API 780 Security Risk Assessment Methodology for the Petroleum & Petrochemical Industries

About the Course

Security threats facing petroleum, petrochemical, and energy infrastructure continue to evolve in complexity due to geopolitical instability, sabotage, terrorism, insider threats, cyber-physical convergence, and the increasing use of emerging technologies such as unmanned aerial systems. Protecting critical facilities requires more than conventional security measures; it demands a systematic, risk-based methodology capable of identifying credible threats, evaluating vulnerabilities, understanding potential consequences, and selecting appropriate protective measures. The American Petroleum Institute's API 780 standard provides a recognised framework for conducting Security Risk Assessments (SRAs), enabling organisations to make informed, defensible, and auditable security decisions that strengthen the protection of people, assets, operations, and critical infrastructure.

This 5-day API 780 Security Risk Assessment Methodology for the Petroleum & Petrochemical Industries training course provides delegates with the knowledge and practical capability to perform multidisciplinary Security Risk Assessments using the structured five-step API 780 methodology. It follows the complete Security Risk Assessment process, including Characterisation, Threat Assessment, Vulnerability Assessment, Risk Evaluation, and Risk Treatment, while demonstrating how each stage contributes to the development of effective security strategies and protection systems. Delegates will examine realistic petroleum facility scenarios, assess credible security threats, evaluate existing safeguards, determine security risks, select appropriate countermeasures, and develop defensible assessment documentation that supports risk-based decision-making and continuous security improvement across petroleum and petrochemical operations.

Core Objectives

The delegates will achieve the following objectives:

• Interpret the principles, terminology, and methodology of API 780 Security Risk Assessments for petroleum and petrochemical facilities
• Apply the structured five-step API 780 Security Risk Assessment methodology to evaluate security risks systematically
• Analyse critical assets, threat scenarios, vulnerabilities, and potential consequences affecting petroleum and petrochemical operations
• Evaluate security risks using recognised risk-ranking methodologies and risk acceptance criteria
• Develop and justify appropriate security countermeasures based on risk assessment outcomes and defence-in-depth principles
• Prepare comprehensive Security Risk Assessment documentation and communicate risk-based recommendations to support management decision-making and regulatory compliance
• Strengthen organisational capability to implement and maintain effective risk-based security programmes aligned with API 780

Training Approach

This training course combines expert-led presentations, facilitated technical discussions, petroleum facility case studies, structured Security Risk Assessment workshops, threat scenario development exercises, and risk evaluation activities based on the API 780 methodology. Delegates will progressively work through each stage of the API 780 Security Risk Assessment process using realistic petroleum and petrochemical facility scenarios, enabling them to confidently apply the structured methodology within their own facilities and organisations.

The Attendees

This training course is designed for professionals responsible for security risk management, facility protection, operational resilience, and critical infrastructure security within petroleum, petrochemical, and energy organisations.

A broad range of professionals will benefit, including but not limited to:

• Security Managers and Security Risk Professionals
• Physical Security Engineers
• Asset Protection and Loss Prevention Specialists
• HSE and Corporate Risk Professionals
• Operations and Facility Managers
• Process Safety and Operational Integrity Engineers
• Project and Engineering Managers
• Emergency Response and Crisis Management Personnel
• Critical Infrastructure Protection Specialists
• Pipeline and Terminal Security Professionals
• Regulatory, Compliance, and Security Officers

Daily Discussion

DAY ONE: API 780 SECURITY RISK ASSESSMENT FRAMEWORK & STEP 1 – CHARACTERISATION

• API 780 Security Risk Assessment Methodology and Risk-Based Security Principles
• Security Risk Assessment Team Roles, Responsibilities, and Stakeholder Engagement
• Step 1: Characterisation – Facility Description and Operational Context
• Critical Asset Identification, Asset Criticality, and Infrastructure Dependencies
• Security Performance Objectives and Protection Requirements
• Security Risk Assessment Planning, Scope Definition, Assumptions, and Documentation

DAY TWO: STEP 2 – THREAT ASSESSMENT

• Step 2: Threat Assessment Methodology
• Threat Identification, Intelligence Sources, and Information Collection
• Adversary Capability, Intent, and Asset Attractiveness Evaluation
• Insider Threats, Sabotage, Theft, Terrorism, and Organised Criminal Activity
• Emerging Threats Including Unmanned Aerial Systems and Cyber-Physical Attacks
• Development and Validation of Credible Threat Scenarios

DAY THREE: STEP 3 – VULNERABILITY ASSESSMENT

• Step 3: Vulnerability Assessment Methodology
• Security Scenario Development and Vulnerability Assessment Techniques
• Evaluation of Existing Security Measures and Protective Systems
• Detection, Delay, Response, and Recovery Capability Assessment
• Vulnerability Estimation and Security Weakness Analysis
• Consequence Assessment for People, Assets, Operations, and Business Continuity

DAY FOUR: STEP 4 – RISK EVALUATION

• Step 4: Security Risk Evaluation Methodology
• Likelihood Determination and Consequence Integration
• Security Risk Determination, Ranking, and Prioritisation
• Risk Acceptance Criteria and Residual Risk Evaluation
• Risk-Based Decision-Making Frameworks
• Risk Communication and Management Decision Support

DAY FIVE: STEP 5 – RISK TREATMENT

• Step 5: Risk Treatment Methodology
• Selection and Justification of Security Countermeasures
• Defence-in-Depth and Layered Protection System Design
• Benefit-Cost Analysis and Security Investment Prioritisation
• Residual Risk Assessment, Documentation, and Security Risk Registers
• Security Risk Assessment Review, Revalidation, and Continuous Improvement

Certificate Awarded

Upon successful completion of this training course, participants will be awarded a Certificate of Completion from XCalibre Training Centre, acknowledging their accomplishment. This certificate serves as a testament to their dedication to developing their skills and advancing their expertise in their respective fields.