{"text_format":"3","workbook":"xlsx","n_sheets":9,"sheets":["Section 1.Production SITE","Section2-Track Record-Staffing","Section3-Technology_Sample","Section4-Process_Methodology","Summary - Functional","Phase4 Sec1 - Site inspection","Phase4 Sec2 - Staffing_Security","Phase4 Sec3- Product and Oper","Summary - Site inspection"],"not_rendered":{"defined_names":2},"read":"whole","date_system":"1900"}

{"sheet":"Section 1.Production SITE","index":0,"n_rows":16,"n_cols":8,"rows_kept":16}
["PHASE 3 FUNCTIONALITY CRITERIA"]
["Section 1: Production Site – Governance and documentation (Weight: 20 points)"]
["No.","Sub-criterion","Description","Key Requirments","Score","Max score","Weight","Weighted score"]
[1.1,"Facility security plan","A Facility Security Plan outlines how the printing site protects its people, assets, information, and secure materials. It serves as the master document governing overall site security","1. Description of facility layout, including restricted zones and critical process areas.\n2. Identification of security vulnerabilities, threats, and risk mitigation measures.\n3. Physical barriers and protections (fencing, gates, lighting, intrusion detection).\n4. Roles and responsibilities for security personnel and management.\n5. Emergency procedures (evacuation, fire, incident response).\n6. Procedures for protecting secure materials (paper, inks, plates, finished products).\n7. Review and update schedule (typically annually or after significant changes).",7,7,5,{"$f":"E4/F4*G4","v":{"v":5,"d":"5.00000"}}]
[1.2,"Access control policy","Defines how individuals gain authorised entry to the facility, specific production zones, and sensitive information systems. Ensures that only vetted and authorised personnel can access secure areas.","1. Clear access rules for employee, contractor, and visitors\n2. Role based access to zones (e.g., pre press, vaults, production floors).\n3. Procedures for issuing, maintaining, and revoking access credentials (cards, biometrics).\n4. Multi factor authentication for high security areas.\n5. Access logs and automated monitoring of entry/exit points.\n6. Tailgating prevention controls.\n7. Lost/stolen access card response procedures.\n8. Regular review of access rights and access logs.",8,8,5,{"$f":"E5/F5*G5","v":{"v":5,"d":"5.00000"}}]
[1.3,"Security policy framework (physical, logical (software-based safeguards), personnel, production security).","A set of formal documents outlining how security is managed throughout the printing organisation.","1. A approved comprehensive Security Policy.\n2. Policies must include physical, logical, production, and information security policies.\n3. Regular policy reviews (annually or after major changes).\n4. Clearly assigned roles and responsibilities.",4,4,5,{"v":5,"d":"5.00000"}]
[1.4,"CCTV policy, retention period documentation, monitoring SOPs.","A CCTV policy defines how video surveillance is used to monitor secure operations, prevent unauthorized activities, and support investigations. It ensures responsible use of recorded data.","1. Complete list of camera locations covering the following: Perimeter; Access control points; Pre press, printing, and finishing areas; Vaults and material storage\n2. Technical specifications (resolution, night vision, frame rate).\n3. Recording retention period (commonly 30–90 days, aligned with local laws).\n4. Secure storage of video footage with restricted access.\n5. Monitoring SOPs: \tWho monitors and when; How incidents are flagged and escalated; Procedure for video retrieval for investigations\n6. Maintenance and testing schedule for cameras and Network Video Recording (NVR) systems.\n7. POPIA compliance regarding handling of personal data in footage.",7,7,5,{"v":5,"d":"5.00000"}]
[1.5,"Visitor management policy.","Controls how external visitors access, move through, and exit the facility to prevent security breaches, tampering, or exposure of sensitive materials or processes.","1. Regiatration and access approval process for visitors.\n2. Valid identification required upon entry.\n3. Visitor registration log (name, ID number, company, reason for visit, escort name).\n4. Issuing of visitor badges/cards.\n5. Visitors must be escorted at all times in restricted or production areas.\n6. Prohibited items policy (cameras, phones, recording devices).\n7. Confidentiality acknowledgement or visitor  Non-Disclosure Agreement (NDA) where applicable.\n8. Procedures for contractors performing work onsite.\n9. Exit procedure and return of badges.\n10. Regular audits of visitor logs.",10,10,5,{"v":5,"d":"5.00000"}]
[1.6,"Business Continuity & Disaster Recovery Plans","Plans to ensure secure printing operations can continue or recover after disruptions.","1. Documented Business Continuity Plan (BCP).\n2. Disaster Recovery (DR) procedures for critical systems.\n3. Evidence of testing (drills, simulations).\n4. Updated contact lists and alternative arrangements",4,4,5,{"v":5,"d":"5.00000"}]
[1.7,"Organisational structure and roles (including segregation of duties).","Clear documentation showing reporting lines and segregation of duties to prevent conflicts of interest.","1. Updated organisational chart.\n2. Job descriptions for all key roles (production, security, QA, IT).\n3. Segregation of duties for: material handling; access control; plate/cylinder production ; \treconciliation tasks",3,3,5,{"v":5,"d":"5.00000"}]
