API 780 Security Risk Assessment (SRA) Methodology

This API 780 security risk assessment training course teaches the ANSI/API Std 780 methodology step by step, then has you apply it to a full case facility. Over 40 hours you will characterise assets, assess threats, analyse vulnerabilities with adversary sequence diagrams, evaluate and rank risk, and select countermeasures with benefit/cost analysis — the SRA that petroleum, petrochemical and other critical facilities rely on to justify their security design.

Course at a glance

Who this API 780 security risk assessment training is for

• Security managers and SRA team leaders
• Process safety and HSE professionals
• Consultants preparing SRAs for oil, gas and critical facilities
• Security compliance coordinators

What you will be able to do

• Plan an SRA: scope, team and data
• Characterise assets and rank consequences
• Build threat matrices and a design basis threat
• Analyse vulnerabilities with adversary sequence diagrams
• Evaluate risk and justify countermeasures with benefit/cost analysis
• Write and govern an SRA report

Course modules

13 modules, 40 hours of instruction:

1. Orientation & Baseline Assessment — Course Map, Outcomes & PDH Structure, API Standard vs API Certification, Pre-Assessment Diagnostic, Reference Set & Worksheet Pack
2. Security Risk Fundamentals — Security vs Safety vs Process Risk, Consequence × Threat × Vulnerability, Attractiveness as Likelihood Surrogate, Design Basis Threat (DBT), Deter, Detect, Delay, Respond
3. The API 780 Standard — Structure & Language — Scope, Purpose & Applicability, Standard Architecture & Annexes, Terms, Definitions & Acronyms, Relationship to CCPS SVA, ASIS RA.1, ISO 31000 & API 781, API 780 and Regulatory Requirements
4. Planning the SRA — Scope, Team & Data — Study Scope & Boundaries, Team Composition, Facilitator Role & Competency, Supporting Data Requirements, Site Interviews & Kickoff, Asset Screening
5. Step 1 — Asset Characterization — Facility Characterization, Critical Asset Identification, Hazard Identification, Security Event Definition, Consequence Analysis & Severity Ranking, Existing Countermeasure Inventory, Worksheet Exercise — Asset Register
6. Step 2 — Threat Assessment — Adversary Taxonomy, Intent × Capability Rating, Threat Intelligence Sources, Insider Threat, Target Attractiveness, Regional Threat Landscape, Worksheet Exercise — Threat Matrix & DBT
7. Step 3 — Vulnerability Assessment — Scenario Construction, Adversary Sequence Diagram (ASD), Path Analysis — Detection, Delay & Response, Physical Security Layers, Procedural Vulnerabilities, Cyber & SCADA/ICS Interface, Security Force Effectiveness, Worksheet Exercise — ASD Build
8. Step 4 — Risk Evaluation — Combining C, T, A & V, Qualitative vs Semi-Quantitative vs Quantitative, Risk Matrix Construction, Risk Tolerance Criteria, Validation & Prioritization, Common Ranking Errors, Worksheet Exercise — Risk Register
9. Step 5 — Risk Treatment — Countermeasure Selection, Engineered vs Administrative vs Security Force, Net Risk Reduction & Re-Scoring, Benefit/Cost Analysis, Response & Recovery Assessment, Residual Risk Acceptance, Worksheet Exercise — Recommendations with BCA
10. Documentation, Reporting & Governance — Forms & Worksheets Walkthrough, SRA Report Structure, Classification & Handling of SRA Outputs, Management Review & Action Tracking, Revalidation Triggers, Auditing a Third-Party SRA
11. Integration & Regulatory Context — Security & Process Safety Integration, SVA vs SRA, Regulatory Requirements in KSA, ASIS RA.1 & PAS 68, Egypt & GCC Expectations, Insurance & Due Diligence Alignment
12. Applied Workshop — Full SRA on a Case Facility — Case Brief & Data Pack, Breakout — Steps 1 & 2, Breakout — Step 3, Breakout — Steps 4 & 5, Draft SRA Report, Presentations & Critique
13. Assessment & Close — Post-Assessment Exam, Pre/Post Domain Growth Report, Workshop Grading Rubric, Certificate & PDH Record

Format and certificate

Delivered by Be Safe instructors as live online sessions or in-house at your facility, for individuals and company teams. Successful participants receive a Be Safe certificate of training completion for 40 hours, with a unique certificate ID and QR code that employers and clients can check on our certificate verification page.

The course follows the American Petroleum Institute ANSI/API Std 780 methodology; participants should use their own licensed copy of the standard.

Frequently asked questions

More courses for contractors in the Kingdom: Saudi Compliance training · all HSE training.

API® is a registered trademark of the American Petroleum Institute. This is an independent training course by Be Safe Ltd; it is not affiliated with, endorsed or sponsored by API. The certificate is a certificate of training completion, not a certification issued or endorsed by the American Petroleum Institute.