Plan vehicle-incident mitigation before buying barriers

Source facts: vehicle mitigation is a site-specific program

CISA’s April 2024 Vehicle Incident Prevention and Mitigation Security Guide addresses intentional and unintentional vehicle threats near critical infrastructure, facilities, venues, and pedestrians. It presents a Plan-Prevent-Protect framework rather than a single product prescription.

Under planning, CISA discusses risk assessment, emergency operations planning, professional security expertise, and resources for mitigation. Prevention considerations include traffic and crowd management, awareness of concerning behavior or suspicious vehicle activity, reporting, training, and layered security. Protection includes appropriately selected and installed active or passive barriers and understanding relevant perimeter-protection standards.

CISA explicitly says not every recommendation applies to every organization and there is no one-size-fits-all security solution. The guide is a starting point and does not guarantee prevention. Barrier engineering, roadway design, accessibility, emergency access, fire and building requirements, permits, utilities, drainage, snow operations, and property boundaries require qualified professionals and the applicable authorities.

DSE recommendation: define the vehicle problem in layers

Begin with a scaled site plan and observed operations. Mark public roads, curbs, slopes, medians, parking, loading, queuing, drop-off, ride-share, bus and delivery routes, emergency access, pedestrian gathering, accessible routes, building entrances, critical equipment, temporary-event changes, and land a vehicle could traverse. Include adjacent property where its geometry materially shapes an approach.

1. Describe credible scenarios without guessing intent. Consider accidental loss of control, driver error, unauthorized entry, tailgating at a gate, a vehicle entering a pedestrian space, and other scenarios selected by the organization’s risk process. Record target area, approach path, possible vehicle class and speed, exposed people or assets, and existing controls.
2. Observe normal movement. Count and watch vehicles and pedestrians during shift changes, deliveries, events, winter operations, and after hours. A control that works in an empty drawing may create queues, unsafe crossings, or bypass behavior in service.
3. Reduce opportunity operationally. Evaluate routing, scheduling, delivery control, parking placement, traffic calming, staffed entry, credential and visitor processes, lighting, signs, reporting, and temporary-event procedures before assuming a fixed barrier is the only layer.
4. Define detection and response. Assign camera views, intercoms, gate events, duress or alarm procedures, lighting, staff observation, and responder communication to specific zones. Test whether an operator can understand location and direction quickly enough to take the approved action.
5. Engineer physical protection. When the assessment supports a barrier, provide the qualified designer with the approach geometry, desired protection objective, site constraints, operations, utilities, drainage, accessibility, emergency access, maintenance, and evidence needed for selection and installation. Do not infer performance from appearance or an unlabeled product.
6. Plan the degraded day. Define safe operation during gate failure, power loss, snow, construction, a damaged barrier, a blocked lane, a large event, or emergency response. Temporary measures need the same ownership and review as permanent ones.

Acceptance should cover more than the barrier. Walk and drive the approved routes; verify signs, lane assignments, credentials, intercom and guard views, gate sequencing, pedestrian separation, lighting, camera evidence, communications, emergency access, and the procedure for a suspicious or disabled vehicle. Do not perform impact testing on an installed site unless it is part of a professionally controlled program.

Maintain a register of assumptions, drawings, product and installation evidence, inspections, repairs, exercises, incidents, near misses, operational exceptions, and responsible owners. Reassess after a roadway or parking change, new tenant or event use, construction, landscaping, barrier strike, delivery-pattern change, or significant incident. The strongest result is a layered site that manages ordinary traffic safely while reducing plausible vehicle opportunities—not an isolated row of hardware with no operating plan.

Review the completed plan with operations, facilities, security, accessibility stakeholders, and emergency-response partners whose work or access it changes.

Official references

• Cybersecurity and Infrastructure Security Agency, Vehicle Incident Prevention and Mitigation Security Guide, April 23, 2024.
• CISA, full guide (PDF), April 2024.