[1.8,"Risk assessments and mitigation plans.","A systematic process to identify, analyse, and mitigate risks related to materials, equipment, processes, and personnel.","1. Documented risk assessments or register covering: material theft/fraud; process failures; information breaches; insider threats\n2. Mitigation plans with owners and deadlines.\n3. Evidence of risk reviews after incidents or changes.",3,3,5,{"v":5,"d":"5.00000"}]
[1.9,"Incident reporting and escalation procedures.","A formal process for reporting, recording, investigating, and resolving incidens such as security events.","1. Incident reporting forms and registers.\n2. Escalation paths for high risk incidents.\n3. Root cause analysis and corrective actions.\n4. Integration with risk management updates.",4,4,5,{"v":5,"d":"5.00000"}]
[1.1,"Document Control System and Standard Operating Procedures (SOPs)","A management system that ensures controlled creation, approval, distribution, storage, and revision of documents. Documented, controlled procedures that define how secure printing processes are carried out.","1. Document register with version numbers.\n2. Clear authorisation/approval workflows.\n3. Controlled access to secure documents.\n4. Archiving and retention schedule.\n5. SOPs for every security sensitive activity such as: material issuing & reconciliation; printing processes; waste handling; plate management; transport & dispatch\n6, Version control with revision history.\n7, SOPs accessible only to authorised staff.",7,7,5,{"v":5,"d":"5.00000"}]
[{"v":1.11,"d":"1.1"},"Information Security & Data Protection Documentation","Policies and procedures ensuring protection of digital assets, design files, and personal data.","1. Access control procedures (passwords, multi factor authentication).\n2. Network segmentation diagrams.\n3. Data backup, retention, and disposal policies.\n4. POPIA/Data privacy compliance documentation.",4,4,5,{"v":5,"d":"5.00000"}]
[{"$nulls":6},{"$f":"SUM(G4:G14)","v":55},{"$f":"SUM(H4:H14)","v":55}]
[{"$nulls":4},"Weighted",20,"Weighted score",{"$f":"H15/G15*F16","v":20}]

{"sheet":"Section2-Track Record-Staffing","index":1,"n_rows":12,"n_cols":8,"rows_kept":12}
["PHASE 3 FUNCTIONALITY CRITERIA"]
["Section 2: Track record and Staffing (Weight: 20 points)"]
["No","Sub-criterion","Description","Requiremebts","Score","Max score","Weight","Weighted score"]
[2.1,"Written hiring and Vetting procedures: Background checks, re-screening cadence","Formal procedures defining how employees are recruited, screened, and approved to work in security sensitive printing environments. These procedures help prevent insider threats and ensure trustworthy personnel handle secure materials.","1. Documented recruitment process including verification of qualifications and employment history.\n2. Mandatory background checks such as: Criminal record checks; Identity verification; Reference checks; \tCredit checks (for high risk positions)\n3. Re screening cadence (e.g., annually or every 2–3 years depending on role risk).\n4. Role based vetting levels for example: Pre press operators; Security ink handlers; Vault officers; QC/Inspection teams\n5. Documentation stored securely with restricted access.",5,5,10,{"$f":"E4/F4*G4","v":{"v":10,"d":"10.00000"}}]
[2.2,"Security Training documentation; Induction, refresher, role-based materials & records","Training records and materials ensuring personnel understand security procedures, risks, and responsibilities when handling secure materials and equipment.","1. Security induction programme must cover physical security, information security and confidentiality.\n2. Schedule for Refresher training(e.g., annual or semi annual).\n3. Role/Job specific training for high security tasks such as: Material reconciliation; Secure waste handling; Plate/cylinder production; Operating security features equipment;\n4. Training materials and version controlled.\n5. Attendance records, competency assessments, and sign off sheets.\n6. Secure storage of training records for audit purposes.",6,6,5,{"$f":"E5/F5*G5","v":{"v":5,"d":"5.00000"}}]
[2.3,"Templates for Non-Disclosure Agreement (NDAs) and confidentiality agreements.","Standardised legal documents ensuring employees, contractors, and visitors understand and formally commit to protecting confidential processes, materials, and intellectual property.","1. Approved NDA and confidentiality agreement templates.\n2. Signed NDAs required for: All employees; Contractors and maintenance personnel; Visitors entering restricted areas\n3. Agreements must cover:  Protection of sensitive information; Handling of security features and proprietary materials; Post employment confidentiality obligations\n4. Secure storage and tracking of all signed NDAs.\n5. Periodic review to ensure compliance with privacy and security laws (e.g., POPIA).",5,5,5,{"v":5,"d":"5.00000"}]
[2.4,"Training & Competency Records","Documentation demonstrating that employees are trained and competent in secure printing operations.","1. Training matrix\n2. Induction records for new employees.\n3. Refresher training for security, safety, and quality.",3,3,5,{"v":5,"d":"5.00000"}]
[2.5,"Staff with 2 years or more experience with relevant training. Provide a list of employees indicating the above-mentioned requirements.  ","• Documentation that shows the names of staff members who have the required work experience (number of years) and have relevant training ( specify the training received).","1. The list of staff members with a minimum of  2 years of experience with relevant training.\n2. More than 50% of staff members with a minumum of 2 years or more experience.",2,2,5,{"v":5,"d":"5.00000"}]
