Security Risk Assessment (SRA) for an Oil and Gas Facility: The API 780 Method, Step by Step
Key takeaways
- A security risk assessment answers: what are we protecting, from whom, how vulnerable are we, and what are the consequences?
- The API 780 method has five stages: characterization, threat assessment, vulnerability analysis, risk evaluation and countermeasures.
- Risks are ranked with a likelihood × consequence matrix, and the highest are treated first.
- Detection must come early: the delay remaining after detection must exceed the response team's arrival time.
- Countermeasures include barriers, detection, procedures, training and safe design, and the assessment is repeated after every significant change.
Educational content only: procedures and operating values vary between companies and sites. Always follow your company’s approved procedures, your supervisor’s instructions and the permits in force at your site.
Why assess security risk?
Not everything can be protected equally. Resources are limited: guards, cameras, fences and time. A security risk assessment helps the engineer and the security manager put those resources in the right place. The common method in the petroleum and petrochemical industry is API Standard 780. Its idea is that security risk has three parts:
Risk = f(Threat, Vulnerability, Consequence)
That is, the threat (who might want to cause harm, and with what capability), the vulnerability (how easily they could succeed) and the consequence (what happens if they do).
The five stages
- Characterization: what are we protecting? People first, then the plant, control room, substation, fuel tanks, hazardous material stores, data and control systems. For each asset: how important is it, and what happens if it is lost?
- Threat assessment: who might target the facility? Equipment and fuel thieves, a disgruntled insider, vandals, or cyber threats. The assessment relies on information from the authorities and the history of incidents in the area.
- Vulnerability analysis: imagine each threat's path to the asset and ask: where will it be detected, how long will it be delayed, and can the team arrive in time?
- Risk evaluation: rank the scenarios with a matrix and compare them with the company's acceptance criteria.
- Countermeasures: propose what reduces the risk, then recalculate the risk with them in place.
Ranking risks with a matrix
As with an HSE risk matrix, each scenario gets a likelihood score from 1 to 5 and a consequence score from 1 to 5:
Risk score = Likelihood × Consequence
- Theft of copper cable from remote wells: likelihood 4 × consequence 2 = 8.
- Unauthorized entry to the substation: likelihood 2 × consequence 4 = 8.
- Tampering with the control system through a USB stick: likelihood 2 × consequence 5 = 10.
The highest is treated first. But note that equal scores do not mean equal treatment: a scenario with catastrophic consequences needs extra protection even when its likelihood is low.
The "detect early" principle
A barrier alone is not enough, because any barrier can be defeated with time and tools. What we want is for the system to detect an attempt early, leaving enough delay after detection for the team to arrive. The rule:
Remaining delay after detection ≥ Response time
The response team needs 8 minutes to arrive after an alarm. On a hypothetical path to the control room, the layers add these delays: outer fence 1 minute, crossing open ground 3 minutes, inner fence 2 minutes, reinforced control room door 4 minutes.
Case 1: detection at the outer fence (fence sensor):
Remaining delay = 3 + 2 + 4 = 9 min ≥ 8 min
The team arrives before the asset is reached. The design is acceptable.
Case 2: first detection only at the inner fence (a camera there):
Remaining delay = 4 min < 8 min
The team arrives too late. Solutions: earlier detection at the outer fence, a stronger door that adds delay, or a closer team position to cut response time.
The lesson: an extra camera in the wrong place improves nothing. Where you detect matters more than how many devices you have.
Types of countermeasures
- Physical: fences, vehicle barriers, reinforced doors, locks and lighting.
- Electronic: fence sensors, cameras, access badges and alarms.
- Procedural: key control, background checks as allowed by law, visitor management, and permits for entry to critical zones.
- Human: trained guards, training every worker to report, and joint drills with HSE.
- Cyber: separating the control network from the office network, and controlling removable media.
- Inherently safer design: reducing hazardous inventory, placing critical assets away from the perimeter, and redundant power supplies.
When do we reassess?
- When the threat level in the area changes.
- When a new unit is added or the facility changes significantly.
- After any security incident or attempt.
- Periodically, according to company policy.
Takeaway for the engineer
A security risk assessment turns security from guesswork into a reasoned decision: we know what we protect, rank the scenarios, and place detection where it gives the team enough time. The results themselves are sensitive information, kept and shared only with those who need them.
Test your understanding
Related lessons
- Site security: zones, gates and access control
- Desert journey management
- Permit to Work and Job Safety Analysis for a Slickline Job: A Practical HSE Guide for Engineers and Supervisors
Sources
A question about this article? Ask the library