Prior to inspecting a facility, the facility’s management team consents to participate in the program and completes a questionnaire in order to provide background on its services and operations.

The MPAA sends a third-party firm to conduct the security review, which generally lasts one day. This inspection includes interviews with key personnel (such as the Director of Operations) and validation of controls in place through observation, examination of documentation and re-performance. Topic areas are outlined in the MPAA Content Security Model.

The outcome of this inspection is a Site Security Report, which includes considerations for improvement to meet the “best practices” for a given facility type. Except in limited instances, a draft of the Site Security Report is shared with the vendor being surveyed prior to finalization and distribution of such report. The facility’s management is given an opportunity to respond to the Site Security Report within 10 business days. After 10 business days, the final Site Security Report is distributed exclusively to the MPAA, its Members, and their affiliates and subsidiaries. If a surveyed facility makes enhancements to security after the Site Security Report is issued, the vendor is encouraged to report the enhancements to the MPAA in a letter signed by a company officer or authorized executive.

Site Security Reports are provided to the MPAA and its Members solely as a basis for individual discussions with the vendor about security at their facility. Reports are prohibited from being shared beyond the MPAA, its Members, and their subsidiaries and affiliates.