Security Strategy

As a global player on the stage of the production and sale of natural and organic products, SunOpta has a duty to its customers and employees to adequately secure their Modesto, CA facility. Through a risk and threat assessment the company is able to identify internal assets and exactly what measures are currently in place for protection. The identified vulnerabilities in the system will allow the company to plan for the future and build a relevant security network meant to protect its viability. With a sound assessment in hand the company will be able to “bring well-being to life”

ORGANIZATIONAL OVERVIEW

As a producer of dairy milk alternative beverages, SunOpta began exploring communities on the west coast of America from which to house an expansion of aseptic capabilities. The plant chosen after consideration of many options is housed in a big industrial park near the city's municipal airport. The facility itself consists of "an existing building on the Tri-Valley Growers' Plant 1 site at 555 Mariposa Road, which used to be a fruit canning plant before it closed in 2006. In August 2008, SunOpta invested $25m to outfit the new 180,000ft² plant and signed a long-term lease for the building. (New Modesto Facility, 2009) The company has expanded within that footprint since coming online and no conducts twenty-four-hour operations with personnel at the facility on a round the clock basis. The survey completed on March 30, 2016, took into account all current equipment, personnel, capabilities and security measures in use at the time. The survey was completed in its entirety by Matthew Wayne Reynolds, (253) 310-3104, 555 Mariposa Rd Modesto, CA 95354, [email protected].

"SunOpta Inc. is a leading global company focused on organic, non-genetically modified ("non-GMO") and specialty foods. SunOpta specializes in the sourcing, processing and packaging of organic and non-GMO food products, integrated from seed through packaged products; with a focus on strategic vertically integrated business models With about 1,700 global employees, SunOpta's organic and non-GMO food operations revolve around value-added grain, seed, fruit and vegetable based product offerings, supported by a global sourcing and supply infrastructure " (About Us, 2015)

Mission

"At SunOpta, we empower our employees to enrich lives by developing healthy and organic food products, driving sustainable well-being." (About Us, 2015)

Vision

"To be a sustainable organization that is a global leader in natural and organic food products are driven by a spirit of continuous improvement, innovation and category expertise that enables the well-being of our employees, customers, consumers and other stakeholders. (About Us, 2015)

Motto

“Brining well-being to life” (About Us, 2015)

CITY/REGION

The city of Modesto, California is situated in the center of the San Joaquin Valley and is the county seat of Stanislaus County. As a major hub for the agriculture-rich region, the city is home to an estimated population of 210,000 people based on estimates from the city's website. The plant itself is housed along the southeastern side of the town in an industrial area near the city's municipal airport. Emergency services are tended to by City entities to include police, firefighting, and other emergency services. Utilities in the area are maintained by the City, for water, and Pacific Gas and Electric Company for electricity and natural gas.

The immediate vicinity surrounding the facility is home to lower income housing and another medium to large scale production operations. Labor demands within the facility range from highly skilled technical operators to more menial tasks focused on cleaning and stacking boxes. The company sources these employees through nonunion means with direct hiring through Human Resources and temporary labor through a local provider. As a greater than the minimum wage paying facility the company enjoys a better than average retention rate among hourly employees and is, therefore, able to remain selective in its hiring process.

With local crime, which includes gang activity synonymous with the region, being high, the onus falls on companies in the area to protect their facilities. Recent instances of crime in the area that have affected the company itself include equipment theft, including pallets and motors, and vandalism to the exterior fencing and walls around the shipping area of the building. As a city-wide issue, car theft has also been a problem to the facility over the past 12 months with four employee cars being stolen from the front parking lot during daylight hours.

FACILITY

The facility itself is a large stand-alone building with entrances and exits on each side of the building. Along the eastern, front, or Mariposa road facing side of the building are two tractor trailer receiving doors, three self-locking man doors with controlled fob style access a long fence and a vehicle gate for access to the shipping and boiler areas. The northern edge of the building is comprised of three separate man doors using traditional locks, boiler equipment and office area, five tractor trailer load-out shipping doors and small garage area with a roll up door that is used for storage of unused of defunct parts and materials. This northern edge of the facility is connected to the eastern vehicle gate and is enclosed by a six-foot tall fence.

