Security Strategy

SEC/480 CAPSTONE

Week 1 – Risk Assessment Content Checklist

GENERAL INFORMATION

1. Nature of Business/agency

a. Aseptic Bottling Plant; production facility specialized in organic and natural milk and milk substitutes

2. Facility Name

SunOpta Aseptic Modesto

3. Address

555 Mariposa Rd Modesto, CA 95354

4. Survey Date

5. 03/30/2016

6. Hours of operation

7. 8:00 AM – 4:30 PM (office hours) 24 Hour Production

8. Facility Contact Person

Matthew Wayne Reynolds

9. Phone Number

(209) 222-7811

10. Fax number

11. Email

[email protected]

12. Environment

Industrial neighborhood, Modesto, CA

13. Survey conducted by

Matthew Wayne Reynolds

14. Surveyor's address

555 Mariposa Rd Modesto, CA 95354

15. Surveyor's phone

(253) 310-3104

16. Surveyor's email

[email protected]

COUNTRY (where the facility is located)

1. Political conditions

Federal Republic

-United States

-California

-Modesto

2. Crime rates

According to city-data the crime rate is double the national average with high concentrations of gang, auto theft, vandalism and violent crime

3. Personnel safety

Area is serviced by the Modesto Police Department with available assistance from the California Highway Patrol and Stanislaus County Sherrif

4. Availability of labor

As an industrial region the availability to skilled and unskilled labor is readily available

5. Economic conditions

6. The region is largely rural and agriculturally based with large areas of economic hardship/depression

7. Medical treatment availability

The area is serviced by private and public ambulance services that deliver to local and county hospitals

8. Public firefighting availability

Modesto Fire Department(publically funded)

9. Public utilities

Pacific Gas and Electric (Electricity and Natural Gas)

City of Modesto (Water)

10. Public transportation

Stanislaus Area Regional Transit (StART)

11. Earthquake susceptibility

Considered high, 73.62% chance of a major earthquake within 50km of Modesto, CA within the next 50 years (http://www.homefacts.com/earthquakes/California/Stanislaus-County/Modesto.html)

12. Fire susceptibility

Fire in the region is likely due to the dry hot summers and agriculture, industrial neighborhood is largely free of plant life and easily burnable buildings. Largest risk comes from internal or fuel/chemical based fires.

13. Tornado susceptibility

Considered low, 22 tornados since 1950 with 0 injuries and 0 deaths

14. Severe weather susceptibility

Greatest risk comes from drought and flood related instances

COMMUNITY (neighborhood)

1. Crime rates

Double the national average

2. Aesthetic qualities

Industrial neighborhood surrounded by lower income, economically depressed residential neighborhoods

3. Public police protection

Modesto Police Department

4. Fire protection

Modesto Fire Department

5. Emergency medical services

Modesto Fire Department/ Private Entities

6. History of civil unrest

Historic gang activity

7. Graffiti/vandalism

High rates in the area

PHYSICAL SECURITY

Facility Perimeter

1. Fencing

6 foot fence marks border of roughly 75% of perimeter

2. Landscaping

Mostly concrete/asphalt with an area of grass and an evergreen tree/flagpole directly in front of main entrance

3. Parking

Unsecured parking lot along Mariposa Road in front of the building

4. Employee parking are illumination

Four curtesy lights attached to building that face the lot

5. Visitor parking illumination

Not differentiated

6. Employee parking area monitoring

None

7. Visitor parking area monitoring

None

8. Lighting

Exterior lights in boiler and milk receiving areas

9. Vehicular traffic pattern

Direct turn in from Mariposa Road, milk/soy tractor trailers use a back entrance using a mutually maintained gate/path

10. Trash removal

Gilton Solid Waste contracted 2 days per week

11. Protection from adjacent occupancies

Perimeter fence

12. Proper signage

Signs label business, receiving, milk receiving and shipping areas

Building

1. Description of building

The facility itself is a large stand-alone building with entrances and exits on each side of the building. Along the eastern, front, or Mariposa road facing side of the building are two tractor trailer receiving doors, three self-locking man doors with controlled fob style access a long fence and a vehicle gate for access to the shipping and boiler areas. The northern edge of the building is comprised of three separate man doors using traditional locks, boiler equipment and office area, five tractor trailer load-out shipping doors and small garage area with a roll up door that is used for storage of unused of defunct parts and materials. This northern edge of the facility is connected to the eastern vehicle gate and is enclosed by a six-foot tall fence.

The western facing edge of the building includes the back side of the garage area with a traditional lock man door and six man doors along the side of the exterior wall. This area of the plant includes a product storage tank area, chemical loading points, three large cooling system fans, a dairy and milk receiving bay as well as a roll up door for forklift and vehicle access. Most of this area includes a six foot tall fence between company property and that of other businesses directly to the west of the plant. A common pathway through this area is maintained to facilitate the delivery and shipping of liquid soy base and dairy. The northern edge of the building is largely unused with a fence along the exterior and a man door that leads to the fence and a narrow pathway between it and the building.

The interior of the building is maintained to sound industrial production standards by a two person team dedicated to facilities engineering and maintenance. These two mechanics are charged with maintaining a structurally sound and safe working environment for all employees in the facility. Additionally, they maintain relationships with local regulatory agencies to ensure compliance with electrical, chemical, pest and fire control services. The company uses an overlapping fire alarm and sprinkler system designed to douse flames and prevent loss of life and property. The fire extinguisher program includes properly spaced extinguishers and yearly familiarization training with all company employees. Emergency drills for fire and gas are scheduled on a yearly basis but have not been documented as completed since early 2014.

Starting from the southern wall of the building moving northward the plant follows a streamlined process flow designed and implemented to promote ease of movement and maximum efficiency of production. The far southern side of the building houses a warehouse for the receipt of production materials and ingredients and is accessible from the receiving and dairy load out roll up doors. A large soy extraction room, three mixing rooms and an internal access room to the product storage tanks make up the rest of this western portion. Enclosed in two small ventilated rooms in this area are chemical rooms that house caustic and acid meant for cleaning of production machinery throughout the plant. The heart of the aseptic operation is housed in the next two large rooms which share an internal structure inside the overall warehouse. These rooms contain; three Tetra Pak processing machines, three storage silos ranging from 10,000 to 15,000 gallons as well as eight Tetra Pak filling machines all designed to keep air and bacteria out of product cartons to ensure extended shelf life capability. Moving into the original structure sees casing, palletizing and warehousing operations across all eight lines. The far eastern and northern areas of the facility are dedicated warehouses meant for the temporary storage of finished goods before they are shipped on to a distributor. Additionally, inside the original structure is two, two-story buildings meant for offices and storage. The operations office contains a six cubicle workstation, male and female bathrooms, an employee break room and parts storage on the ground floor. The top floor is a dedicated parts and supplies room with two stairwells, one on each side.

The front office structure's ground floor houses offices for the plant, production, and human resource manager's office as well as a small reception area staffed by an administrative assistant. The upstairs portion includes two conference rooms, female and male restrooms and locker rooms as well as access to the roof and electrical equipment. Access to the roof is strictly controlled and is available by only one key.

2. Common walls with adjacent occupancies

Perimeter fence on three sides

3. Exterior door construction

Metal

4. Exterior door locks

3 of 16 external doors use key fob access points(all unfenced facing the road)

5. Door lock operation

Key fob and traditional key

6. Exterior window construction

Front visitor door and front office (downstairs only)

7. Window height above ground

Ground to 7 foot

8. Window security

None

9. Roof access restriction

Internal access point, traditional key secured

10. Building exterior lighting

Minimal, 4 lights on parking lot, boiler area and milk receiving

11. Shipping/receiving area monitoring

Monitored by production employees

12. Emergency exit

16 man doors and 6 roll up doors

13. Emergency exits unobstructed

Doors kept clear and accessible

14. Interior door construction

Steel

15. Interior wall construction

Brick

16. Antitheft systems/mechanisms

None

Access Control

1. Intrusion detection

None

2. Building entrances minimized

16 man doors and 6 roll up doors

3 man doors and 2 roll up doors accessible from street

3. Employee entrance monitoring

None

4. Visitor/guest entrance monitoring

Controlled access by administrative assistant, guests funneled to waiting area

5. Interior door locks

Traditional locks throughout

-key fob controlled access to front office/human resources area

6. Key control system

Keys and key fob control system by administrative assistant

7. Key sign-out/assignment system

Specific key/fob sign out

8. Keys accounted for

No scheduled inventory

9. Key safeguards

Locks changed after management turnover in 2015

10. Employee distinguishableness

Different uniforms provided for specific departments/positions

Production: white uniforms with steel toe boots

Warehouse: Tan/Black uniforms with steel toe boots

Quality: White smocks with steel toe boots

Maintenance: Blue uniforms with steel toe boots

Salary: Company Polo/Dress shirt with steel toe boots

11. Visitor/Guest supervision

Visitors receive a visitor pass and must have a chaperone

(exceptions for contractors who receive pass but do not require escort)

12. Restricted access to sensitive/vulnerable areas

Human resources/plant management offices control by limited access key fob

13. Computer/data storage restrictions

Password protected/user specific computer terminals. All users subject to additional background checks for specific access

-VPN access

-public drive access

-oracle access

-Ceridian payroll access

-CoLoS access

14. Key storage area restrictions

Traditional key storage maintained and controlled by administrative assistant

15. Mechanical/utility room restrictions

Restricted access signs only

16. Telecommunications room restrictions

Locked room in human resources office controlled by key fob

17. Mailroom restrictions

N/A

18. Executive office suite restrictions

Key fob limited access

19. Vendor access

Sign in with administrative assistant

20. Vault/safe security

N/A

21. Controlled substance security

N/A

22. Hazardous Material security

Restricted access chemical storage rooms/areas

23. Cash/liquid asset protection

N/A

24. Proper signage to direct visitors

External and internal area designation signs

Alarm and Surveillance Systems

Describe the system and components

Fire Protection

1. Fire alarm system

Traditional alert system with audible and 911 alerting technology

2. Sprinkler system

Water based throughout plant with foam based systems in the boiler and chemical storage areas

3. Fire extinguishers

4. Spaced evenly throughout the plant with regular Fire Marshall inspections done

5. Fire suppression

6. Foam based suppression system in the boiler and chemical storage areas

7. Fire alarm system testing

Fire alarm drills scheduled but not performed since 2014

8. Gas line protection

Master gas shut off in boiler area

9. Electric power cord protection

N/A

10. Fire doors functional

N/A

11. Flammable material storage

Flammable material stored in segregated lockers

12. Fire notification plan

Immediate notification tree posted

13. Fire evacuation plan

Fire evacuation plans posted

14. Fire exits unobstructed

All exits clear

15. Fire exits secured from outside

All exits clear

16. In house fire brigade

N/A

17. Fire safety policy/procedures

Regular fire Marshall Inspections and maintaining safe exit routes

18. Address prominently displayed

Front sign has address displayed (along Mariposa Road)

PERSONNEL SECURITY

1. Employee background investigations

All employees subject to initial, annual and event based background investigations

2. Previous employer verification

Random check of previous employers

3. Personnel records security

Secured in key fob limited access areas

4. Exit interviews that employee termination

Mandatory (when available)

5. Organization property retrieval at termination

Mandatory (billed when unsuccessful/withhold final pay)

6. Employee/visitor safeguards against

7. Accidents

Accident prevention and response program

8. Theft

Minimal: dependent on voluntary reporting

9. Assault

Zero tolerance policy for violence

10. Workplace violence

Zero tolerance policy for violence

INFORMATION SECURITY

1. Critical information identification

All information on servers considered proprietary

2. Critical information security

All digital information protected by password/access control measures

All paper information scanned in/sent to shred after use

3. Information hardcopy destruction

All paper information scanned in/ sent to shred after use

4. Employee nondisclosure agreement in place

Yes

5. Intellectual property identification

All considered proprietary

6. Intellectual property security

Same as critical

7. Client and customer list protection

Confidential

8. Access to computers restricted

Controlled access/additional background checks required

9. Access to computer transmissions restricted

Business use only

10. Laptop and personal computer security

Key personnel issued laptops

11. E-mail access restrictions

Business use only

12. Internet connection security

Secured company wi-fi for VPN access

Unsecured guest wi-fi(password protected) for company visitors

13. Electronic document destruction procedures

Mandatory retention of all documents

Special authorization from corporate IT to delete anything

14. Software licensing

Controlled by IT department

15. Prohibition against installation of outside software

Super user access required to download/install

16. Terminated employees immediately denied access

Controlled by IT department (in theory yes)

17. Disaster recovery plan

All information backed up at other SunOpta plants

18. Duplicate data files maintained at remote location

All information backed up at other SunOpta plants

19. Password security

All passwords change at 90 day intervals

20. Information security indoctrination and training

Limited

21. Cellular phone communication protection

Cellular phones issued to key personnel

Largely unenforced no cell phone policy in place for production floor

INVESTIGATIONS, INTELLIGENCE, AND SECURITY

Background Investigations

1. Employees (new)

All new employees undergo intensive background check

2. Employees (existing)

Existing employees undergo annual and event based background checks

3. Vendors/contractors

Limited: depending on relationship with vendor

4. Partnerships with other organizations

N/A

5. Security clearances

N/A

Incident Investigations

1. Investigation of any loss

Threshold based with no specific trigger

2. Accidents

All investigated to find root cause/ preventative measures

3. Safety hazards

Identified and addressed through safety team

4. Crime

Dependent on event with most actions being handled through human resources

5. Natural disasters

No definitive plan

Intelligence

1. Competition counterintelligence

N/A

2. Criminal intelligence

N/A

3. Foreign travel intelligence

N/A

Reporting Procedures

1. Background investigations documentation

All employees/perspective employees sign release to authorize Results stored at corporate offices

2. Background investigation confidentiality

Only employee and corporate representative/human resources manager authorized access

3. Security activity log maintenance

N/A

4. Recording of incidents

OSHA safety log maintained by Safety Team

5. Incident reported to proper manager and/or authority

Mandatory reporting of all incidents up the chain to corporate

6. Adherence to reporting procedures

Mandatory

OPERATIONS

1. Audit procedures

Customer/internal/safety audits completed on a routine basis

2. Employee locker/workstation inspections

Weekly

3. Accounting function separation

Accounting currently completed by corporate accounting(open position in house)

4. Package control system

All deliveries to administrative assistant during office hours

5. Opening time ambush controls

24 hour operations

6. Closing time ambush controls

24 hour operations

7. Receiving area security

None (roll up door with simple hold locks)

8. Shipping area security

Fenced in area

9. Delivery driver controls

All deliveries to administrative assistant during office hours

10. Shipping/ receiving area separation

Separate sides of facility

11. Equipment inventory

Monthly/Quarterly/Yearly

12. Contractor/vendor audits

None scheduled

13. Customer/guest/visitor service

All sign in and acknowledge company GMPs

POLICIES AND PROCEDURES

1. Mission statement

"At SunOpta, we empower our employees to enrich lives by developing healthy and organic food products, driving sustainable well-being." (About Us, 2015)

2. Vision statement

"To be a sustainable organization that is a global leader in natural and organic food products are driven by a spirit of continuous improvement, innovation and category expertise that enables the well-being of our employees, customers, consumers and other stakeholders. (About Us, 2015)

3. Organizational goals

“We responsibly bring healthy food from field to table”

4. Organizational values

Unrelenting

Adaptable

Collaborative

5. Quality improvement initiatives

SQF/HAACP based initiatives to produce safe quality aseptic beverages in a timely manner

6. Employee code of conduct

Employees are expected to present themselves in a safe professional manner in order to attain the company goals of being an industry leader in natural and organic products.

7. Employee misconduct policies

All employee misconduct handled through the progressive discipline process

8. Disciplinary procedures

Progressive discipline based

9. Termination procedures

Progressive discipline based with focus on adherence with CA law

10. Search/inspection policies

All persons to include their clothing/bags/vehicles on site are subject to search in their presence

11. Removal of organization property

Strictly prohibited and enforced through progressive discipline

12. Bomb threat procedures

No specific plan in place

13. Evacuation procedures

Evacuation maps posted throughout the facility

14. Severe weather procedures

Alert tree notification and advice to preserve life and property

15. Natural disaster procedures

Evacuation maps posted throughout the facility

16. Contraband detection

Voluntary reporting based

17. Chemical abuse policy

Prohibited as an OSHA facility

18. Drug testing policy

Initial, random and event based

SECURITY INDOCTRINATION/TRAINING

1. Indoctrination for new employees

Brief orientation conducted by human resources

2. Training for existing employees

Limited to supervisor level training on no set schedule

3. Executive protection

N/A

4. Foreign travel training

None at local level

LIAISON ACTIVITIES

1. Contact with local police maintained

Bi annual meeting of local business and city representatives to include local law enforcement to discuss security and business/neighborhood continuity

2. Contact the sheriff maintained

Bi annual meeting of local business and city representatives to include local law enforcement to discuss security and business/neighborhood continuity

3. Contact with state police and/or highway patrol maintained

Bi annual meeting of local business and city representatives to include local law enforcement to discuss security and business/neighborhood continuity

4. Contact with fire department maintained

Bi annual meeting of local business and city representatives to include local law enforcement to discuss security and business/neighborhood continuity Regular contact with fire marshal regarding regulatory and compliance functions

5. Contact with appropriate federal agencies maintained

Regular work with industry based regulatory agencies, federal law enforcement contact is large event based

6. Articulation and/or collaboration with other security organizations

No specific security team on site and limited contact with outside organization in regards to security. Local IT manager maintains IT system and security in house.