Incident Response for Financial Institutions under the ABS Guidelines

A physical security programme should not end when a threat is detected.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) treats Response as one of the four fundamental components of physical security, alongside Risk Assessment, Protection and Detection.

ABS defines response as the protective actions taken to mitigate an emergency or security incident and react to a physical security threat. It organises response into three main phases:

Preparation → Incident Response → Post-Incident Recovery.

This structure is important because effective response begins before an incident happens.

An organisation should already know who is responsible, what activates the response, how employees are informed, how people are accounted for, how building management is involved and how different threat scenarios will be managed.

The objective is not to invent the response during the emergency.

What does ABS mean by Incident Response?

ABS’s Response framework covers actions taken to reduce the effects of a security incident or emergency and deal with the physical threat.

The three phases are:

Preparation, where plans, roles and procedures are established.

Incident Response, where immediate actions are taken to contain and mitigate the incident.

Post-Incident Recovery, where the organisation examines what happened, corrects weaknesses and improves its security programme.

These phases form a useful operating cycle:

Prepare → Respond → Recover → Improve

Why does preparation matter?

ABS describes preparation as fundamental to managing an emergency or security incident effectively.

The preparation phase should address the threats and risks already identified by the financial institution.

ABS specifically says response planning should consider:

roles and responsibilities, how and when the response is activated, threat-specific procedures, and arrangements for accounting for people and assets.

This means an emergency plan should answer practical questions before the incident occurs.

Who makes decisions?

Who contacts the Police?

Who communicates with employees?

Who talks to the landlord?

Who manages access control?

Who accounts for employees and visitors?

Who preserves security information for the investigation?

Those details can make the difference between a coordinated response and several teams acting independently.

Should incident-response responsibilities be assigned in advance?

Yes.

ABS specifically states that personnel roles and responsibilities should be established as part of response planning.

During the actual incident, ABS again emphasises that roles, responsibilities and required actions should be clearly defined, including liaison with external authorities.

Consultant’s perspective

A financial institution should avoid vague instructions such as:

“Security will manage the incident.”

A stronger procedure identifies the actual functions involved.

For example, security may lead physical-security coordination while facilities coordinates with building management, HR or business continuity accounts for employees, communications handles internal messaging and management provides the required decision authority.

The exact structure should reflect the FI’s organisation.

Does every physical security incident require the same response?

No.

ABS specifically states that emergency planning for buildings and offices must be tailored to different situations.

A forced-door alarm does not require the same response as:

an armed attack, suspicious parcel, bomb threat, chemical contamination or vehicle-borne explosive threat.

A mature response framework therefore combines:

one common incident-management structure

with

threat-specific response procedures.

Which threat scenarios does ABS expect FIs to prepare for?

ABS specifically says response protocols should be developed and simulated for Active Assailant, Bomb Threat, Mail Delivered Threats, Chemical/Biological/Radiological threats, PBIED, VBIED and Hostage Situations.

These scenarios do not necessarily represent every possible physical-security incident.

However, they are the specific threat-response subjects ABS addresses in its Response section.

Should the FI coordinate its response with building management?

Yes.

ABS says preparation should involve relevant stakeholders such as building management so operating protocols and procedures are aligned.

This is especially important for financial institutions operating in multi-tenant buildings.

The FI may control its own:

office access control, tenant CCTV, internal communications and employee procedures.

But building management may control:

building entrances, lifts, common areas, PA announcements, evacuation routes, fire systems, perimeter security, building guards and contact with emergency responders.

The two response plans therefore cannot be developed in isolation.

Who decides whether to evacuate or lockdown?

ABS does not prescribe one universal job title or decision authority.

The FI should define this within its emergency procedures and coordinate with building-management protocols.

This is particularly important because the safest action depends on the threat.

An incident outside the building may make remaining inside safer.

An incident inside the premises may require evacuation.

A suspicious package may require people to move away from a particular area rather than automatically use the normal evacuation route.

The decision framework needs to be agreed in advance.

What is the difference between evacuation and invacuation?

ABS uses both concepts.

Evacuation means moving people away from the affected building or area.

Invacuation refers to keeping or moving people into a safer internal location rather than sending them outside.

ABS’s bomb-threat guidance specifically recognises that either evacuation or invacuation may be activated depending on the situation.

Consultant’s perspective

This distinction is critical.

A standard fire response often assumes movement out of the building.

A physical-security threat may make the external environment itself dangerous.

Therefore, an FI should not simply treat every security incident as a fire evacuation.

Should the FI have alternative evacuation routes?

Yes, this is an important consideration in the wider ABS building checklist.

ABS asks whether evacuation and invacuation routes take account of the location of suspicious packages, objects or vehicles and whether alternative assembly areas are available where the normal location may be exposed to the threat.

Consultant’s perspective

The normal fire assembly point should therefore not automatically be treated as the safe destination for every security incident.

The threat itself may be near that location.

Should employees and visitors be accounted for during an evacuation?

Yes.

ABS specifically says staff must be accounted for efficiently when evacuation is activated and that the responsible department should have protocols to begin employee accounting quickly.

Response planning also refers more broadly to accounting for people and assets.

Consultant’s perspective

A practical accountability system should consider not just permanent employees, but also:

visitors, contractors and other persons who may be on site.

This links incident response directly to the visitor-management process.

Does ABS prescribe a particular employee-accounting technology?

No.

The guideline establishes the need for accountability but does not require one specific software platform.

An FI might use:

HR information, an emergency application, visitor-management records, floor wardens or another suitable method.

The important security outcome is knowing whether people are safe and whether anybody may remain in the affected area.

Should staff receive incident-response training?

Yes.

ABS says regular security-related exercises and drills should be conducted so employees and role holders remain familiar with emergency-response procedures.

It also says SOPs, emergency plans and guidelines should be supported by staff awareness and training, with simulation exercises used to identify weaknesses in those plans.

This means incident response should be practised, not merely documented.

What should incident exercises test?

ABS does not prescribe a universal exercise script.

A useful simulation should test whether:

the incident is detected, the correct person is notified, decision authority is clear, employees receive appropriate instructions, building management is contacted, security systems support the response, people are accounted for and external responders can be coordinated with.

The exercise should then identify gaps for correction.

That is a practical interpretation of the ABS exercise and continuous-improvement requirements.

What should happen immediately when an incident occurs?

ABS states that swift action is needed to minimise damage.

The responder or Emergency Response Team should identify the cause of the incident or breach, contain it and take prompt measures to prevent further impact while avoiding unnecessary compromise of any subsequent investigation.

A useful high-level sequence is therefore:

Identify → Contain → Protect → Escalate → Coordinate → Recover

This is a consultant’s summary of the ABS response logic rather than a prescribed ABS acronym.

Should the FI preserve evidence after an incident?

ABS specifically warns that prompt incident action should avoid compromising the integrity of any subsequent investigation.

This has practical implications for:

CCTV recordings, access-control logs, alarm records, visitor information and incident reports.

Consultant’s perspective

Relevant electronic records should therefore be protected from automatic deletion or accidental alteration when an incident is under investigation.

The precise evidence-handling procedure should be established within the FI’s security and investigation processes.

What does ABS say about an Active Assailant?

ABS uses the Run, Hide and Tell principles for individual response to an active attacker.

In summary:

Run when it is safe to escape.

Hide where escape is not safe, using available cover and restricting the attacker’s access where possible.

Tell the Police when it is safe to do so and provide useful information about the attack and attackers.

The organisation’s role is to ensure employees are familiar with these principles before an incident occurs.

Is Active Assailant response the same as lockdown?

Not exactly.

Lockdown can be one organisational response to a threat, while Run, Hide, Tell provides individual guidance during an active attacker situation.

Depending on where the attacker is located, some employees may be able to escape while others may need to hide.

Consultant’s perspective

A blanket announcement such as:

“Everyone must stay where you are”

may not be suitable for every active-assailant scenario.

This is why employee education and incident-specific procedures matter.

Should an FI conduct Active Assailant exercises?

ABS says the response protocols it identifies, including Active Assailant, should be developed and simulated.

That supports exercises or simulations.

However, any exercise should be controlled and designed so participants understand it is an exercise and are not unnecessarily exposed to distress or danger.

What does ABS say about bomb threats received by telephone?

ABS provides a specific Bomb Threat Call section.

Its guidance focuses on remaining calm, alerting Police, keeping the caller engaged where possible and gathering useful information such as the alleged bomb’s location, timing and characteristics, while also paying attention to details about the caller and background sounds.

ABS also warns against spreading rumours and notes that evacuation or invacuation may be activated according to the situation.

Should receptionists and call handlers know how to respond to bomb threats?

This is a logical consequence of the ABS procedure.

The person receiving the call may need to gather information while somebody else alerts the Police.

Consultant’s perspective

An FI should therefore consider maintaining a Bomb Threat Call Checklist at likely call-receiving locations such as:

reception, security desks or central switchboards.

The exact checklist should align with the FI’s procedure and current official guidance.

Does every bomb threat require immediate evacuation?

ABS does not state that every bomb-threat call automatically requires full evacuation.

Instead, it says evacuation or invacuation may be announced depending on the situation.

This is an important distinction.

Moving large numbers of people without considering the threat location can itself create risk.

The decision should follow the organisation’s emergency procedures and relevant authority direction.

What about a suspicious parcel or mail-delivered threat?

ABS addresses Mail Delivered Threats separately from telephone bomb threats.

It warns that suspected explosive mail should not simply be opened and says Police should be contacted, with further actions taken to secure people and the affected premises.

We covered the mailroom-security side in the previous article.

For incident response, the key issue is that employees need a predefined escalation procedure rather than improvising with the object.

What does ABS say about Chemical, Biological or Radiological threats?

ABS includes Chemical, Biological and Radiological (CBR) threats among the scenarios requiring developed and simulated response protocols.

Its detailed guidance for suspected contaminated mail emphasises avoiding unnecessary handling or spreading of the material, isolating the affected area and managing exposed persons appropriately.

The wider building-management checklist also asks whether procedures exist for shutting fresh-air ventilation and restricting ingress and egress as part of an In-Place Protection response.

Should a CBR incident always trigger evacuation?

Not necessarily.

Depending on where the hazard is located, moving employees outside or through an affected area may increase exposure.

ABS’s building-management guidance therefore considers situations where the building may need to be secured rather than evacuated until authorities clear the threat.

This is another reason an FI should understand its building’s invacuation and In-Place Protection arrangements.

What is PBIED?

PBIED refers to a Person-Borne Improvised Explosive Device.

ABS treats this as a separate threat scenario because the explosive device is carried or concealed on a person.

The guideline’s individual-response guidance emphasises moving to safety, following Police or security instructions and avoiding hazardous areas.

From an organisational perspective, the more important preparation questions concern:

detection, screening, communications, cordoning, evacuation routing and building-management coordination.

What is VBIED?

VBIED refers to a Vehicle-Borne Improvised Explosive Device, where an explosive device is contained in a vehicle.

ABS separately addresses this threat and its wider building checklist examines matters such as suspicious vehicles, evacuation distances and routes away from the threat.

For most financial institutions in commercial buildings, much of the physical response to a suspected VBIED will involve:

building management, building security and the Police.

The tenant FI still needs to understand what instructions employees should receive and how its own emergency procedure links to the building plan.

What does ABS say about hostage situations?

ABS includes Hostage Situation among the scenarios requiring developed and simulated response procedures.

Its individual guidance focuses on remaining calm, avoiding provocative behaviour, following instructions and observing information that may later assist authorities.

Consultant’s perspective

At the organisational level, the FI’s role is more likely to involve:

rapid notification of authorities, restricting access to the affected area, coordination with building management, employee communications and supporting the Police response.

Employees should not be expected to improvise negotiation strategies.

Does an FI need a separate SOP for every threat?

Not necessarily a completely separate standalone document.

ABS says the protocols should be developed and simulated, but does not prescribe the document structure.

An FI could maintain:

one comprehensive Emergency Response Plan with threat-specific sections,

or

separate SOPs for higher-risk scenarios.

The important issue is that the instructions are easy to locate and use during the actual incident.

What is the role of the Security Control Room during an incident?

ABS describes the control room elsewhere as the nerve centre where information from security systems can be received, assessed and escalated.

During an incident, the SCR, SCC or remote monitoring centre may therefore support:

alarm receipt, CCTV verification, situational awareness, communication with field security personnel and escalation.

Consultant’s perspective

The control-room procedure should link directly to the Emergency Response Plan.

The operator should not need to decide from scratch:

“Who do I call for this alarm?”

The escalation path should already exist.

How should CCTV support incident response?

CCTV can support incident response through:

situational awareness, verifying what has happened, identifying where the threat is, supporting deployment decisions and preserving information for later investigation.

However, the camera system should not distract personnel from immediate life-safety decisions.

Consultant’s perspective

After an incident, relevant video should be secured promptly so it is not automatically overwritten under normal retention settings.

How should access control support response?

Access control may potentially assist with:

restricting movement, protecting critical areas, reviewing who entered particular spaces and supporting lockdown procedures.

However, security actions involving electronically controlled doors must not compromise applicable emergency-egress and life-safety requirements.

The exact door behaviour should therefore be engineered and documented before the incident occurs.

What should happen to visitors during a security incident?

ABS requires visitor management and separately requires personnel accountability during emergency response.

These two areas should therefore connect.

Consultant’s perspective

The host or designated emergency organisation should know how visitors are:

notified, moved to safety and accounted for.

A visitor cannot be expected to understand the FI’s emergency procedures as well as an employee.

This is another reason accurate visitor records are operationally useful.

What about people with disabilities or other assistance needs?

The cited ABS Response section does not provide detailed instructions for these groups.

A complete emergency-response plan should therefore address this separately using the applicable building, workplace and emergency-planning requirements.

It should not be presented as a specific ABS requirement unless supported by another source.

Does ABS require an Emergency Response Team?

ABS refers to the incident respondent or Emergency Response Team during incident response.

It does not, in this section, prescribe a universal ERT size or organisational chart for every FI.

The required structure should reflect the premises, employee population and applicable requirements.

Should incident-response contact lists be maintained?

ABS requires clearly defined roles, escalation and external-authority coordination.

While it does not provide one universal contact-list template in the cited Response section, maintaining current emergency contacts is a practical requirement for making those escalation procedures usable.

Consultant’s perspective

Relevant contacts may include:

building security, building management, FI security, facilities, crisis management, Police, emergency services and critical service providers.

The important point is that the list must remain current.

What should happen after the immediate incident is over?

ABS does not treat the end of the emergency as the end of the response process.

Its Post Incident Review section says FIs should analyse:

the root causes, gaps in incident response and vulnerabilities in the physical security plan.

The organisation should also seek input from stakeholders involved in the incident to assess the effectiveness of the response.

Should a Physical Security Risk Assessment be repeated after an incident?

Potentially, yes.

ABS says an FI may conduct a Physical Security Risk Assessment as part of the post-incident review to identify improvements in its physical security measures.

This makes sense where an incident reveals:

a previously unidentified threat, an ineffective control, a new vulnerability or incorrect risk assumptions.

The risk assessment can then be updated based on actual experience.

What should a post-incident review examine?

ABS specifically directs FIs to analyse root causes, response gaps and vulnerabilities and to obtain input from stakeholders involved in the response.

A useful review can therefore examine questions such as:

Did detection work?

Was the threat recognised quickly?

Was escalation clear?

Were employees given the right instructions?

Did landlord coordination work?

Did CCTV and access control provide useful information?

Were people accounted for?

Did any procedure cause confusion?

Were external responders supported effectively?

These are consultant questions that operationalise the ABS review requirements.

What should happen to corrective actions?

ABS states that plans should be developed and implemented to address identified gaps and improve security measures.

It also says lessons learned should be incorporated into the FI’s policies and procedures.

Therefore, a post-incident review should not end with a report.

It should lead to:

finding → corrective action → owner → implementation → verification → updated procedure

That is a practical governance workflow based on the ABS requirement for corrective action.

Should lessons learned affect training?

Yes, logically.

If the post-incident review identifies problems in:

employee awareness, guard response, control-room escalation or management decision-making,

then the relevant training and exercise programme should be revised.

This fits ABS’s continuous-improvement approach of testing procedures, identifying gaps and updating policies and procedures.

Should an FI conduct a review even if the incident was handled successfully?

ABS does not say post-incident review is only needed after failures.

Even a successful response may reveal opportunities to improve:

communications, response time, coordination or technology.

Consultant’s perspective

A successful outcome does not necessarily mean every control operated as intended.

A structured review can establish why the outcome was successful and whether that capability can be repeated.

Common mistakes in physical security incident response

A common mistake is having a generic emergency document that does not distinguish between different threats. ABS specifically identifies several scenarios requiring dedicated response consideration.

Another is designing tenant procedures without understanding the landlord’s emergency plan. ABS expressly expects coordination with building management.

A third is assuming evacuation is always the correct response. ABS recognises both evacuation and invacuation depending on the threat.

Another common problem is failing to assign authority. During a real incident, uncertainty over who can activate lockdown, contact authorities or issue employee instructions can waste critical time.

Finally, many organisations focus heavily on the incident itself but fail to conduct a structured post-incident review. ABS expects root causes, response gaps and vulnerabilities to be assessed and corrective actions incorporated into the security programme.

Practical ABS Incident Response Checklist

A financial institution should be able to answer the following:

1. What physical-security scenarios have been identified through the risk assessment, and are response procedures available for the applicable threats?
2. Who activates the incident response, who leads it and who can authorise evacuation, invacuation or lockdown?
3. Are employee, visitor and contractor accountability arrangements defined?
4. Are FI procedures aligned with building-management procedures?
5. Can security, facilities, management and external responders communicate effectively?
6. Are Active Assailant, Bomb Threat, Mail Delivered Threat, CBR, PBIED, VBIED and Hostage Situation protocols addressed where applicable?
7. Do employees understand the actions expected of them, including Run, Hide and Tell for an active-assailant scenario?
8. Are key call handlers familiar with bomb-threat procedures?
9. Are suspicious-mail and CBR escalation procedures established?
10. Are alternative evacuation routes and assembly arrangements considered where the normal route may lead towards the threat?
11. Can the Security Control Room or monitoring provider support verification and escalation?
12. Are CCTV, access-control and alarm records protected for investigation after a serious incident?
13. Are procedures tested through drills and simulations?
14. Is a post-incident review carried out to identify root causes, vulnerabilities and response gaps?
15. Are corrective actions assigned, implemented and incorporated into updated policies, SOPs and training?

Conclusion

The ABS Physical Security Guidelines treats incident response as a planned security capability, not something that begins only when an emergency occurs.

Its framework consists of:

Preparation → Incident Response → Post-Incident Recovery.

Preparation should establish roles, responsibilities, activation methods, threat-specific procedures, accountability arrangements and coordination with building management.

During the incident, ABS expects swift action, containment, clear responsibilities and coordination with relevant external authorities.

Afterwards, the FI should analyse root causes, identify response gaps and vulnerabilities, consider whether another Physical Security Risk Assessment is required, implement corrective actions and feed lessons learned back into policies and procedures.

The central principle is:

The effectiveness of incident response is largely determined before the incident happens. Roles, communications, procedures and coordination should already be understood and practised.