[2.6,"Staff being vetted for security printing as indicted above. Provide a list of employees","• Documentation or the list that shows the names of staff members who have undergone vetting and the date of vetting.  ","1. Documentation or the list that shows the names of staff members who have undergone vetting and the date of vetting.  \n2. 100% of staff being vetted",2,2,5,{"v":5,"d":"5.00000"}]
[2.7,"Company Track Record (Integrity & Compliance History). Provide 4 reference letters.                                 ","Documentation demonstrating the organisation’s historical performance regarding security, compliance, quality, and reliability in producing secure printed products.","1. Record of past audits, certifications, and compliance checks (ISO 14298, ISO 9001, customer audits).\n2. History of: Security incidents and resolutions\n3. History of: Non conformances and corrective actions\n4. History of: Customer complaints/compliments and how they were addressed\n5. Documentation of production quality performance, e.g.: Defect rates; Delivery reliability; Rework statistics\n6. Evidence of long term relationships with reputable clients (government, exam bodies, banks).\n7. Demonstrated zero tolerance approach to fraud, tampering, and data lapses.\n8. Annual management reviews summarising: Security performance; Operational risks; Continuous improvement actions",8,8,15,{"v":15,"d":"15.00000"}]
[{"$nulls":6},{"$f":"SUM(G4:G10)","v":50},{"$f":"SUM(H4:H10)","v":{"v":50,"d":"50.00000"}}]
[{"$nulls":4},"Weighted",20,"Weighted score",{"$f":"H11/G11*F12","v":{"v":20,"d":"20.00000"}}]

{"sheet":"Section3-Technology_Sample","index":2,"n_rows":21,"n_cols":8,"rows_kept":21}
["PHASE 3 FUNCTIONALITY CRITERIA"]
["Section 3: Technology and Equipment and Sample Certificate (Weight: 40 points)"]
["No.","Sub-criterion","Description","Requirements","Score","Max score","Weight","Weighted score"]
[3.1,"Sample certificate"]
["3,1,1","Watermark","Watermarks: Subtle designs visible when held up to the light.","Subtle designs visible when held up to the light.",1,1,5,{"$f":"E5/F5*G5","v":5}]
["3,1,2","Security Inks","Security Inks: Inks that react under specific lighting conditions (e.g., UV fluorescent inks).","Inks that react under specific lighting conditions (e.g., UV fluorescent inks).",1,1,5,{"$f":"E6/F6*G6","v":5}]
["3,1,3","Holographic Foils","Holographic Foils: Multi-dimensional images that are difficult to replicate.","Multi-dimensional images that are difficult to replicate.",1,1,5,5]
["3,1,4","Microprinting","Microprinting: Extremely small text that is difficult to copy.","Extremely small text that is difficult to copy.",1,1,5,5]
["3,1,5","Technological Integration","Technological Integration: Features like secure QR codes or barcodes that link to digital verification systems.","Features like secure QR codes or barcodes that link to digital verification systems.",1,1,5,5]
[null,"Techology and Equipment"]
[3.2,"Pre‑Press Technology","Technology used to design, process, and prepare secure artwork, plates, and digital masters in a controlled and protected environment.","1. Description/evidence of secure design workstations with restricted access and encrypted storage.\n2. Specialist secure graphics software for guilloches, microtext, fine-line patterns, and anti-copy features.\n3. Controlled Raster Image Processor (RIP) systems with audit logs.\n4. Locked-down plate/cylinder imaging systems (CtP / CtCylinder).\n5. Secure storage and tracking of plates, cylinders, and digital designs.\n6. No external connectivity or removable storage without authorisation.",6,6,5,5]
[3.3,"High Security Printing Press Technology","Presses and printing technologies capable of producing overt, covert, and forensic security features required in secure documents.","1. Configurations for intaglio, offset, flexo, letterpress/numbering, screen, or gravure (depending on the secure product).\n2. Access-controlled machine interfaces (HMI/PLC) with role-based profiles.\n3. Automated register and quality control systems, including live monitoring cameras or inline inspection systems.\n4. Secure ink management and controlled press-side make ready.\n5. Capabilities for speciality inks (UV, IR, magnetic, OVI/tactile).\n\n",5,5,5,5]
[3.4,"Security Ink & Consumables Technology","Specialised materials and handling systems ensuring the integrity of inks, foils, holograms, and other security consumables.","1. Secure ink vaults with restricted access (biometric/card).\n2. Controlled dispensing and consumption tracking.\n3. Approved portfolio of secure inks (UV/IR/magnetic/photo chromic/thermo chromic/OVI/taggant).\n4. Traceable receipt, storage, issue, and reconciliation of inks and foils.\n5. Secure hologram/optical variable device (OVD) application units.\n6. Specifications for environmental controls (temperature/humidity) where required.",6,6,5,5]
[3.5,"Substrate Handling & Material Control Technology","Systems ensuring proper tracking, inspection, and secure storage of paper, polymer, or other secure substrates.","1. RFID/barcode-enabled tracking of substrate movement from receiving to printing to vault.\n2. Verification tools for watermarks, threads, fibres, thickness, opacity.\n3. Controlled access to substrate storage cages/vaults.\n4. Automated sheet/roll counting and reconciliation systems.\n5. Environmental monitoring for substrate-sensitive materials.",5,5,5,5]
[3.6,"Post‑Press / Finishing Technology","Equipment used to apply serialisation, laminates, holograms, coatings, and final finishing operations under secure control.","1. Numbering systems (inkjet/letterpress) with tamper-proof serialisation control.\n2. Lamination, hot-stamping, foil-transfer units with security monitoring.\n3. Precision cutting, slitting, perforation, and binding equipment.\n4. Systems for tracking rejects, reworks, and spoilage during finishing.\n5. Secure packaging and sealing systems for finished goods.",5,5,5,5]
[3.7,"Security Feature Integration Technologies","Advanced machinery used to embed, encode, or personalise security features that require precision and controlled access.","1. Laser engraving/personalisation systems for tactile features or MRZ/CLI/MLI elements.\n2. Systems for secure QR/DataMatrix code generation with cryptographic protection.\n3. Machine-readable feature application: RFID inlays, magnetic stripes, RFID chip initialisation (for IDs/passports).\n4. Tamper-proof access to personalisation parameters and software.\n5. Real-time quality verification of applied security features.",5,5,5,5]
[3.8,"Quality Control & Authentication Technology","Inspection tools and systems used to ensure printed products meet strict security and quality requirements.","1. 100% inline inspection systems with defect detection and reject tracking.\n2. UV/IR inspection stations, microscopes, spectrophotometers, magnetic sensors.\n3. Taggant detection devices for covert forensic features.\n4. SPC (Statistical Process Control) software for data analysis and trend monitoring.\n5. Calibration and verification logs for all QC equipment.",5,5,5,5]
[3.9,"Information Technology & System Security ","IT systems, networks, and controls protecting digital assets, production systems, and sensitive customer data.","1. Segregated networks for design, production, and administrative environments.\n2. Firewalls, endpoint protection, and intrusion detection.\n3. Role-based access control (RBAC) for production systems.\n4. Encrypted storage of digital masters and job data.\n5. Backup, disaster recovery (DR), and business continuity (BCP) systems.",5,5,5,5]
[{"v":3.1,"d":"3.10"},"Waste Destruction & Tracking Technology","Systems ensuring that defective, unused, or spoilage materials are securely destroyed and fully traceable.","1. Cross cut shredders, pulpers, or incinerators suitable for security grade destruction.\n2. Sealed waste bins with chain-of-custody records.\n3.RFID/barcode tracking of waste removal from machines to destruction point.\n4. Destruction logs signed by authorised personnel.\n5. CCTV oversight of destruction areas.",5,5,5,5]
[{"$nulls":6},{"$f":"SUM(G5:G19)","v":70},{"$f":"SUM(H5:H19)","v":{"v":70,"d":"70.00000"}}]
[{"$nulls":4},"Weighted",40,"Weighted score",{"$f":"H20/G20*F21","v":{"v":40,"d":"40.00000"}}]

{"sheet":"Section4-Process_Methodology","index":3,"n_rows":12,"n_cols":8,"rows_kept":12}
["PHASE 3 FUNCTIONALITY CRITERIA"]
["Section 4: Process and Methodology (Weight: 20 points)"]
["No.","Sub-criterion","Description","Requirements","Score","Max score","Weight","Weighted score"]
[4.1,"Project Execution Methodology","Structured, end to end approach covering intake, risk assessment, pre press, production, personalization/serialization, QC, packing, dispatch, and controlled closure.","1. Governance: RACI, escalation paths, change control (with risk impact and approvals).\n2. Phasing: Stage gates (Design Freeze → Pre Prod → Pilot/Lot 0 → Full Prod).\n3. Risk & Security: Threat model, segregation of duties, dual control for critical steps.\n4. Documentation: Version controlled SOPs/work instructions; audit trail for all decisions.\n5. KPIs: Yield, defect rates, reconciliation accuracy, on time delivery, incident MTTR.",5,5,5,{"$f":"E4/F4*G4","v":5}]
[4.2,"Delivery Capacity and Turnaround Time  ","Demonstrated ability to meet volumes and SLAs under normal and surge conditions.","1. Capacity Plan: Rated throughput by press/line/shift; OEE baselines; surge plan.\n2. SLA Matrix: Lead times per product/lot size; cut off times; expedited paths.\n3. Redundancy: Backup presses, critical spares, alternative suppliers, DR plan.\n4. Proof: Historical performance (run charts) and load testing or pilot data.\n5. Comms: Proactive delay notifications and recovery actions.",5,5,5,{"$f":"E5/F5*G5","v":5}]
[4.3,"Material control procedures (substrates, inks, holograms, plates).","Tight chain of custody for all value bearing and security sensitive materials.","1. Receipt & Verification: Two person receipt, COA/COC checks, batch/serial capture.\n2. Storage: Restricted area, CCTV, access logs, environmental controls.\n3. Issue/Return: Logged issuance by job/lot; daily counts; sealed returns.\n4. In Process Controls: WIP locks, tamper evident containers, interim counts.\n5. Traceability: End to end linkage from PO → receipt → job → reconciliation → destruction.",5,5,5,5]
[4.4,"Reconciliation logs template(s). Daily/end-of-job reconciliation forms","Standardized logs reconciling all inputs, outputs, and variances per job/shift. Formal closure documents ensuring zero unexplained variances.","1. Fields: Job ID; date/shift; material type & batch; start balance; issued; good output; waste (by category); returns; end balance; variance; explanation; dual sign off.\n2. Controls: Sequentially numbered pages; no blanks; corrections line through + initials.\n3. Frequency: At each material movement and at shift end; retained per retention policy.\n4. Aggregation: Sum all shift logs; verify against MRP/ERP and finished goods.\n5. Variance Handling: Root cause, corrective action, approval by supervisor + QA.\n6. Sign off: Operator, Supervisor, QA; date/time; unique form ID; archive policy.",6,6,5,5]
