Which action would NOT be part of a proper ISPS security compliance program?

• A. Verifying that the facility's security plan aligns with ISPS objectives
• B. Implementing access control measures
• C. Establishing incident reporting and response protocols
• D. Conducting unstructured random checks of staff without policy reference

Answer: (D)

ISPS security compliance is built on a documented, risk-based set of procedures that connect the facility’s security plan to ISPS objectives, put in place controlled access to prevent unauthorized entry, and define how incidents are reported and handled. Conducting unstructured random checks of staff without policy reference undermines that framework. Without a policy-driven basis, such checks would be arbitrary, hard to justify, and could violate privacy or labor rules, and they wouldn’t provide verifiable evidence of compliance. The other actions fit naturally: ensuring the security plan aligns with ISPS objectives ensures coherence with the required standards; implementing access control measures helps prevent unauthorized access; and establishing incident reporting and response protocols provides a clear, practiced way to handle security events.