The western facing edge of the building includes the back side of the garage area with a traditional lock man door and six man doors along the side of the exterior wall. This area of the plant includes a product storage tank area, chemical loading points, three large cooling system fans, a dairy and milk receiving bay as well as a roll up door for forklift and vehicle access. Most of this area includes a six foot tall fence between company property and that of other businesses directly to the west of the plant. A common pathway through this area is maintained to facilitate the delivery and shipping of liquid soy base and dairy. The northern edge of the building is largely unused with a fence along the exterior and a man door that leads to the fence and a narrow pathway between it and the building.

The interior of the building is maintained to sound industrial production standards by a two person team dedicated to facilities engineering and maintenance. These two mechanics are charged with maintaining a structurally sound and safe working environment for all employees in the facility. Additionally, they maintain relationships with local regulatory agencies to ensure compliance with electrical, chemical, pest and fire control services. The company uses an overlapping fire alarm and sprinkler system designed to douse flames and prevent loss of life and property. The fire extinguisher program includes properly spaced extinguishers and yearly familiarization training with all company employees. Emergency drills for fire and gas are scheduled on a yearly basis but have not been documented as completed since early 2014.

Starting from the southern wall of the building moving northward the plant follows a streamlined process flow designed and implemented to promote ease of movement and maximum efficiency of production. The far southern side of the building houses a warehouse for the receipt of production materials and ingredients and is accessible from the receiving and dairy load out roll up doors. A large soy extraction room, three mixing rooms and an internal access room to the product storage tanks make up the rest of this western portion. Enclosed in two small ventilated rooms in this area are chemical rooms that house caustic and acid meant for cleaning of production machinery throughout the plant. The heart of the aseptic operation is housed in the next two large rooms which share an internal structure inside the overall warehouse. These rooms contain; three Tetra Pak processing machines, three storage silos ranging from 10,000 to 15,000 gallons as well as eight Tetra Pak filling machines all designed to keep air and bacteria out of product cartons to ensure extended shelf life capability. Moving into the original structure sees casing, palletizing and warehousing operations across all eight lines. The far eastern and northern areas of the facility are dedicated warehouses meant for the temporary storage of finished goods before they are shipped on to a distributor. Additionally, inside the original structure is two, two-story buildings meant for offices and storage. The operations office contains a six cubicle workstation, male and female bathrooms, an employee break room and parts storage on the ground floor. The top floor is a dedicated parts and supplies room with two stairwells, one on each side.

The front office structure's ground floor houses offices for the plant, production, and human resource manager's office as well as a small reception area staffed by an administrative assistant. The upstairs portion includes two conference rooms, female and male restrooms and locker rooms as well as access to the roof and electrical equipment. Access to the roof is strictly controlled and is available by only one key.

ASSESSMENT

Strengths

It is important to maintain strong working relationships neighboring businesses to ensure a collective approach to general security and wellbeing. As each company in a given area will see a similar vulnerability risk, it is increasingly important to develop and foster relationships with those that share a similar environment. This communication can help each entity build an interlocking set of protocols meant to protect the viability of the business community through good times and bad. Even within the grasps of high crime area, the vulnerability of an entire industrial neighborhood may be affected positively or negatively based on the overall community-based relationships in place.

Within the designated industrial zone lies a preexisting network of businesses that have the ability to work together to prevent or mitigate the risk of crime in the area. As new tenants move into existing buildings, it is an important show of unity for established members to reach out and determine what security elements are available to make the overall continuity plan of the neighborhood stronger. The plant representative currently meets with other safety and security personnel at a bi-annual meeting hosted by the City and Police Department.

With attendance in the bi-annual business community meetings the company and its representatives can build a report with local law enforcement entities. These relationships are vital to the long-term health and viability of the company as a member of the overall community. Businesses that can develop and implement security measures with the rest of the community in mind helps to build an interlocking network that promotes safety and security throughout. With this type of cooperation and report developed, the various companies will be better able to deal with large-scale incidents as a team rather than multiple singular entities.

