An article in Homeland Security Today presents a case study demonstrating the importance of critical infrastructure operators having a security program in place. In the case study, a man parked his van outside a sensitive facility for a prolonged period of time, telling the staff there that the van had broken down and that a tow truck was on its way. But when the tow truck didn’t arrive in a reasonable amount of time, the staff began implementing security protocols that eventually led them to call police. Given the facility’s sensitivity, local law enforcement conducted an expedited response, during which they discovered the van was registered to a person on a terrorist watch list. As highlighted by this real-world scenario, the facility had a security program with protocols in place, had trained its staff to these, and had partnered with law enforcement so that it understood the facility’s sensitivity and how it could work with the facility in a response. Getting to this point was the result of the facility having executed three steps the article underscores are necessary for a critical infrastructure facility’s security program: 1) Identify the purpose of the critical infrastructure program; 2) Form and write down goals or objectives; and 3) Measure and present progress. Homeland Security Today.