FFY 2024 Federal Nonprofit Security Grant Program (NSGP-S) Security Self Assessment

Security and Safety/Emergency Management

This section refers to the need to designate personnel to create and implement plans and procedures to address security and personnel safety issues and emergencies.

Factors that contribute to the effectiveness of security, safety, and emergency management efforts at non-profits include the designation of a security manager or security committee; volunteer ushers and greeters; existence of security and safety/emergency operations plans; commitment to training and exercises on these plans; engaging with external partners such as first responders and working groups; and mass notification capabilities and crisis communications.

These teams are usually comprised of volunteers and can be composed of any members of the non-profit. Some may have a security or safety background such as law enforcement, fire service, emergency medical response, or emergency management, but any member with the interest and desire can be trained for the various roles available. Some organizations hire permanent personnel to fill specific security or safety roles.

Non-profits may use different names for their plans. They may incorporate security elements into a plan that outlines the facility’s approach to operations before, during, and after an emergency, or they may have two separate plans, one focused on security and another focused on safety/emergency operations.

Security generally refers to those elements that secure a facility from theft, attack, bomb threat, and similar physical harm to the congregation or facility.

Safety and emergency management refers to protection from natural disasters, fires, trips and falls, accidental injuries, and health emergencies such as choking incidents, heart attacks, bee stings, and a wide range of similar events.

Question Title

* 1. Official Organization Name. Please ensure this matches the name on your Investment Justification (IJ).

Question Title

* 2. Name and address of the site (street address, no PO Boxes). Please ensure this matches the information on your Investment Justification (IJ)

Facility / Location Name *

Address *

Address Line 2

City/Town *

State/Province *

ZIP/Postal Code *

Country *

Point of Contact Email Address *

Point of Contact Phone Number *

Question Title

* 3. Has this site previously received funding from the Federal Nonprofit Security Grant Program?

Yes

Question Title

* 4. Does the non-profit have a security manager or security committee to make security management decisions?

The non-profit does not have a security manager or committee.

The non-profit has a security manager or committee, but security management activities are sporadic.

The non-profit has a security manager or committee. Security management activities are regularly scheduled, but not coordinated with other committees, departments, or groups (e.g., special events planning, childcare).

The non-profit has a security manager or committee. Security management activities are regularly scheduled and coordinated with other committees, departments, and groups, but additional personnel are needed to support the facility’s security mission.

The non-profit has a security manager or committee. Security management activities are regularly scheduled and coordinated with other committees, departments, and groups, and staffing levels fully support the facility’s security mission.

Question Title

* 5. Does the non-profit have a written security and safety/emergency operations plan(s)?

The non-profit does not have a written security and/or safety/emergency operations plan(s). All security and safety/emergency response procedures are communicated verbally and may be performed on an ad hoc basis.

The non-profit has some written documentation that partially addresses safety and emergency operations policies, programs, and/or procedures (e.g., a checklist), but a comprehensive plan(s) does not exist.

The non-profit has a written security and safety/emergency operations plan(s). The security plan or portion of the plan addresses some, but not all, of the following areas: identification of threats; security force; access control; monitoring and surveillance; suspicious activity recognition and reporting; financial and cybersecurity; hiring procedures and background checks; daycare, school, and youth security (where applicable); special event and offsite excursion safety and security; and opening, locking, and closing procedures for the facility. The safety/emergency operations plan or portion of the plan addresses some, but not all, of the following areas: threat and hazard analysis; goals and objectives; procedures for medical emergencies, bomb threats, and active shooter incidents; communication, crisis management, and media procedures; evacuation, shelter-in-place, lockout, and lockdown procedures; reunification of children and parents or guardians; and recovery and resumption of operations. The plan(s) addresses maintaining point- of-contact lists, training and exercises, and plan maintenance (e.g., review and revision).

The non-profit has a comprehensive security and safety/emergency operations plan(s) that addresses all of the areas listed previously. However, leadership has not officially approved the plan(s), and the non-profit has not coordinated the plan(s) with first responders (e.g., law enforcement, fire response, and emergency medical services personnel), emergency management officials, and other community partners. If the security and safety/emergency operations plans are combined, facility personnel have explored the option of separating the combined plan into two separate plans.

