ASIS Enterprise Security Risk Management Implementation Training Course

Course overview

Security teams are increasingly expected to show how physical security, protective services, investigations, travel security and resilience activity protect business objectives rather than simply reduce incidents. ASIS Enterprise Security Risk Management (ESRM) provides a disciplined way to do this: identify the assets that matter, engage the people accountable for them, assess threats and vulnerabilities, and agree proportionate treatments. This course helps practitioners move from site-led or technology-led security decisions to documented, stakeholder-owned risk decisions that can be defended to senior management.

Participants work through the ASIS ESRM approach from organisational context and asset identification to risk assessment, treatment selection, implementation and review. They practise stakeholder mapping, defining risk criteria and appetite, applying likelihood-and-impact scoring, documenting security risks in a register, comparing treatment options, and translating controls into accountable action plans. The course also addresses the practical interface between security, health and safety, business continuity, legal, HR, facilities and operational leadership.

Delivery combines instructor-led explanation with worked examples, facilitated risk workshops and a running organisational case study. Participants use an ESRM implementation workbook to build an asset profile, stakeholder engagement plan, risk assessment, treatment plan, governance model and performance measures. They leave with a completed ESRM implementation pack that can be adapted for their own business unit, site, programme or security transformation initiative, alongside a certificate of completion.

The course suits security professionals and operational leaders who need to establish, refresh or scale an enterprise security risk management programme. It is particularly valuable where security must secure investment, clarify risk ownership, integrate with enterprise risk processes, or demonstrate measurable contribution to organisational objectives.

Course objectives

By the end of this course, participants will be able to:

• Apply the ASIS ESRM cycle to a defined organisational security risk scenario
• Map asset owners, stakeholders and decision rights using an ESRM stakeholder map
• Define security risk criteria, appetite statements and escalation thresholds
• Conduct an asset-based threat, vulnerability and consequence assessment
• Build a scored security risk register with inherent and residual risk ratings
• Evaluate risk treatment options using cost, feasibility, effectiveness and ownership criteria
• Produce an ESRM implementation roadmap with actions, accountabilities and review dates
• Design security performance measures and reporting dashboards linked to business objectives

Benefits of attending

Target competencies

Who should attend

• Security Managers — who need to align security programmes with asset-owner priorities and enterprise risk decisions
• Corporate Security Directors — who must establish consistent risk governance across sites, regions or business units
• Security Risk Managers — who need a repeatable method for assessing and treating security risks
• Business Continuity and Resilience Managers — who coordinate protective measures across operational disruption risks
• Health, Safety and Environment Managers — who need to integrate security risk ownership with wider operational risk controls
• Facilities and Operations Managers — who own critical assets and require defensible, proportionate security investments

Requirements and prerequisites

Participants should have a working awareness of their organisation’s security operations, assets, sites or services, and be able to describe common security threats such as theft, unauthorised access, violence, fraud or disruption. Familiarity with basic risk terms—likelihood, consequence, controls and residual risk—is useful but not essential. Participants should be comfortable reviewing simple spreadsheets and organisational documents. No prior ASIS qualification, formal risk-management certification, specialist security technology expertise or advanced Microsoft Excel capability is required. Complete beginners can attend, but should expect to spend time learning the language of enterprise risk and security governance before applying it.

Training methodology

The five days alternate short instructor-led inputs with structured application of the ASIS ESRM method to a running corporate case. Participants analyse asset-owner objectives, facilitate stakeholder conversations, score risks, compare control options and create governance documentation in small groups. The instructor critiques assumptions, evidence quality and treatment choices rather than treating a risk matrix as a purely numerical exercise. Case discussions include security’s interfaces with HSE, facilities, HR and continuity. On the final day, each participant converts the case approach into a practical implementation plan for their own organisation.

Course outline

Day 1: ESRM foundations and organisational context

• ASIS Enterprise Security Risk Management principles and lifecycle
• Security as an enabler of organisational objectives
• Asset-based versus threat-led security planning
• Organisational context and operating-environment analysis
• Security risk governance, accountability and decision rights
• Stakeholder identification and asset-owner engagement
• Alignment with ISO 31000 risk-management principles

Workshop: Participants create an ESRM context statement and stakeholder map for a case-study organisation, identifying critical assets and accountable owners.

Day 2: Asset identification and security risk assessment

• Asset categories: people, information, physical assets, operations and reputation
• Asset value, criticality and dependency analysis
• Threat identification using internal and external intelligence sources
• Vulnerability analysis across people, process, technology and premises
• Likelihood, consequence and uncertainty definitions
• Inherent risk scoring and risk-matrix calibration
• Security risk register structure and evidence requirements

Workshop: Participants conduct an asset-based assessment and produce an inherent-risk register for three priority business assets.

Day 3: Risk evaluation and treatment selection

• Risk appetite, tolerance and escalation thresholds
• Control identification and control-effectiveness testing
• Residual-risk assessment and management acceptance
• Risk avoidance, reduction, transfer and acceptance options
• Layered security controls and defence-in-depth design
• Cost, benefit, feasibility and unintended-consequence analysis
• Treatment-plan ownership, milestones and resource requirements

Workshop: Teams evaluate competing treatment options for a high-risk scenario and produce a prioritised security risk treatment plan.

Day 4: Implementing ESRM across the enterprise

• ESRM operating model and programme implementation stages
• Integrating ESRM with HSE, enterprise risk and business continuity processes
• Security policy, standards and procedure hierarchy
• Security risk workshop design and facilitation techniques
• Roles of asset owners, security advisers and executive sponsors
• Change management for risk-based security practices
• Data quality, documentation control and audit trails

Workshop: Participants design an ESRM implementation roadmap, including governance forums, stakeholder communications and a 90-day action sequence.

Day 5: Monitoring, reporting and applied implementation planning

• Key risk indicators and key performance indicators for security
• Control assurance, testing schedules and exception management
• Risk review triggers and reassessment cycles
• Executive security risk reporting and decision papers
• Dashboard design for residual risk and treatment progress
• Lessons learned from incidents and near misses
• Personal ESRM implementation planning and maturity assessment

Workshop: Participants complete and present an ESRM implementation pack containing a risk register, treatment roadmap, governance model and executive reporting outline.

Tools & standards covered

ASIS Enterprise Security Risk Management Guideline, ISO 31000:2018 Risk management — Guidelines, ISO 31010:2019 Risk management — Risk assessment techniques, Microsoft Excel

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions