Skip to content
SECURITY & SAFETY HUB
Sign in

Resource library

Templates download as CSV files that open in Excel, Google Sheets or LibreOffice.

Worksheets & templates

Security risk registerAsset, threat, vulnerability, L × I, controls, owner, residual risk.Download CSVHIRA worksheetActivity to verification, with hierarchy of controls.Download CSVJSA / JHA templateJob step, hazard, consequence, control, responsible, verification.Download CSVCCTV planning worksheetPurpose, area, lighting, detail level, privacy, recording, maintenance.Download CSVSecurity audit checklistRequirement, evidence, result, owner, closure evidence.Download CSVIncident reportVerified facts kept separate from assumptions.Download CSVCorrective action trackerFinding, cause, action, priority, status, effectiveness check.Download CSVDrill / after-action reviewObjectives, timeline, strengths, gaps, actions.Download CSV

Glossary

Access review
A scheduled check that each person's access still matches their role.
From: Access Control and Visitor Management
After-action review (AAR)
A structured review of what was planned, what happened, why, and what to change.
From: Tabletop Exercises, Drills and After-Action Reviews
Anti-passback
A rule preventing a card being used to enter twice without exiting.
From: Access Control and Visitor Management
Assembly point
A safe, pre-agreed location where people gather after evacuating.
From: Fire Warden Awareness
Asset
Anything of value to protect: people, information, property, reputation, operations.
From: Security Risk Assessment Fundamentals
Behavioural indicator
An action out of place for the context, e.g. photographing access points and avoiding staff.
From: Suspicious Activity: Objective Observation and Reporting
Consent
Free, specific, informed, unconditional and unambiguous agreement, given with a clear affirmative action.
From: DPDP Act, 2023 — Awareness for Workplaces
Crowd density
People per square metre; high densities raise crush risk.
From: Event and Public-Facing Venue Security Awareness
Data Fiduciary
The person or organisation that decides the purpose and means of processing.
From: DPDP Act, 2023 — Awareness for Workplaces
Data Principal
The individual to whom personal data relates.
From: DPDP Act, 2023 — Awareness for Workplaces
Data Processor
Processes data on behalf of a Data Fiduciary, e.g. a vendor.
From: DPDP Act, 2023 — Awareness for Workplaces
Event control
A single point that coordinates staff, security, medical and emergency services.
From: Event and Public-Facing Venue Security Awareness
Hallucination
Confident but false output from an AI model.
From: AI Literacy and Responsible Generative AI at Work
Hazard
Something with the potential to cause harm (e.g. energised cable, moving forklift).
From: HIRA: Hazard Identification and Risk Assessment
Hazardous energy
Electrical, mechanical, hydraulic, pneumatic, chemical, thermal or stored energy.
From: Permit-to-Work and Lockout/Tagout (LOTO)
Hierarchy of controls
Elimination → Substitution → Engineering → Administrative → PPE.
From: HIRA: Hazard Identification and Risk Assessment
Hostile reconnaissance
Information gathering that may precede an attack; report it, do not investigate yourself.
From: Suspicious Activity: Objective Observation and Reporting
Human in the loop
A person reviews and is accountable for the final output.
From: AI Literacy and Responsible Generative AI at Work
Impact
The severity of consequences if it does occur.
From: Security Risk Assessment Fundamentals
Inject
A new piece of scenario information given during the exercise.
From: Tabletop Exercises, Drills and After-Action Reviews
Internal audit
An organisation's own check that the ISMS works as intended.
From: Information Security and ISO/IEC 27001 Awareness
Invacuation
Moving people to a safer place inside a building when outside is dangerous.
From: Event and Public-Facing Venue Security Awareness
ISMS
Information Security Management System — policies, processes and controls managing information risk.
From: Information Security and ISO/IEC 27001 Awareness
Isolation
Separating equipment from all energy sources.