Human capital within an organization is sometimes an undervalued segment and one that must be protected at all times. Allowing for a safe and secure workspace that fosters productivity should be the result of any management process in a successful organization. "Calculating the value of our employees is difficult because they are not like any other asset; they are simultaneously the greatest potential asset and the most significant potential liability that an organization has at any given time. They are the only intangible asset that can be influenced but never completely controlled." ("Your Company's Most Valuable Asset: Your Employees", n.d.) The loss of an employee, especially from a preventable incident, is one that can be seen as both devastating and priceless at the same time. While it is expected that employees will leave overtime, it should be a stated goal of the company to maintain a safe working environment at all times.

A significant portion of the security system that is in place and functioning revolves around the company's ability to make sound hiring decisions. All new and existing employees are subject to random drug screens in addition to initial and annual background checks. Each of these measures ensures regulatory compliance and is therefore also triggered by an event and reasonable suspicion based actions. Any derogatory information found in an employee or applicant's history must receive a conditional waiver through corporate command channels before hiring, or retention can continue. Additionally, all employees receive initial and annual instruction on all company policies and procedures in place ensuring that everyone is on the same page and can act as a safety officer at any time.

Weaknesses

The plant security plan as it is currently constituted is lacking has had little by way of planning or security measures enacted. With the recent incidents of vandalism and car theft on company property, a newfound focus to improve security in an economical way has become a focus. The large unsecured parking lot has become an area of concern for employees coming to work each day as each one now knows a coworker whose car was stolen while working within the facility. Current security measures in place consist of controlled access doors on the front facing doors of the facility with issuance and tracking of key fobs controlled by the administrative assistant that works from 0800 to 1600 on a Monday through Friday basis. Additionally, the six-foot fence that acts as a perimeter barrier between company controlled areas and other businesses which cover about seventy-five percent of the property.

Human-made threats to an organization or its assets, whether they are malicious or unintentional, have a great impact on the need for and implementation of security plans. These human-based threats often encompass a majority of the attention and resources of the security team as they must protect against internal and external threats simultaneously. "Human-caused incidents, which result from the intentional actions of an adversary, such as a threatened or actual chemical attack, biological attack, or cyber incident…" (Threat and Hazard Identification and Risk Assessment Guide, 2013) These human-made threats include all types of potential threats from theft and sale of proprietary information to computer based cyber-attacks to direct ballistic or terroristic actions. Each threat can have an immediate impact on safety, security and overall profitability of the organization if left unaddressed.

VULNERABILITIES

The core concept of physical security, in this case, is to protect the plant from intrusion by unauthorized entities. Physical security is defined as "That part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard them against espionage, sabotage, damage, and theft."(Physical Security, n.d.) To adequately protect those assets requires a foundation of principals and planning to effectively control access within the constructs of a cost-conscious system. "A physical protection system, or PPS, integrates people, procedures, and equipment for the protection of assets or facilities against theft, sabotage, or other malevolent human attacks. The design of an effective PPS requires a methodical approach in which the designer weighs the objectives of the PPS against available resources and then evaluates the proposed design to determine how well it meets the objectives."(Garcia, 2008, p.1) Through the use of a PPS system, the focus of the security framework will be on the organizational ability to detect delay and respond to threats. The three areas lay the foundation of the security network that will protect the organization. "The primary functions of a PPS are the detection of an adversary, delay of that adversary, and response by security personnel (guard force)." (Garcia, 2008, p.57)

LAYERED SECURITY

The perimeter security in place as a simple border fence creates a barrier around roughly seventy-five percent of the exterior of the property. During night time operations there are few lights illuminating the perimeter as most in place are for convenience of using the parking lot. External security is largely dependent on controlling access to the building to the three eastern or front facing man doors that used the key fob access system. As not security measures are in place, the company largely depends on non-security company employees to determine if something is out of place and needs further attention. Once inside the building, there are once again little security measures in place as of this survey. All doors inside are self-locking and require an assigned key for entry while front office areas to include human resources are part of the same key fob restricted access system in use on the front facing doors. The administrative assistant can remotely unlock the northern most "visitor/main door" to allow access during day time hours.

NATURAL HAZARDS

Natural vulnerabilities to an organization come largely from geographically specific threats that may affect one location within a business but have no bearing whatsoever on another location. It is due to this nuance that makes it even more important to develop a site-specific assessment to identify better the vulnerable elements that may affect the company. The Central Valley of California is a relatively low-lying area dotted with streams and rivers making their way from the foothills of the Sierra and Cascade ranges to the Pacific Ocean. Little geographic variation combined the relatively inexpensive industrial land in flood-prone areas leaves many organizations highly susceptible to the effects of flooding. Conversely, just 60 miles to the west the greatest concern comes from large-scale geologic events such as earthquakes with little concern had for potential flooding. This two area would be considered close to most but endure highly different threats and overall vulnerability based on the geographic makeup of the surrounding area.

HUMAN MADE THREATS

Human-made threats and their resultant vulnerabilities contribute a bulk of the reasoning for having a risk assessment program in place. Where natural and even technological risks are large the result of acts of nature, it is the human made threat to safety and security that can cause the greatest effect over time. The vulnerability of any organization is susceptible to two major types of human-made threats; internal and external. External threats come from the larger scale events like terrorist attacks and general criminality that can have an immediate impact on the profitability functionality of the company. Internal threats are a constant threat in any industry and have the potential to erase profits effectively. "In times of economic difficulties, anything that affects the bottom line (profits) is not tolerated. Nevertheless, where fraud exists, most business fraud surveys calculate losses at about 6 percent of annual revenue. Some surveys we have seen reported have concluded that losses attributable to employee theft (internal theft) equal or exceeded profits!" (Broder & Tucker, 2012, p. 45) This internal threat highlights the vulnerability of a company to the actions and inactions of its personnel. Employee engagement and development of work ethics is a vital part of the operation that relies heavily on the human resource management process in this area. "Human Resource Management includes conducting job analyzes, planning personnel needs, recruiting the right people for the job, orienting and training, managing wages and salaries, providing benefits and incentives, evaluating performance, resolving disputes, and communicating with all employees at all levels. Examples of core qualities of HR management are extensive knowledge of the industry, leadership, and effective negotiation skills."(Businessdictionary.com, 2015) These systems are designed to develop and effectively manage company personnel.

TECHNOLOGICAL THREATS

The company holds as secure assets on its larger network the particular ingredient and formulation sheets of products. This proprietary information covers both internal and external formulas to include in-house competitors. In the course of production and logistical operations, the company uses logistical software operating system that combines many facets of production into one particular and user-friendly interface. The overall vulnerabilities in the current construct of the network come via an aging software infrastructure and the threat of data leakage or corporate espionage that could result in the loss of proprietary information.

On the servers of the current system, specifically at the plant in question, a user with proper access could have access all information on available on the system. From a human resources perspective, this includes all company progressive discipline and payroll files that are hidden with a folder and protected by a simple password. Company and customer specific ingredient lists for both raw and finished products found with little difficulty and available to all granted access to the system. Accounting and budgetary files, on the other hand, are relegated to user specific access certifications in addition to a regularly changed password changed, and all access therein is digitally tracked and or logged.

This particular facility requires both hard-wired and Wi-Fi for all users of the system in any department. A common practice within the facility is to move freely throughout the plant with a laptop in hand to facilitate management-level multi-tasking. Customers to the factory can use a password protected non-secure Wi-Fi network that allows access to email and will also support a 3rd party Virtual Private Network (VPN). "A VPN, as its name suggests, is just a virtual version of a secure, physical network—a web of computers linked together to share files and other resources. But VPNs connect to the outside world over the Internet, and they can serve to secure general Internet traffic in addition to corporate assets. In fact, the lion's shares of modern VPNs are encrypted, so computers, devices, and other networks that connect to them do so via encrypted tunnels." (How, and Why To Set Up A VPN Today, 2013). With the relatively small workforce covering plants and producers across the globe it is equally important that employees outside company proved network access can remotely log in with a VPN of their own. As it currently states each user or facility must be specially wired into the grid for any access to be granted.