[4.5,"Waste destruction procedures.  Witnessed destruction, records","Irreversible destruction of waste, set up sheets, test runs, misprints, plates, and defective security foils—under dual control and surveillance.","1. Trigger & Timing: Defined thresholds; daily or immediate for high risk waste.\n2. Method: Approved methods (cross cut shredding to defined particle size, pulping, incineration, plate defacing).\n3. Chain of Custody: Sealed, logged containers; transfer logs; dual custody.\n4. Witnessing: Two authorized staff (e.g., Ops + QA/Client); CCTV; photos where allowed.\n5. Records: Date/time; waste type/qty; method; signatures; exceptions noted.",4,4,5,5]
[4.6,"Job ticketing templates and batch control forms.","Job packets and batch documents that drive consistent execution and traceability.","1. Job Ticket Fields: Job/PO; version/rev; artwork hash; security features list; substrates/inks/holograms batches; serialization range; QC checkpoints; packing/labeling; special handling; sign off points.\n2. Batch Control: Unique batch IDs tied to serialization ranges and material lots; start/stop times; yields; hold reasons; movement history.\n3. Controls: Barcode/QR on documents; page counts; controlled copies; digital twin in MES/ERP.",3,3,5,5]
[4.7,"Pre‑press access rules and digital workflow documentation.","Strict control and auditability of digital assets (artwork, VDP, number ranges) and RIP/workflow systems.","1. Access Control: Least privilege; MFA; named accounts; no shared logins; time bound access for vendors.\n2. Asset Protection: Encrypted storage; checksum/hashes for artwork; version control; watermarking where applicable.\n3. Secure Workflow: Approved file formats; preflight checks; proofing/approval trail; RIP settings locked & logged; secure hot folders with permissions.\n4. Data Handling: Secure import of variable data/serials (checksum validation); test data separation; purge schedules; DLP for egress control.\n5. Monitoring: Full audit logs (view, edit, export, RIP, delete); CCTV in pre press; change control for color profiles, screens, plates.\n6. Disaster Recovery: Backup/restore tests; offsite/immutable backups; RTO/RPO defined.",6,6,5,5]
[{"$nulls":6},{"$f":"SUM(G4:G10)","v":35},{"$f":"SUM(H4:H10)","v":35}]
[{"$nulls":4},"Weighted",20,"Weighted score",{"$f":"H11/G11*F12","v":{"v":20,"d":"20.00000"}}]

{"sheet":"Summary - Functional","index":4,"n_rows":10,"n_cols":3,"rows_kept":10}
["PHASE 3 FUNCTIONALITY CRITERIA - Summary"]
["Overall Summary (Max 100 points)"]
["Category","Weight","Score (points)"]
["Section 1.Production SITE",20,{"$f":"'Section 1.Production SITE'!H16","v":{"v":20,"d":"20.00"}}]
["Section2-Track Record-Staffing",20,{"$f":"'Section2-Track Record-Staffing'!H12","v":{"v":20,"d":"20.00"}}]
["Section3-Technology_Sample",40,{"$f":"'Section3-Technology_Sample'!H21","v":{"v":40,"d":"40.00"}}]
["Section4-Process_Methodology",20,{"$f":"'Section4-Process_Methodology'!H12","v":{"v":20,"d":"20.00"}}]
[null,"Total Score:",{"$f":"SUM(C4:C7)","v":{"v":100,"d":"100.00"}}]
[]
[null,"Rating:",{"$f":"IF(C8>=85,\"Excellent / High-security facility\",IF(C8>=70,\"Strong / Meets most requirements\",IF(C8>=55,\"Acceptable but improvements needed\",IF(C8>=40,\"Weak controls / Security risk\",\"Critical / Unacceptable risk\"))))","v":"Excellent / High-security facility"}]

{"sheet":"Phase4 Sec1 - Site inspection","index":5,"n_rows":12,"n_cols":8,"rows_kept":12}
["PHASE 4 SITE INSPECTION"]
["Section 1: Production site - Governance and policy implementation (Weight: 30 points)"]
["No.","Sub-criterion","Description","Requirements","Score","Max score","Weight","Weighted score"]
[1.1,"Verify Perimeter condition (fences, gates, barriers).  Secure premises","The physical perimeter must prevent unauthorized access and must comply with the site's formal security policy. Infrastructure should demonstrate active maintenance and tamper resistance.","1. Continuous fencing of appropriate height and strength; no visible breaches or weak points.\n2. Controlled vehicle and pedestrian entry points; gates locked and monitored.\n3. Barriers, bollards, or anti ram defenses at critical entrances.\n4. Clear signage (restricted area notices, controlled zone marking).\n5. Perimeter lighting operational; no dark spots.\n6. Records of maintenance, inspections, and perimeter incident reports.",6,6,5,{"$f":"E4/F4*G4","v":{"v":5,"d":"5.00000"}}]
[1.2,"Access control: badge/biometric verification in practice. Check real-time access control operations","Entry and movement must be restricted to authorized personnel using controlled authentication systems. Procedures must align with the site’s access control policy.","1. Functioning badge readers, turnstiles, and/or biometric devices.\n2. Real time verification observed (no tailgating, proper card use).\n3. Live access logs monitored from the control room.\n4. Access rights matched to job roles; periodic reviews documented.\n5. Anti passback rules enforced, if defined in policy.\n6. Alarms triggered for unauthorized attempts and recorded.\n",6,6,5,{"$f":"E5/F5*G5","v":{"v":5,"d":"5.00000"}}]
[1.3,"Security guard presence, procedures, incident logs.","Trained guards must enforce security rules and maintain vigilance consistent with documented site procedures.","1. Guard posts staffed according to the duty roster.\n2. Guards verify IDs, challenge unknown persons, and conduct patrols.\n3. Observation of guard behavior consistent with SOPs (patrol frequency, bag checks, escort adherence).\n4. Up to date incident logs: entries for alarms, attempted breaches, visitor issues, or irregularities.\n5. Communication tools working (radios, panic buttons).\n6. Evidence of guard training and refresher sessions.",5,5,5,{"v":5,"d":"5.00000"}]
