The program security assessment.
The assessment is the entry point to the firm's work: five days examining how a program actually operates, followed by a report that states what to remedy first, what to remedy next, and what can safely be left alone.
- On site
- Five working days
- Report
- Within seven days of departure, presented in person
- From
- $18,500
- Founding rate
- Reduced for the first programs, in exchange for a reference
Six areas of examination.
A department is usually weak in at least two of them.
Facilities
Coaches' offices, meeting rooms, the war room, the locker room, film rooms. Who holds keys and credentials, who services the rooms, what is in the walls and ceilings, and where the sensitive conversations actually take place.
Travel
How hotels and meeting spaces are selected, who books them, how rooming lists move, what the staff carries, and what becomes of the team's tablets on the bus.
Devices and information
Telephones, tablets, playbook applications, shared drives, group messages, the film system, and the individuals with administrative access. How signals and calls are protected on game day.
People and practice
Boosters with building access, student workers, interns, the staff member who posts from the facility, the assistant whose spouse is employed by a rival. No one is investigated. The patterns are what matter.
Athlete exposure
What a stranger can learn about the roster in twenty minutes: addresses, vehicles, family, schedules, and which players are already receiving threats and have not said so.
Incident response
What happens today when a player receives a threat, a coach's telephone goes missing, or a reporter calls with something that was never public. Who receives the call, and whether they know what to do.
The week.
Conducted quietly, on a fixed structure, and concluded with a presentation to the athletic director.
- Before arrival
A short questionnaire and a document request: facility plans, travel policy, device policy, the organizational chart. Half of the findings are already visible in what a program cannot produce.
- Days one and two: facilities and access
Every room in which decisions are made is walked. Physical inspection of fixtures, furniture and wiring. Access review with facilities and campus police.
- Day three: people and information
Conversations with the head coach, the director of operations, the equipment staff and the graduate assistants. How information moves is learned from the people who move it.
- Day four: athletes
An open-source exposure check on a sample of the roster, and a briefing for the whole team if the department wishes. Players learn what is already public about them.
- Day five: travel and game day
The travel process is walked end to end, from the hotel contract to the sideline. A game-day signal plan is observed if the calendar allows.
- The report
Prioritized findings, a remediation schedule with owners and costs, and a one-page summary written for the athletic director. Presented in person or by video, never by email alone.
Before arrival: the document request.
Sent with the engagement letter. Half of the findings are already visible in what a program cannot produce, and the department learns something from the exercise of looking.
- Floor plans of the football building, with room use marked by the director of operations.
- The key and credential list from facilities: who holds what, including vendors.
- The travel policy, the last two trip itineraries, and the hotel contracts for the coming season.
- The device policy, if one exists, and a list of the applications in which the plan lives.
- The organizational chart, including graduate assistants, interns, student workers and volunteers.
- The current incident procedure for a threat to a player, if one exists, and the name of whoever answers the telephone at night.
- Any prior security report, sweep report or insurance survey of the facility.
Two scenarios, walked with the staff.
On the final day the staff is walked through two situations, around a table, for twenty minutes each. The answers become the incident-response section of the report.
- A player receives a credible threat at eleven at night
Whom does he tell? Does that person know whom to call? Is there a number answered at that hour? Who decides whether campus police are involved, and who tells the family? What is preserved, and by whom?
- A coach's telephone, with the plan on it, goes missing on a road trip
Who receives the call? Can that person trigger a remote wipe, and do they hold the credentials? Who decides whether the plan is compromised and what changes for tomorrow? Who tells the head coach, and when?
In most buildings the honest answers are that no one is sure. Twenty minutes produces a page of answers, and the page is the plan.
How findings are graded.
Every finding carries one of four severities, and the severity fixes the timing.
| Severity | Meaning | Timing |
|---|---|---|
| Critical | A live threat, an active leak path, or a room where the plan is exposed today. | Told to the client contact the same day, by telephone, before it appears in any report. |
| High | Would cause real harm if exploited, and exploitation is plausible this season. | Remedy before the next road trip. |
| Medium | A gap that a motivated person could use. | Remedy this season. |
| Low | Good practice the program is missing. | Remedy when convenient, or accept it and say so in writing. |
No surveillance of staff. No memorandum of fear.
The assessment does not investigate individuals, read anyone's messages, or record anyone. It describes patterns and remedies. Should something during the week suggest misconduct, the engagement letter states in advance exactly what the firm will report and to whom, so that no one is surprised.
Nor is the report a sales document for technical inspections. It states which rooms warrant instrumented inspection and which do not. Most programs require fewer than they fear.
How long does it take?
Five working days on campus, followed by approximately one week to prepare the report. The findings presentation falls in the second week.
Does it include a technical sweep?
It includes a physical inspection of the rooms in which sensitive conversations take place. A full technical inspection with instrumented equipment is a separate engagement, and the report states which rooms warrant one.
Who receives the report?
The individual the department names as client contact, normally the athletic director or chief of staff. Findings concerning staff practice are written so that they can be remedied without naming anyone.
What does it cost?
Published pricing begins at $18,500 for a single-sport program and rises with facilities and teams covered. Founding programs in the first year receive a reduced rate in exchange for a reference.