From: Permit-to-Work and Lockout/Tagout (LOTO)
Job step
One action in the sequence, described as a verb: 'Isolate pump', 'Remove cover'.
From: JSA / JHA: Job Safety Analysis
Lagging indicator
Measures outcomes, e.g. injuries, thefts.
From: Excel Dashboards for Security & Safety Reporting
Leading indicator
Measures activity that prevents incidents, e.g. inspections completed.
From: Excel Dashboards for Security & Safety Reporting
Least privilege
Give only the access needed for the role, for the time needed.
From: Access Control and Visitor Management
Likelihood
How probable it is that the risk event occurs in the review period.
From: Security Risk Assessment Fundamentals
MFA
Multi-factor authentication — a second proof beyond your password.
From: Cybersecurity Awareness: Phishing, Passwords and MFA
Objective description
What you saw and heard, without interpretation.
From: Suspicious Activity: Objective Observation and Reporting
Operational requirement
A written statement of what each camera must achieve and why.
From: CCTV Planning, Operation and Privacy
Password manager
Software that creates and stores unique strong passwords.
From: Cybersecurity Awareness: Phishing, Passwords and MFA
PEEP
Personal Emergency Evacuation Plan for people who need assistance.
From: Fire Warden Awareness
Permit-to-work (PTW)
A formal written system authorising specific high-risk work under defined controls.
From: Permit-to-Work and Lockout/Tagout (LOTO)
Personal lock
A lock applied by each worker; only they hold the key.
From: Permit-to-Work and Lockout/Tagout (LOTO)
Phishing
A message pretending to be trusted to trick you into clicking, paying or sharing.
From: Cybersecurity Awareness: Phishing, Passwords and MFA
Pivot table
A tool that summarises rows by categories and totals.
From: Excel Dashboards for Security & Safety Reporting
Pixel density
Pixels per metre at the target; higher density gives more detail.
From: CCTV Planning, Operation and Privacy
Pre-job briefing
A short meeting where the crew reviews the JSA before starting.
From: JSA / JHA: Job Safety Analysis
Privacy masking
Blocking parts of a scene (e.g. neighbouring windows) from view and recording.
From: CCTV Planning, Operation and Privacy
Prompt
The instruction you give the AI.
From: AI Literacy and Responsible Generative AI at Work
Purpose limitation
Use data only for the purpose stated to the individual.
From: DPDP Act, 2023 — Awareness for Workplaces
Residual risk
The risk remaining after additional controls are in place.
From: Security Risk Assessment Fundamentals
Retention period
How long recordings are kept before automatic deletion.
From: CCTV Planning, Operation and Privacy
Risk
The combination of likelihood of harm and its severity.
From: HIRA: Hazard Identification and Risk Assessment
Severity
How serious the harm could be, from first aid to fatality.
From: HIRA: Hazard Identification and Risk Assessment
Statement of Applicability (SoA)
A document listing which controls apply and why.
From: Information Security and ISO/IEC 27001 Awareness
Stop-work authority
Anyone's right and duty to stop work if conditions are unsafe.
From: JSA / JHA: Job Safety Analysis
Sweep
A quick check of an assigned area to prompt people to leave — without delaying your own exit.
From: Fire Warden Awareness
Tabletop exercise
A discussion-based walk through a scenario, without deploying resources.
From: Tabletop Exercises, Drills and After-Action Reviews
Tailgating
Following an authorised person through a controlled door without presenting a credential.
From: Access Control and Visitor Management
Threat
A source of potential harm, e.g. theft, intrusion, sabotage, workplace violence.
From: Security Risk Assessment Fundamentals
Verification
Checking that a control is in place and working, not just written down.
From: HIRA: Hazard Identification and Risk Assessment
VMS / NVR
Video Management Software and Network Video Recorder — software and hardware that record and manage cameras.
From: CCTV Planning, Operation and Privacy
Vulnerability
A weakness a threat could exploit, e.g. an unlit fence line or shared access cards.
From: Security Risk Assessment Fundamentals

Reference links