[1.4,"CCTV coverage in sensitive zones; check working status. Review CCTV coverage & functionality","CCTV must provide full coverage of secure production, pre press, material storage, and dispatch zones. Systems must support monitoring, recording, and review.","1. Cameras operational with no blind spots in secure/material handling areas.\n2. Live monitoring observed in the security control room.\n3. Recording retention meeting policy requirements (e.g., 30/90 days).\n4. Export capability tested/available for investigations.\n5. Maintenance logs for camera inspections and fault resolution.\n6. Time stamps synchronized across all devices.",6,6,5,{"v":5,"d":"5.00000"}]
[1.5,"Alarm systems, intrusion detection, response processes.","Electronic alarms must detect unauthorized entry and trigger documented response actions.","1. Door, window, motion, and vibration sensors operational in restricted zones.\n2. Alarm tests performed periodically with documented results.\n3. Immediate notification to guards/control room upon activation.\n4. Clear response procedures: dispatch, verification, escalation, reporting.\n5. Integration with CCTV for event correlation, if applicable.\n6. Maintenance/service logs up to date.",6,6,5,{"v":5,"d":"5.00000"}]
[1.6,"Visitor escorting and ID checks observed.","Visitor control procedures must ensure no unsupervised movement within secure printing zones.","1. Visitor pre registration or logbook entries completed accurately.\n2. ID presented and validated; badges issued with clear visual differentiation.\n3. Visitors escorted at all times by authorized personnel.\n4. No access to prohibited areas; adherence to “no electronics” or “no bags” rules.\n5. Visitor badges returned and reconciled at exit.\n6. Visitor logs retained according to security policy.",6,6,5,{"v":5,"d":"5.00000"}]
[null,"Secure storage: vaults, cages, locked rooms.","Value bearing materials (substrates, holograms, inks, plates, serialised items) must be stored in restricted access, controlled environments.","1. Vault access via dual control or restricted badge/biometric access.\n2. High security locks, reinforced doors, tamper evident seals where appropriate.\n3. CCTV coverage and intrusion alarms for all secure storage zones.\n4. Material issue/return logs maintained and reconciled daily.\n5. Environmental controls suitable for sensitive materials (temperature/humidity).\n6. Inventory counts performed against Enterprise Resource Planning(ERP)/Material Requirements Planning (MRP)/Warehouse Management System (WMS) records.\n7. Access lists reviewed periodically, with least privilege enforced.\n",7,7,5,{"v":5,"d":"5.00000"}]
[{"$nulls":6},{"$f":"SUM(G4:G10)","v":35},{"$f":"SUM(H4:H10)","v":35}]
[{"$nulls":4},"Weighted",30,"Weighted score",{"$f":"H11/G11*F12","v":{"v":30,"d":"30.00000"}}]

{"sheet":"Phase4 Sec2 - Staffing_Security","index":6,"n_rows":20,"n_cols":8,"rows_kept":20}
["PHASE 4 SITE INSPECTION - Section 2"]
["Section 2: Staffing and security - Verification (Weight: 30 points)"]
["No.","Sub-criterion","Description","Requirements","Score","Max score","Weight","Weighted score"]
[2.1,"Technical Skills of staff operating printers. ","Operators must demonstrate competency in setup, calibration, color control, serialization, and inline inspection/QC.","1. Valid training records & competency matrices by machine/model.\n2. Recent assessments (e.g., make ready, color target hits, maintenance tasks).\n3. Cross training coverage for critical shifts; refresher training within last 12 months.\n4. Evidence: Training certificates, sign off sheets, observation notes, test prints.",4,4,5,{"$f":"E4/F4*G4","v":5}]
[2.2,"Proven experience operating high-speed digital/offset printing machines;","Operators should have documented experience on relevant press types and configurations (e.g., web/offset, high speed digital with RIP/DFE).","1. CV/service history per operator confirming machine familiarity and tenure.\n2. References or internal performance records/run logs tied to operator IDs.\n3. Demonstrated knowledge of emergency stops, jams, and inline inspection workflows.\n4. Evidence: Operator-to-job logs, previous job run reports, maintenance sign-offs.",4,4,5,{"$f":"E5/F5*G5","v":5}]
[2.3,"Spot‑checks on staff ID usage","Staff must display valid ID badges consistently; badges must be unique, current, and tamper resistant.","1. Visible ID worn above the waist; color coding for roles/areas.\n2. No shared or loaned badges; lost badge process documented.\n3. Evidence: Floor walk observations, badge policy, exception logs.",3,3,5,5]
[2.4,"Confirm staff were vetted","All security sensitive roles require background screening before access is granted.","1. Completed vetting checks (identity, criminal, employment verification) per policy.\n2. Vetting renewal intervals defined and met; exceptions approved by security.\n3. Evidence: HR vetting status list (names redacted), audit of sample personnel files.",3,3,5,5]
[2.5,"Interview staff on security training and rules","Operators and support staff can articulate key rules: access control, visitor handling, no phone rules, clean desk, incident reporting.","1. Annual security awareness training with tests/quizzes passed.\n2. Role specific secure printing modules (e.g., handling holograms/plates, VDP).\n3. Evidence: Interview notes, LMS records, signed acknowledgement of policies.",5,5,5,5]