The overall digital network that the information system now sits on is aging from both software and hardware perspective. The plant received an upgrade in those systems when the plant was refurbished and repurposed for its current use and started operations in March of 2009. Coming up on seven full years of nonstop operations has left the plant susceptible to potentially catastrophic attacks. The addition of a diverse product mix that includes many customers that themselves are rivals brings forth another layer of vulnerability. The company must protect its information from outside sources as well as from those granted physical access to the plant. A large threat to all parties involved comes by way of data leakage or employee theft from those unengaged participants under the security policy.

CRIME AND CRIMINOLOGY

The focus on crime when conducting a risk assessment is one that could potentially make or break an organization from the onset. In a community like Modesto, specifically in the area this operation is taking place the influence of crime cannot be underestimated. To be successful in the long run and maintain an ability to retain skilled workers the plant will need to enact measures meant to promote a safe and secure working environment. As a trusted supplier of natural and organic products to consumers it is important that the company maintains an image as an active participant in the betterment of the community at large. Focusing on ways to reduce or mitigate the damage seen from crime in the area is solid step in that direction.

NATIONAL AND GLOBAL ISSUES

Within a global society comes a system that is, for better or worse, dependent on outside entities to deliver their logistical needs. Even in the case of a vertically integrated company that delivers on all logistical needs in-house, there comes reliance on the outside. That would be in the general upkeep and usability of transportation mediums, road, rail, air and or sea, to deliver goods and services to the end consumer. The general vulnerability of each medium to outside influence directly affects the company that would otherwise rely on them to provide goods and services in an efficient manner to maintain the overall bottom line. The company, in this case, is highly reliant on the ability of others outside their control to maintain and ensure their usability. Therefore, the potential to be vulnerable to outside influences in the case is quite high.

As with natural threats, each organization is widely susceptible to, or a product of the environment that they call home. In regards to socio-economic and criminal activity, it is ever important to consider the physical location of company facilities and how the neighboring business and the general community interact. Many companies will enter into contractual agreements for land and facility use based on the availability of workforce and direct cost to the bottom line. In the case of Modesto, CA, this largely industrial area comes with relatively cheap rent, flood susceptibility, and high crime. The neighboring communities, bordering the industrial developments and municipal airport, are regarded as the poorest in town and are known for higher than average gang and criminal activity. The vulnerability in this instance is derived from an initial cost cutting decision and must be considered in all aspects of safety and security going forward.

Through this assessment of current risks, threats and vulnerabilities, SunOpta Modesto is able to move forward in the security planning process. With a focus on what is working now and what needs to be changed, the company can better focus on “brining well-being to life.” As a member of the business and local community the company can be seen as a team player interested in a safe working environment for all employees. With a focus on safety and security, the company will be better able to deliver on its status as a leading producer of natural and organic products.

References

Broder, J. F., & Tucker, E. (2012). Risk Analysis and the Security Survey (4th ed.). Waltham, MA: Elsevier Inc.

How (and why) to set up a VPN today. (2013). Retrieved from http://www.pcworld.com/article/2030763/how-and-why-to-set-up-a-vpn-today.html

Garcia, M. (2008). The Design and Evaluation of Physical Protection Systems (2nd ed.). Burlington, MA: Butterworth-Heinemann.,p1,p.4,p.57.

Physical Security. (n.d.). Retrieved from http://www.thefreedictionary.com/physical+security

SunOpta New Facility, Retrieved from http://www.packaging-gateway.com/projects/sunopta-soymilk/

Your Company’s Most Valuable Asset: Your Employees. (n.d.). Retrieved from http://www.oasisadvantage.com/blog/your-companys-most-valuable-asset-your-employees

About Modesto, Retrieved from http://www.modestogov.com/about/