plan; exercise materials; After Action Report (AAR); improvement plan.
- Customer Benefit
- Tested plans and a structured improvement path.
Management Consulting
Administrative Management and Process Improvement
- Customer Need
- Unclear workflows and procedures create inconsistency and unnecessary risk.
- What SPG Does
- SPG evaluates administrative workflows, internal procedures, controls, and management practices.
- Typical Deliverables
- Workflow assessment; standard operating procedures; control recommendations; process improvement plan.
- Customer Benefit
- Documented workflows and more consistent management practices.
Strategic and Operational Planning
- Customer Need
- Leaders need a realistic path from objectives to implementation.
- What SPG Does
- SPG supports strategic objectives, resource priorities, implementation sequencing, and performance measures.
- Typical Deliverables
- Strategic plan; operational roadmap; implementation schedule; performance measures.
- Customer Benefit
- A structured plan to guide organizational action.
Layered Protection
Every SPG engagement is managed in Layered Protection, SPG's proprietary assessment management platform. It keeps your assessment on one controlled, standards-based workflow, so nothing is lost between the site visit and resolution.
- One controlled workflow from Requested Assessment and in-brief through the out-brief, signed products, and Corrective Action Plan (CAP) tracking.
- Standards-based: federal facilities follow the ISC Risk Management Process; DoW activities follow DoDI 2000.12 and the DoD Antiterrorism Officer Guide.
- Field-ready: assessors can record observations on site, even without connectivity.
- Signed and locked: final products carry required signatures and are released as locked PDF files.
- Controlled release: the Authorized Official notifies your organization by email when products are released. Products are for your organization and its higher headquarters only.
- Read-only client access: you view your released products and CAP status. SPG internal tools and data are never exposed.
- Corrective actions are tracked until resolved, so findings do not stall after the site visit.
Typical Consulting Deliverables
Deliverables are selected according to your objectives and the agreed scope of work. Each engagement identifies the work product, review process, completion criteria, and delivery format before work begins.
| Service | Typical deliverable | How you use it |
|---|---|---|
| Risk Assessment | Signed TVRA report, FSL Determination, Baseline LOP, CAP | Decide which risks to address first and support budget requests |
| Vulnerability Assessment | Prioritized findings and countermeasure recommendations | Fix the most important gaps first |
| Criticality Assessment | Critical asset list and ranking | Focus protection on mission-critical assets |
| All-Hazards Threat Assessment | Threat ratings and planning considerations | Base plans and exercises on current threats |
| Antiterrorism Program Review | Program findings, CAP, improvement roadmap | Prepare for higher-headquarters assessment |
| ISC Compliance | Compliance review, checklist, CAP | Show and maintain ISC compliance |
| Risk Acceptance | RAJF package and disposition tracking | Document accountable risk decisions |
| FSC Consulting Services | Organizational Structure, Charter, Meeting Minutes, ISC procedures | Run a functioning, documented FSC |
| Plans and Exercises | OEP, Active Shooter Plan, AT Plan, TTX, AAR | Test and improve readiness |
| Management Consulting | SOPs, workflow recommendations, strategic roadmap | Standardize processes and track execution |
How an Engagement Works
- Request and Pre-AssessmentYou submit a Requested Assessment. SPG confirms scope, schedule, and fee in writing, requests documents, and helps you prepare, including for HHQ or CHQ assessments.
- In-BriefBefore the assessment begins, SPG meets with your leadership to confirm scope, points of contact, and logistics.
- AssessmentSPG conducts the site visit, interviews, and evaluation according to the agreed scope and applicable standard.
- Out-BriefAt the end of the assessment, SPG briefs leadership on preliminary observations and next steps.
- Signed ProductsFinal products are signed by the required officials and released as locked PDF files to your organization.
- Post-Assessment ActionsSPG tracks the Corrective Action Plan (CAP) and prepares Risk Acceptance, Mitigation, and Transfer of Risk documentation until each item is resolved.
- Close-Out and AARSPG closes the engagement and completes an After Action Report (AAR) to improve the next one.
Service Scope NoticeDescriptions of services and typical deliverables are illustrative and do not constitute a binding offer or guarantee of results. Specific activities, qualifications, schedules, and deliverables are governed by an executed agreement and applicable legal, licensing, and regulatory requirements. SPG does not represent that every listed service is presently staffed or available for immediate performance.
Discuss a Consulting Requirement
Tell us about your organization, objectives, and the assistance you are seeking. We will review the requirement for service alignment and appropriate next steps.