[2.6,"Interviews to confirm vetting was performed.","Supervisors and HR/security can explain the vetting workflow and show compliant records.","1. Standard vetting SOP; pre employment gate enforced.\n2. Evidence of audit trail: dates, outcomes, adjudication for any flags.\n3. Evidence: SOPs, vetting dashboard/reports, anonymized case samples.",3,3,5,5]
[2.7,"Observation of security culture/behavior and staff awareness.","Staff consistently demonstrate secure behaviors without prompting.","1. Challenging unknown persons; enforcing escort rules.\n2. No tailgating; secured workstations; proper waste handling.\n3. Adherence to no camera/no USB rules.\n4. Evidence: Floor walk observations, incident/near miss logs, coaching records.",5,5,5,5]
[2.8,"Only authorised staff in restricted areas.","Access to pre press, vaults, press floor, and finishing is limited based on role and need to know.","1. Access lists current; least privilege applied; periodic recertification.\n2. Real time access logs match observed presence; anti passback enforced where applicable.\n3. Evidence: Access control exports, door reader tests, spot checks against rosters.",3,3,5,5]
[2.9,"Verify NDAs signed","All employees, contractors, and temps sign NDAs covering IP, client confidentiality, and security obligations.","1. NDA in personnel files prior to start date; version controlled templates.\n2. Renewals upon role change/vendor re engagement.\n3. Evidence: Sample NDA records, HR policy, vendor contract clauses.",5,5,5,5]
[2.1,"Workstation Security (Locking, Screen Timeout)","Systems auto lock and require individual authentication; unattended sessions are not accessible.","1. Screen timeout ≤ 5–10 minutes (as per policy); manual lock behavior observed.\n2. Full disk encryption where applicable; no shared generic logins.\n3. Evidence: GPO/MDM screenshots, endpoint config baselines, floor observations.",3,3,5,5]
[2.11,"Restricted USB ports or DLP controls.","Prevent unauthorized data exfiltration and malware via removable media.","1. USB mass storage blocked by policy; exceptions documented and approved.\n2. DLP monitoring for file transfers; logging and alerting in place.\n3. Evidence: Endpoint policy, SIEM/DLP reports, device control settings, test with known device (if permitted).",3,3,5,5]
[2.12,"Access levels verified on machines.","Printers, RIP/DFE, CtP, and finishing equipment enforce role based access for settings and jobs.","1. Operator vs. Supervisor vs. Admin roles defined; audit logs enabled.\n2. Changes to color profiles/serialization parameters require elevated approval.\n3. Evidence: Role matrix, screen captures of role settings, audit log samples.",3,3,5,5]
[2.13,"Interviews with IT/security staff regarding monitoring processes.","IT/security teams can demonstrate live monitoring, alerting, and incident response.","1. Centralized logging (SIEM) for endpoints, servers, access control, and CCTV.\n2. Defined incident response playbooks and evidence of recent drills/tests.\n3. Evidence: SIEM dashboards, ticketing records, IR runbooks, post incident reports.",3,3,5,5]
[2.14,"Verification of secure handling of digital masters (design files).","Artwork, VDP templates, and serialization data are protected throughout their lifecycle.","1. Version control with hashes; restricted project folders; MFA for access.\n2. No export without approval; watermarking/test data separation; time bound vendor access.\n3. Backup + immutable/offline copies; defined retention and purge schedules.\n4. Evidence: Repository logs, ACLs, checksum records, purge logs, encryption policy.",4,4,5,5]
[2.15,"Strict Access Control (Physical & Digital)\n","Strict access control systems must be in place to limit entry to sensitive areas of the plant to authorized personnel only. This includes both physical access and digital access to systems.","1. Physical: Badges/biometrics, mantraps/turnstiles, anti passback, visitor escorts.\n2. Digital: RBAC/MFA, least privilege, network segmentation for pre press/press controllers, PAM for admins.\n3. Periodic access recertification; termination de provisioning within SLA.\n4. Evidence: Access control system exports, MFA logs, network diagrams, de provisioning tickets.",4,4,5,5]
[{"$nulls":6},{"$f":"SUM(G4:G18)","v":75},{"$f":"SUM(H4:H18)","v":{"v":75,"d":"75.00000"}}]
[{"$nulls":4},"Weighted",30,"Weighted score",{"$f":"H19/G19*F20","v":{"v":30,"d":"30.00000"}}]

{"sheet":"Phase4 Sec3- Product and Oper","index":7,"n_rows":10,"n_cols":8,"rows_kept":10}
["PHASE 4 SITE INSPECTION"]
["Section 3: Production Process and Operational Security (Weight: 40 points)"]
["No.","Sub-criterion","Description","Requirements","Score","Max score","Weight","Weighted score"]
[3.1,"Material Handling\n","End to end control of value bearing materials (substrates, inks, holograms, plates, serialized components) from receipt to issuance, WIP, returns, and destruction—under dual control and full traceability.","1. Receipt & Verification: Two person receipt; PO, CoA/CoC, batch/lot, and quantity checks; immediate logging into ERP/MES/WMS.\n2. Segregation & Storage: Secure cages/vaults with CCTV and alarms; environment controls as per spec; clear red/amber/green status or “Quarantine/Hold/Released” labels.\n3. Issuance & Returns: Logged by job/batch with count by count reconciliation; tamper evident containers for transit between stages.\n4. WIP Controls: Physical locks, material covers, and interim counts at shift change; serialized components tracked by range.\n5. Waste & Set Up Sheets: Bagged, sealed, logged; witnessed destruction per SOP within defined time windows.\n6. Records: Daily reconciliation logs, exception reports, variance RCA & CAPA. Evidence: Material logs, cage/vault access logs, reconciliation sheets, WIP tags, sealed waste records, CCTV snapshots of controlled areas.",6,6,5,{"$f":"E4/F4*G4","v":{"v":5,"d":"5.00000"}}]
