The search for "physical security risk analysis model" has exploded in recent months. It's understandable why: the document is mandatory, it sounds bureaucratic, and the natural reflex is to look for a form to fill out.
If you want a risk analysis prepared by an evaluator registered with the RNERSF or just to find out what category you are in, see the service page risk analysis in physical security Constanta: the eligibility check is free.
The problem is that risk analysis doesn't work that way. A downloaded model can show you structure, but it can't give you the content — and during an inspection, the exact contents are checked.
What is the document actually?
Physical security risk analysis establishes, for a specific site, what threats it is targeted by, how vulnerable it is to them and what protective measures are proportionate to the resulting risk. The obligation comes from Law 333/2003, in the modified form of Government Emergency Ordinance 37/2026.
A clarification that changes a lot: from May 2026, risk analysis is mandatory only for units whose methodological norms establish them minimum security requirements (art. 49)2). The others implement measures based on their own assessment, materialized in a safety data sheet (art. 49)9). If before looking for a model you are wondering whether you need the document, that is the first thing to clarify — I explained the difference in the article Risk analysis or safety data sheet?.
It is the basis for the security plan and the design of technical systems. If the analysis is wrong, everything that follows it is wrong — including the budget you approve.
Why a completed model doesn't hold
A template downloaded from the internet contains the chapter titles. It does not contain:
- the surroundings of your site and the risks they bring;
- the actual flows of people, goods and values through the building;
- the operating hours and the times when the site is vulnerable;
- the history of incidents in the area and at the facility;
- the real state of existing measures — what is installed, what is still working, what is outdated;
- the photographs and plans that support each statement.
A document without these elements is instantly recognizable: it describes a generic building. When checking, the question is not "do you have a risk analysis?", but "on what basis do you say the risk is medium?" A completed model does not have an answer to the second question.
There is another aspect, which is not about compliance, but about money: a generic analysis leads to generic measures. Either you oversize and pay for equipment you don't need, or you undersize and get caught out exactly where it counts.
Document structure, chapter by chapter
The law doesn't let you guess. MIA Instruction no. 9/2013, art. 7 para. (1) says that risk analysis is made up of three components:
- risk assessment and treatment report;
- evaluation grid specific to the object of activity;
- documents backing — questionnaires, statements and data used.
The grid and supporting documents are exactly the part that a downloaded model cannot produce: they contain the data of your site. And the report, to stand on its own, must cover:
1. Identification data. The site, the client, the evaluator and proof of his/her qualification. Without the last part, the document has no effect.
2. Description of the site. Location, neighborhoods, type of construction, partitioning, access and evacuation routes, fencing, outdoor lighting, operating hours. Here you can immediately see if the evaluator has been on the ground.
3. The activity and values exhibited. What happens in the building and what is at stake: goods, cash, data, equipment, but also people. An electronics warehouse and a clinic have completely different risk profiles, even if they have the same surface area.
4. Applicable threats. Not a copied list, but the plausible threats to that target, in that area, with that activity. Burglary, robbery, vandalism, unauthorized access, internal threat — each substantiated.
5. Vulnerabilities. What's missing and what doesn't work anymore. Areas without video coverage, doors that don't lock, access control that doesn't log, alarm system not connected to the dispatch center, procedures that no one follows.
6. Risk assessment. Probability and impact, with the method explicitly stated. This is the difference between a technical document and an opinion: if the method is not written, the result cannot be verified by anyone.
7. Proposed measures. Grouped by categories — mechanical, electronic, security, procedural — and each linked to the vulnerability it covers. A measure that does not address any identified vulnerability is usually a piece of equipment sold for nothing.
8. Conclusions. Framing the level of risk and what remains to be done.
9. Annexes. Plans, photos, evaluation sheets. The part that downloaded models can't provide at all.
Who can draw it up?
Only one physical security risk assessor registered in National Register of Physical Security Risk Assessors (RNERSF) — Instruction 9/2013, art. 8 para. (1). A document signed by someone else — by a systems installer, an uncertified consultant, or your company — does not produce legal effects, no matter how good it looks.
It's worth checking before paying: ask for the registry number and confirm it.
When should it be redone?
GEO 37/2026 rewrote the deadlines. According to art. 493 of Law 333/2003 in its current form, the analysis is revised:
- within 90 days at most from changing internal or external parameters;
- within 60 days at most from the occurrence of a relevant physical security incident;
- within 30 days at most from modifying architectural-constructive characteristics or from not implementing the established measures.
Notice what's gone: periodic review every 3 years of Instruction 9/2013 is not taken over in the text of the ordinance. Until the methodological norms are updated, the situation remains to be clarified — and the practical recommendation is to keep the three-year cycle as a good practice.
New deadlines are tied to events, not the calendar. A industrial building expansion, office re-compartmentation, or a burglary start the clock, and the shortest deadline is 30 days.
GEO 37/2026 amended Law 333 exactly in this direction: the emphasis shifts from the formal existence of the document to the real risk assessment. A five-year-old analysis, on a building that has changed in the meantime, is only compliant on paper.
Practical conclusion
A template shows you what chapters should be there — and that's where it's useful, so you know what you're getting and what to ask. But it can't save you from going into the field, because everything that gives value to the document is gathered there.
If you want to know if your site falls under the legal obligation, or if the analysis you have still describes reality, send us the data and we will tell you. See how we prepare physical security risk analysis — there is no charge for checking the classification.
