API 780 Security Risk Assessment Methodology for the Petroleum & Petrochemical Industries

About the Course

Security threats across petroleum and petrochemical facilities continue to intensify due to evolving geopolitical instability, sabotage risks, insider threats, cyber-physical convergence, and the emergence of advanced attack vectors such as unmanned aerial systems. These conditions require a structured, methodology-driven approach to security risk assessment that goes beyond conventional security practices. The American Petroleum Institute’s API 780 standard provides a recognised framework for conducting Security Risk Assessments (SRA), enabling organisations to systematically identify threats, evaluate vulnerabilities, assess consequences, and determine appropriate protective measures to safeguard critical infrastructure.

This 5-day API 780 Security Risk Assessment Methodology for the Petroleum & Petrochemical Industries training course equips delegates with the capability to execute Security Risk Assessments in alignment with API 780 methodology. It follows a structured workflow covering asset characterisation, threat assessment, vulnerability analysis, consequence evaluation, and risk determination, leading to the selection and justification of countermeasures. It also addresses contemporary challenges such as insider threats, coordinated attacks, and the integration of physical and operational security systems. Emphasis is placed on developing defensible, auditable assessments and strengthening risk-based decision-making. Upon completion, delegates will be equipped to perform structured SRAs, document risk findings, and support the implementation of effective security controls across petroleum and petrochemical operations.

Core Objectives

The delegates will achieve the following objectives:

• Interpret API 780 methodology for security risk assessment execution
• Analyse facility assets, critical functions, and exposure points
• Evaluate threat scenarios using structured assessment techniques
• Examine vulnerabilities across physical, operational, and personnel domains
• Assess consequences of security incidents on people, assets, and operations
• Determine risk levels and prioritisation using structured evaluation methods
• Develop and justify security countermeasures based on risk outcomes

Training Approach

This training course adopts a structured and practical approach, combining expert-led sessions, guided technical discussions, and scenario-driven applications aligned with API 780 methodology. Emphasis is placed on step-by-step execution of Security Risk Assessments using realistic petroleum facility scenarios to strengthen practical implementation capability.

The Attendees

This training course is suitable for professionals responsible for security risk, facility protection, and operational resilience within petroleum and petrochemical industries.

A broad range of professionals will benefit, including but not limited to:

• Security and Risk Management Professionals
• HSE and Compliance Specialists
• Operations and Facility Managers
• Asset Protection and Loss Prevention Personnel
• Project and Engineering Professionals
• Emergency Response and Crisis Management Teams
• Regulatory and Security Officers

Daily Discussion

DAY ONE: API 780 FRAMEWORK AND SECURITY RISK ASSESSMENT STRUCTURE

• API 780 Security Risk Assessment Methodology Overview
• Security Risk Assessment Process and Workflow
• Asset Characterisation and Criticality Identification
• Facility Description and Operational Context Definition
• Threat Categories and Security Risk Drivers
• Security Risk Assessment Planning and Scoping

DAY TWO: THREAT ASSESSMENT AND SCENARIO DEVELOPMENT

• Threat Identification Techniques and Intelligence Inputs
• Adversary Capability, Intent, and Target Selection
• Insider Threat Assessment and Security Breach Scenarios
• External Threats Including Sabotage, Theft, and Terrorism
• Emerging Threats Including UAV and Cyber-Physical Risks
• Development of Credible Security Threat Scenarios

DAY THREE: VULNERABILITY ANALYSIS AND CONSEQUENCE EVALUATION

• Vulnerability Assessment Methodologies and Techniques
• Facility Layout Analysis and Critical Node Identification
• Evaluation of Access Control and Perimeter Security Weaknesses
• Detection, Delay, and Response Capability Assessment
• Consequence Analysis for People, Assets, and Operations
• Impact Severity Classification and Scenario Evaluation

DAY FOUR: RISK DETERMINATION AND SECURITY CONTROL SELECTION

• Risk Determination Methodologies and Calculation Approaches
• Risk Ranking and Prioritisation Techniques
• Risk Acceptance Criteria and Decision Thresholds
• Defence-in-Depth and Layered Security Design
• Selection of Security Countermeasures and Controls
• Cost-Risk Justification and Investment Prioritisation

DAY FIVE: SECURITY GOVERNANCE, RESPONSE, AND CONTINUOUS IMPROVEMENT

• Security Risk Assessment Documentation and Reporting
• Development of Risk Registers and Security Assessment Outputs
• Countermeasure Justification and Mitigation Planning
• Residual Risk Evaluation and Decision Support
• Integration of SRA Findings into Facility Security Plans
• Security Risk Assessment Review, Update, and Revalidation

Certificate Awarded

Upon successful completion of this training course, participants will be awarded a Certificate of Completion from XCalibre Training Centre, acknowledging their accomplishment. This certificate serves as a testament to their dedication to developing their skills and advancing their expertise in their respective fields.