[3.2,"Production Workflow\n","Documented, repeatable workflow from pre press to dispatch with stage gates, dual checks at sensitive steps, and airtight linkage between digital instructions and physical output.","1. SOPs & Work Instructions: Version controlled; visible at each process station (pre press, press, finishing, personalization, packing).\n2. Job Ticket Discipline: Each job has a complete ticket (specs, artwork hash/ID, serialization range, QC gates, material lots, packing/labeling).\n3. Stage Gates: Design freeze → Pre production trial → Pilot/Lot 0 → Full run; sign offs recorded (Ops + QA).\n4. Serialization/VDP: Controlled range issuance; validated imports; test data segregation; audit logs of RIP/DFE settings; no ad hoc changes without approvals.\n5. Change Control: Formally approved deviations and engineering changes; traceable to lots/products affected.\n6. Handover & Traceability: Batch IDs and operator IDs recorded at every transition; barcode/QR on travelers where possible.\nEvidence: SOP library (rev history), sample job packets, DFE/RIP audit logs, change control forms, traveler scans, floor walk observations of stage gates.",7,7,5,{"$f":"E5/F5*G5","v":{"v":5,"d":"5.00000"}}]
[3.3,"Product Security\n","Protection of in process and finished secure products from substitution, theft, counterfeiting, and unauthorized disclosure. Includes physical controls, tamper evidence, and chain of custody.","1. Restricted Zones: Clearly marked secure areas (pre press, press, vault, personalization, finishing, dispatch) with role based access and anti tailgating.\n2. Tamper Evident Measures: Sealed containers, numbered seals on carts/totes, seal logs with dual sign off at handovers.\n3. Inline & End of Line Controls: 100% verification where mandated (e.g., barcode/serialization verification, hologram presence); quarantine for rework with unique hold tags.\n4. Finished Goods Security: Immediate transfer to secure storage; pick/pack under CCTV; shipping seals/labels reconciled; client approved carriers.\n5. Visitor & Device Policy: No cameras/phones/USB; tool and sample controls; escorted at all times.\n6. Incident Handling: Immediate escalation of misprints, missing sheets, or seal discrepancies; documented RCA/CAPA.\nEvidence: Access control reports, seal logs, verification reports (yield, read rate), quarantine area records, dispatch chain of custody, incident tickets.",6,6,5,{"v":5,"d":"5.00000"}]
[3.4,"Quality Management\n","A robust QMS that ensures compliant output and continuous improvement across design, production, inspection, and final release.","1. Standards & Calibration: Adherence to defined standards (e.g., color targets, registration tolerances); calibrated instruments (spectros, densitometers) with current stickers and certs.\n2. In Process QC: Defined sampling plans and QC gates (Pre press, First Article, In Run, Final); checklists signed with measurable results.\n3. Defect Classification & Disposition: Standard defect taxonomy; hold/quarantine rules; rework instructions; scrap authorization.\n4. Data & Trends: Yield, defects per million (DPM), first pass yield (FPY), rework rates, and control charts; CAPA linked to root cause.\n5. Document Control: Current specs and art references (hash/signature); obsolete docs removed from floor; training acknowledgment on new revisions.\n6. Release: QA release sign off per lot/batch; certificate of conformity where required.\n7. Evidence: Calibration registry, QC records, FAIs, control charts, CAPA logs, QA release forms, training records tied to SOP revisions.",7,7,5,{"v":5,"d":"5.00000"}]
[3.5,"Safety & Environmental\n","Safe operations and compliant handling of chemicals, emissions, noise, and waste—without compromising product security.","1. Machine Safety: Guards/interlocks functional; LOTO procedures; emergency stops tested and documented; clear walkways and signage.\n2. Air & Noise Controls: Ventilation/extraction for inks/solvents; documented maintenance schedules; PPE use observed and enforced.\n3. Waste & Emissions: Segregated waste streams (hazardous, paper, plastic, plates); licensed disposal; destruction records for security waste; environmental logs.\n4. Training & Drills: Safety inductions, annual refreshers, mock drills (fire/spill); near miss reporting and corrective actions.\n5. Coexistence with Security: Safety inspections preserve chain of custody (e.g., sealed waste even during spill response; escorted maintenance).\n",5,5,5,{"v":5,"d":"5.00000"}]
[{"$nulls":6},{"$f":"SUM(G4:G8)","v":25},{"$f":"SUM(H4:H8)","v":25}]
[{"$nulls":4},"Weighted",40,"Weighted score",{"$f":"H9/G9*F10","v":{"v":40,"d":"40.00000"}}]

{"sheet":"Summary - Site inspection","index":8,"n_rows":9,"n_cols":3,"rows_kept":9}
["Summary  - SITE Inspection"]
["Category","Weight","Score (points)"]
["Phase4 - Site inspection",30,{"$f":"'Phase4 Sec1 - Site inspection'!H12","v":30}]
["Phase4 - Staffing_Security",30,{"$f":"'Phase4 Sec2 - Staffing_Security'!H20","v":30}]
["Phase4 - Production and Operati",40,{"$f":"'Phase4 Sec3- Product and Oper'!H10","v":40}]
[]
[null,"Total Score:",{"$f":"SUM(C3:C5)","v":100}]
[]
[null,"Rating:",{"$f":"IF(C7>=85,\"Excellent / High-security facility\",IF(C7>=70,\"Strong / Meets most requirements\",IF(C7>=55,\"Acceptable but improvements needed\",IF(C7>=40,\"Weak controls / Security risk\",\"Critical / Unacceptable risk\"))))","v":"Excellent / High-security facility"}]