SOP for Planning a Red Teaming Exercise

Objective

This SOP is intended for security personnel/owners/management to plan a

red teaming exercise. Through the exercise, the issues or problems faced
during addressed with solutions drawn up to ensure that all efforts towards
preparation and readiness for the emergency will be well co-ordinated and
workable.

Type of Exercises

• Tabletop Exercise
• Drills

• Functional Exercise

• Full-Scale Co-Ordinated Exercise

Record Red Teaming Exercise in the Report format provided.

Guideline for the different type of exercise and Execution of exercise (red
teamer’s approach

1) Access control

SITE REQUIREMENTS:

1. School premises
2. Walkie Talkies
3. Line Telephones
4. Visitor / Contractor / Vehicle Passes
5. Visitor / Contractor / Vehicle Register Books

Manpower (Role Players):

1. Two SOs (A) & (B)

2. School OM

1
SCENARIO

ACTOR ARRIVES AT THE MAIN GATE AND ATTEMPTED TO ENTER THE

PREMISES BY SNEAKING IN FROM THE SIDE OF THE MAIN GATE,
OPPOSITE THE GUARD HOUSE, WITHOUT STOPPING FOR SECURITY
CHECKS

Role Player to demonstrate:

• Procedures for person trespassing into Premise

[EXERCISE CUT IF ROLE PLAYERS FAIL TO DETECT ACTOR ENTERING

PREMISE WITHOUT STOPPING]

• Stop any person who attempts to trespass on the premises.

o Verbally.
o Physically.
• Warn the person verbally that he/ she would have committed a criminal
offence by trespassing.

ACTOR IGNORES THE WARNING AND BARGED HIS WAY IN

• Role Player to demonstrate:

• Inform OM immediately
• Providing description of the trespasser (Gender/Race/Age/Height/Attire
etc)
• Carry out instructions by OM

[EXERCISE CUT] to stop the exercise

2) Suspicious items

SITE REQUIREMENTS:

1. A meeting room with seating capacity for at least 5 persons

2. Walkie Talkies
3. Line Telephones
4. Occurrence Book

Manpower (Role Players):

1. One Security Supervisor (Control Room In-charge)

2. Two SOs (A) & (B)

WHILE YOU ARE ON PATROL, YOU NOTICED A PERSON LOITERING AND

BEHAVING SUSPICIOUSLY AT THE LOADING UNLOADING BAY. HE WAS
CARRYING A BAG WITH HIM. WHAT ARE THE APPROPRIATE ACTION
TO TAKE?

2
Questions need to be answered / points that could be covered in the
discussion of inject 1 include:

• What are the guidelines for handling a suspicious person?

• What are the facts to report to Control? (Demonstration)
• What would Control do upon receiving the message? (Demonstration)
• How to approach suspicious person in a cautious manner including
checking of his bag? (Demonstration)

UPON BEING QUESTIONED, THE SUSPICIOUS PERSON WAS UNABLE

TO PROVIDE A SATISFACTORY ANSWER. YOU NOTICED THAT THE BAG
WHICH HE WAS HOLDING SMELT OF UNUSUAL ODOUR. BEFORE YOU
COULD CHECK FURTHER, HE DROPPED THE BAG AND RAN AWAY
FROM THE SCENE. WHAT ARE THE APPROPRIATE ACTION TO TAKE?

Questions need to be answered / points that could be covered in the

discussion of inject 2 include:

• Describe the procedures when suspicious parcels or objects are found

• What are the facts to report to Control? (Demonstration)
• What would Control do upon receiving the message? (Demonstration)
• What do you do / do not do to the bag?
• What would you do before arriving of the Authorities?
(Cordoning/evacuation/preservation of scene)

WHEN POLICE ARRIVES, WHAT SHOULD YOU DO?

Questions need to be answered / points that could be covered in the

discussion of inject 3 include:

• What are the facts to report to Police? (Demonstration)

• What would you do when Police directed a full scale of evacuation from
the building? (Demonstration)
• What would you do when Police leave the scene upon completion of
investigations.

[EXERCISE CUT] to stop the exercise

3
Exercise safety

Electrical and Equipment

Electrical and equipment to be utilized or temporarily deployed for the

exercise should be documented for safety, compliance and maintenance
checks prior to the start of the exercise.

Use of Items deemed to be a Weapon

The use of these items shall follow strictly to the Singapore Laws. Both real
device and dummy shall be properly marked, label, kept separately and keep
under lock and key.

Access to Exercise Area

Access Control

Security officers or gantry shall be deployed on site if access control is

required for the exercise area. Any trespass to some exercise areas by an
unauthorized person may create confusions and uncalled for injects that may
disrupt the exercise. Participants should report to the Exercise Command
Centre (EXCmd) if there is any unauthorized person on site. Invited VVIPs /
Guests / Media

An authorized representative from the exercise organizer shall be assigned to

coordinate and accompany the VVIPs / Guests / Media attending the event at
all times. Participants should be pre-amp of the presence of such invited
persons. The VVIPs / Guests / Media should be confined to designated areas
and an exercise representative shall be assigned to explain the exercise
details and for Q&A.

Identification of Participants

In view of the mass participation of simulated exercises, participants may be

required to put on security pass, vests, hats or uniform for some affiliated
groups, to identify their roles in the simulation.

4
Pass Identification of Participants

Roles Colour

Assessors Red

Role-Players Black

Support Staff Grey

Observers/VIPs Orange

Contingency plan for a real incident occurring during exercise

Safety in all aspects of the exercise takes priority over the exercise events.
The following safety rules shall apply:

• A Controller shall be assigned as a SAFETY CONTROLLER. He is

responsible for the safety of all participants. Any observation that
contravenes safety shall be reported to the Chief Controller and
Exercise Director. The Exercise Director shall have full authority to
dictate whether to terminate or continue an exercise if a real-time
incident warrants such a decision.
• Should there be an emergency that warrants any assistance, shout the
word “NO DUFF! NO DUFF! NO DUFF!” at least 3 times to gather
attention.
The following procedures should be used in case of a real emergency during
the exercise:

• Someone is seriously ill or injured

• Notify controller, render first aid and call for the ambulance
• No Duff! No Duff! No Duff!
• Fire Evacuation Incident
• Execute the standard fire evacuation procedures in accordance with
the stipulated SOP listed in the organization.
• Activation of Emergency Ambulance Service
• The exercise organiser shall assign a person in charge to work with the
commercial ambulance or nearest hospital in the event of a real-world
emergency.

5
Exercise evaluation (AAR)

Debriefings

The aim of post-exercise debriefs is to collect sufficient data and observation

noted to support effective assessment and enhance future planning.

After Action Review (AAR)

AAR is designed to summarise key information related to assessment. It

provides basic exercise information and also focuses on an analysis of core
capabilities such as capability performance, strengths and areas for
improvement.

Process Improvement Plan (PIP)

PIP is indeed a process whereby all the observations reported in the AAR are
consolidated and rectify through various corrective actions. These are usually
prioritized and tracked as a corrective action program at the higher
management level.

After Action Meeting (AAM)

This is a high-level interactive meeting held among decision and policymakers

from the stakeholders, and key personnel from the Assessors and Exercise
Organising Team. The purpose is to allow all meeting attendees to discuss,
validate observations, debrief the exercise in order to review and refine the
draft AAR and PIP.

6
Exercise Assessment Guides
Core Competency Competency Critical Tasks Performance
Target(s) Ratings

7
End of Document

-This page is deliberately left blank-