The non-profit has a comprehensive security and safety/emergency operations plan(s) that addresses all of the areas listed previously. If the security and safety/emergency operations plans are combined, facility personnel are exploring the option of or are in the process of separating the combined plan into two separate plans. Leadership has approved the plan(s) and has coordinated the plan(s) with first responders, emergency management officials, and other community partners.

Question Title

* 6. Are employees and volunteers trained on the security and safety/emergency operations plan(s)?

The non-profit does not have a written security and safety/emergency operations plan(s).

The non-profit does not train employees and volunteers on the security and safety/emergency operations plan(s).

The non-profit provides some information or training to some employees and volunteers, but not to everyone involved with implementing the plan(s). The non-profit may provide training less often than annually.

The non-profit provides at least annual training to everyone involved with implementing the plan(s) but no recurring training throughout a calendar year. Although all parties have completed training on the plan, they may not have easy access to references that will prompt them to execute their responsibilities effectively when an incident occurs (e.g., quick reference guides, badge-sized reference cards).

The non-profit provides annual training to everyone involved with implementing the plan(s), as well as some type of refresher training. Refresher training may be sporadic, for example, only after a threat or incident. The non-profit provides concise and user-friendly reference guides on the plan(s), policies, and procedures.

The non-profit provides comprehensive training to everyone involved with implementing the plan(s) annually, as well as regular refresher training throughout the year (e.g., quarterly). The non-profit provides concise and user-friendly reference guides on the plan(s), policies, and procedures.

Question Title

* 7. The non-profit provides annual training to everyone involved with implementing the plan(s), as well as some type of refresher training.

The non-profit does not have a written security and safety/emergency operations plan(s).

The non-profit does not train congregants on elements of the plan(s) (e.g., evacuation routes, responding to an active- shooter incident).

The non-profit provides some training to congregants at least once a year. Training may be limited to the appropriate emergency response actions for primary locations only (e.g., main gathering area, fellowship hall, classrooms).

The non-profit provides comprehensive training to congregants annually and throughout the year. Congregants are trained on appropriate emergency response actions regardless of their location in the non-profit (e.g., including hallways, bathrooms).

Question Title

* 8. Has the non-profit coordinated the security and safety/emergency operations plan(s) with first responders?

The non-profit does not have a written security and safety/emergency operations plan(s).

The non-profit has not coordinated with first responders regarding emergency preparedness.

The non-profit has provided the security and safety/emergency operations plan(s) to first responders but has not solicited or implemented their input on the plan. The non-profit has not shared critical information about the building or facilities (e.g., floor plans, location of critical assets or areas, and notification and contact lists). Emergency responders have not toured the non-profit in order to familiarize themselves with the layout of the building and grounds.

The non-profit has coordinated the security and safety/emergency operations plan(s) with first responders and has shared critical information about the building and facilities. Although emergency responders have toured the facility, the non-profit has not initiated activities to bring them onsite regularly. The non-profit has coordinated the security and safety/emergency operations plan(s) with first responders and has provided critical information about the building and facilities.

The non-profit has initiated activities to regularly bring emergency responders onsite (e.g., with training activities or traffic control). The non-profit has not created crisis response kits for first responders to use in an emergency. The non-profit has coordinated the security and safety/emergency operations plan(s) with first responders and has shared critical information about the building and facilities.

Emergency responders come onsite regularly (e.g., for training activities or traffic control). The non-profit has created crisis response kits for first responders to use in an emergency. Local law enforcement may not have conducted a security assessment of the facility.

Question Title

* 9. Does the facility exercise the security and safety/emergency operations plan(s)?

The non-profit does not have a written security and safety/emergency operations plan(s).

The non-profit does not exercise the plan(s) on an annual basis.

The non-profit exercises the plan(s) at least once annually. Exercises are tabletop or drills and involve relevant facility personnel. They do not include community partners (e.g., first responders, local emergency management staff).

The non-profit exercises the plan(s) at least once annually. Exercises are tabletop or drills and include community partners (e.g., first responders, local emergency management staff). The facility does not develop an after- action report for each exercise.

