The Importance of Managing Mission Critical Assets and Keys

[Definition] What is critical facility management? 

Critical facilities are worksites essential to business operations. They can be entire buildings or areas within buildings, such as data centers, medical centers, manufacturing plants, and trading floors—such as a stock exchange. 

Critical facility management systems support the effective and efficient operation of these facilities. They include electrical infrastructure, BMS and critical asset monitoring systems, UPS equipment, fire detection and suppression systems, access control, and other physical security and management controls.

Importance of risk management in critical facility management 

Properly managing risk requires well-trained professionals backed by comprehensive policies and smart technology. Critical facility and asset protection is no longer a practice one can carry out independently. The consequences of human error are too severe. 

Consider faults from manual access control—specifically, the example of rekeying an entire critical facility due to key loss. Although fees per lock may decrease for larger facilities, it could still amount to around $40 per lock, even at the lowest end. Consequently, rekeying 100 locks could result in expenses of up to $4,000, posing a considerable concern if a sub-master key goes missing unexpectedly. 

The consequences become even more severe if a master or grandmaster key is lost, potentially jeopardizing your physical plant budget. An unfortunate example of this occurred in the State of Hawaii when government security officials realized they had no record of how many master keys were in circulation. For security purposes, they undertook the costly measure of rekeying the entire State Capitol, incurring over $250,000 in unnecessary expenses. 

How can I identify our mission-critical assets? 

Since every organization and its mission are unique, every organization should also have its method of categorizing mission critical assets. Obviously, there may be some commonalities across organizations, but each organization needs to establish clear parameters for identifying its mission critical assets.  

To determine which requires a special category of management and protection, you should consider the value of each asset, the impact its unavailability would have on your organization, and the specific risks you face having that asset in your facility. 

Value 

The equipment, infrastructure, or data—the assets—that an organization chooses to store will possess some inherent value. This value may change or diminish over time, so organizations need to assess the significance of those assets and their impact on their processes. 

Impact  

Consider the consequences if specific assets were to be compromised or stolen by attackers. Suppose the impact of such an event extends beyond the organization's borders and affects the safety and security of multiple customers, for instance. In that case, you should define that asset as mission critical based solely on the impact of its unavailability. 

Risks  

Evaluating an asset’s importance also involves anticipating potential threats and risks that could arise due to those assets being in your possession. For example, the potential risk of vehicle theft from owning and managing fleet vehicles in a city center.  

You need to ask questions, such as, are certain types of assets that might interest bad actors? How easily accessible are they? By addressing such questions, organizations can gauge the level of risk certain assets bear and then prioritize their protection accordingly.

See 10 Physical Security Risk Mitigation Strategies That Actually Work

Examples of mission critical assets  

Let’s consider several different types of mission critical assets in context. 

How can you manage access control for mission critical assets effectively? 

Access control is one of the most important management activities for mission critical assets. Typically you either want to control direct access to assets that you can store—like a HoloLens headset—or control access credentials to the ones you can’t—like a hydroelectric power generating facility. In the first case, you would want to use resilient asset management. In the latter, you would want to deploy smart key management. 

The role of smart asset management systems in securing mission critical assets  

Asset management involves overseeing and directing the use of an asset throughout its entire lifecycle within an organization. The primary objective of asset management is to optimize the item's value over its lifespan while also addressing any potential risks associated with its ownership and usage. 

Smart asset management systems use sensor networks embedded within the system to monitor stored critical assets, understand their condition, and modify access to them as needed. All those processes can be automatically by the smart system itself or adjusted according to operator prompts. 

The role of smart key control systems in securing mission critical assets 

Key control involves securing locations and assets using physical keys and managing access to those keys. Business key control programs typically include policies and tools to regulate key distribution, track keys in use, and prevent unauthorized duplication. 

The primary objective of a comprehensive key control program, regardless of its specific details, is to safeguard mission critical locations, assets, and individuals efficiently. As with smart asset management systems, smart key systems self-monitor and adjust key control practices automatically based on operator criteria.

Are there standards for handling mission critical assets? 

Yes, but they vary widely by industry and jurisdiction. Researching what might apply in your state or province is highly recommended. However, Several major standards exist that every organization should be aware of. 

ISO 55000 

If your organization adheres to ISO 55000 asset management standards, implementing an automated smart system can aid in ensuring compliance for the storage of mission critical assets. By utilizing electronic management tools, you can automate record-keeping, leading to reduced errors. Additionally, the system allows you to gather valuable data, which can be used to improve your overall asset management program continuously. 

FEMA critical facility standards 

If your organization has US-based facilities, you should know the formal definition of a critical facility established by the Federal Emergency Management Agency (FEMA) regarding flooding emergency management. “Typical critical facilities include hospitals, fire stations, police stations, storage of critical records, and similar facilities. These facilities should receive special consideration when formulating regulatory alternatives and floodplain management plans. A critical facility should not be in a floodplain if possible. If a critical facility must be located in a floodplain, it should be provided a higher level of protection to continue functioning and provide services after the flood.”