Do risk assessments need to include administrative facilities, data centers, and cash vaults?

Yes. Risk assessments should extend beyond branches to include all facilities where sensitive assets or data are stored — including administrative offices, data centers, cash vaults, and currency handling areas. These locations often receive less security attention than customer-facing branches but carry significant risk exposure.

Administrative facilities typically house sensitive personnel records, financial systems access, and network infrastructure. Data centers contain the systems that process transactions, store customer data, and run the applications the institution depends on. These are high-value targets for both physical intrusion and insider threat scenarios, yet they are often assessed less rigorously than branch locations.

Cash vaults and currency handling areas present their own specific risk profile: large concentrations of cash, controlled access requirements, and regulatory expectations around dual control and audit trails. A comprehensive risk assessment evaluates access control configurations, camera coverage, alarm zone design, and procedural controls at each facility type. CSG's risk assessment services are designed to cover the full footprint of an institution's physical presence, tailoring the assessment methodology to the specific risk profile of each facility type.