The non-profit exercises the plan(s) at least once annually. Exercises are functional and include community partners (e.g., first responders, local emergency management staff). The facility develops an after-action report for each exercise and uses it to improve plans and procedures.

The non-profit exercises the plan(s) at least once annually. Exercises are simultaneous functional exercises and include community partners (e.g., first responders, local emergency management staff). The facility develops an after-action report for each exercise and uses it to improve plans and procedures.

Question Title

* 10. Does the facility have lock-down, lockout, and shelter-in-place procedures?

The facility does not have lock-down, lockout, and shelter-in-place procedures.

The facility has some lock-down, lockout, and shelter-in-place procedures, but procedures may lack sufficient detail. Information concerning lock-down, lockout, and shelter-in-place procedures and locations has not been communicated to congregants.

The facility has comprehensive lock-down, lockout, and shelter-in- place procedures. Lock-down, lockout, and shelter-in-place procedures and locations have been communicated to congregants, and key information is posted throughout the building. However, the facility does not have a regular cycle for reviewing and updating the lock-down, lockout, and shelter-in- place procedures. The facility has not evaluated the need for any “safe rooms” for protection against extreme threats or hazards (e.g., tornado, hurricane, or active shooter). “Safe rooms” are designated spaces where people can retreat to in the event of an immediate threat of danger.

The facility has comprehensive lock-down, lockout, and shelter-in- place procedures. Lock-down, lockout, and shelter-in-place procedures and locations have been communicated to congregants, and key information is posted throughout the building. The facility regularly reviews the lock-down, lockout, and shelter-in- place procedures and implements updates as needed. The facility has “safe rooms” to provide immediate life-safety protection against extreme threats or hazards, or has evaluated the need for these spaces.

Question Title

* 11. Does the non-profit have mass notification capabilities?

The non-profit does not have a way to alert the entire facility of imminent danger. The non-profit does not monitor external sources for important emergency information (e.g., weather alerts, public safety announcements from local first responders, and national public warnings from the Emergency Alert System).

The non-profit monitors external sources for important emergency information and has a public address system for onsite emergency communications but lacks ways to communicate warnings to individuals who need other accommodations such as visual signals. The non-profit does not periodically test the system.

The non-profit monitors external sources for important emergency information and has both audio and visual mass notification systems for onsite emergency communications. They are unique and separate from communications channels used for routine announcements. The non-profit periodically tests the system.

Question Title

* 12. Does the non-profit have crisis communications plans and procedures?

The non-profit does not have any crisis communications plans or procedures.

The non-profit has crisis communications plans and procedures that address emergency contacts, chain of command, and distribution of mass notifications, but they may lack some level of detail. A spokesperson for the congregation may not have been designated or may have been designated without relevant training and/or resources.

The non-profit has comprehensive crisis communications plans and procedures that address emergency contacts, chain of command, distribution of mass notifications, coordination with local government officials (e.g., public information officers), and support for affected congregants who prefer not to engage with the media. A spokesperson for the congregation has been designated and adequately trained.

Question Title

* 13. Does the non-profit receive threat information, security-related bulletins, advisories, or alerts from an external source?

The non-profit does not receive any threat information, security-related bulletins, advisories, or alerts from an external source.

The non-profit monitors open-source intelligence information related to threats against non-profits, but has not joined any trusted communities of peers and partners exchanging issues, ideas, intelligence, and other information across private networks.

The non-profit monitors open-source intelligence information related to threats against non-profits and is part of at least one vetted, private information-sharing network such as the Faith-Based Information Sharing & Analysis Organization (FB-ISAO). In addition, the non-profit has contacted the local police department regarding access to crime report information, and receives such information if it is available. However, the non-profit does not network locally to gain intelligence information.

Question Title

* 14. Does the non- profit participate in any external security or emergency preparedness working groups?

The non-profit does not participate in any external security or emergency preparedness working groups.

Facility personnel are connected with a federal, state, local, or private sector security or emergency preparedness working group. They may not regularly attend meetings, but they receive information.

Facility personnel are connected with a security or emergency preparedness working group. They regularly attend meetings and receive information.

Facility personnel are connected with a security or emergency preparedness working group. They regularly attend meetings and receive information. They may participate in special events or activities that the working group sponsors. They may have leadership positions in the group.

Facility personnel are connected with two or more security and/or emergency preparedness working groups. They regularly attend meetings and receive information. They may participate in special events or activities that a working group sponsors. They may have leadership positions in a group.

Question Title

* 15. Does the non- profit conduct background checks on employees and volunteers?

The non-profit does not conduct any background checks on employees or volunteers.

The non-profit procures background checks on select individuals only.

The non-profit procures background checks on all employees and volunteers. However, the type of background checks conducted may provide minimal information, creating a false sense of security.

The non-profit procures thorough background checks on all employees and volunteers. Unique detailed checks are conducted according to an individual’s position (e.g., credit checks for anyone handling money). However, background checks are conducted only initially (e.g., upon hire or when volunteer services began) and not on a recurring basis.

The non-profit procures thorough background checks on all employees and volunteers. Background checks are conducted initially and on a recurring basis.

Question Title

* 16. Does the facility provide security information to employees, volunteers, and congregants?

The non-profit does not provide security information to employees, volunteers, and congregants.

The non-profit provides information about specific security incidents to employees and volunteers. The facility does not provide security awareness information.

The non-profit provides information about specific security incidents as well as security awareness information to employees and volunteers. However, security awareness information is limited in scope and availability (e.g., provided occasionally).

The non-profit provides information about specific security incidents as well as security awareness information to employees and volunteers on a recurring basis. Security awareness information is detailed and comprehensive, but distribution is limited (e.g., emails only). The non-profit also encourages congregants to take personal responsibility for strengthening the community’s security culture, for example, with messages in printed materials already regularly distributed.

The non-profit provides information about specific security incidents as well as security awareness information to employees and volunteers on a recurring basis. Congregants also receive security awareness information. Security awareness information is detailed, comprehensive, and communicated through a variety of formats (e.g., emails, posters, announcements, regular meetings).

Question Title

* 17. Does the facility have procedures for bomb threats and suspicious items?

The facility does not have procedures for bomb threats or suspicious items.

The facility has some written documentation that addresses bomb threats and suspicious items, but detailed, comprehensive procedures do not exist. Mail and shipping procedures ensure all mail and packages are delivered to a single location. External entities cannot deliver mail or packages directly to an individual.

The facility has bomb threat and suspicious item procedures, but some information may be lacking. The facility may not communicate these procedures to employees and volunteers. Congregants are aware that if they encounter a suspicious item, they should leave it alone and notify someone in authority.

The facility has a detailed bomb threat plan and comprehensive suspicious item procedures that define characteristics and outline appropriate response actions. The facility communicates these procedures to employees and volunteers but does not provide them any training. Congregants are aware that if they encounter a suspicious item, they should leave it alone and notify someone in authority.

Detailed guidelines provide the appropriate actions for responding to a bomb threat, and comprehensive procedures define common characteristics of suspicious items and outline appropriate response actions. The facility communicates these plans and procedures to employees and volunteers, and it provides them related training as appropriate. Congregants are aware that if they encounter a suspicious item, they should leave it alone and notify someone in authority.

Question Title

* 18. Does the non-profit have cash management controls?

The non-profit does not have established cash management controls. Any cash-handling policies and procedures are communicated verbally and may be performed on an ad hoc basis. If cash is stored onsite, it is not adequately secured in a safe. A lockable cash drawer may be in use.

Cash storage is adequately secured with a safe, or money is deposited immediately after collection. The non- profit has established cash-handling policies and procedures and financial safety protocols. However, dual custody or dual controls are not required for all cash-handling procures. Financial records may lack detail or be incomplete.

Cash storage is adequately secured or money is deposited immediately. The non- profit has established cash-handling policies and procedures and financial safety protocols. A two-party system is in place to ensure that no one person has sole access to contributions and other collections. Financial records are detailed and accurate. However, not all individuals with cash access have undergone a background check that includes a credit check.

Cash storage is highly secured or money is deposited immediately. The non-profit has established cash- handling policies and procedures and financial safety protocols. Financial records are detailed and accurate. Individuals with cash access have undergone a thorough background check that includes a credit check.