Physical security for critical infrastructure
Critical infrastructure sites are spread out, often unstaffed, and protected by fences, cameras and access control that someone watches from miles away. An intruder at a remote substation, pump station or telecom shelter can cause harm far beyond the site. We assess how these sites are protected, test the systems that watch them, and check whether an alarm at 3 a.m. actually brings a response.
Who it is for
- Electric utilities and generation operators, including sites in scope for NERC CIP physical security requirements.
- Water and wastewater systems, telecom carriers, pipelines, ports and transport operators.
- Operators of sites designated as critical in the United States, the EU or the Gulf.
- Engineering firms and integrators that want an independent check of a security design before it is built.
Standards we map findings to
NERC CIP (North American electric sector)
CIP-006 covers the physical security of BES Cyber Systems, and CIP-014 the physical security of certain transmission stations and substations. We test the controls behind your evidence on site, so the physical security plan describes what the site actually does.
- Physical security perimeters, access control and the logging of who entered and when.
- Monitoring, alarms and the response to unauthorized access.
- Visitor control, escorts and the records kept of them.
Water and wastewater
Under America’s Water Infrastructure Act, community water systems serving more than 3,300 people must assess their risk and resilience, including to malevolent acts, keep an emergency response plan, and review both every five years. We assess the physical side: the barriers, detection and response at treatment plants, pump stations, tanks and wells.
EU Critical Entities Resilience Directive
Directive (EU) 2022/2557 requires critical entities identified by their member state to assess risk and take technical, security and organizational measures, physical protection of their premises among them. It sits alongside NIS2, which covers their cybersecurity. See Europe.
Saudi Arabia and the Gulf
Operators of critical national infrastructure in Saudi Arabia answer to the NCA’s Essential Cybersecurity Controls, which include a physical security subdomain, and for industrial sites the Operational Technology Cybersecurity Controls. See Middle East.
CISA guidance
Where no rule names a standard, we use CISA’s guidance for your sector and its Cross-Sector Cybersecurity Performance Goals as the baseline, so findings are measured against something your board and regulators recognize.
How we assess
- Perimeter: fences, gates, vehicle barriers, lighting and clear zones, and how long each one actually delays someone with hand tools.
- Detection: intrusion detection, camera coverage and analytics, and whether an alarm reaches a person who can act on it.
- Response: who goes, how long it takes, and what happens at an unstaffed site at night or in bad weather.
- Keys and access across many remote sites: badges, padlocks, key control and contractor access.
- The security systems themselves as targets: cameras, door controllers and remote monitoring links, and how they connect to operational technology networks.
- Control rooms, equipment shelters and cabinets: what a visitor, contractor or insider can reach.
What you receive
- A site-by-site assessment, with representative sites visited and findings extended across similar ones.
- Findings ranked by consequence and mapped to the standard you answer to, each with a price range.
- Delay, detection and response timings for the attack paths that matter most.
- Where authorized, a covert test of perimeter, detection and response.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Scoped by site count. Typically one to two days on site per representative site, with the report two to three weeks after the last visit.
Common questions
Do you need to visit every site?
Not usually. For large estates we visit a representative sample of each site type, agreed with you, and extend findings across the others. The sites with the highest consequence are always visited.
Do you test whether an alarm gets a response?
Yes, where authorized and coordinated in advance with your operations center and, where needed, local law enforcement, so no real response is sent against a test. Everything is agreed in writing first.
Are you a NERC CIP auditor?
No. We assess and test; we do not audit on behalf of a Regional Entity and issue no attestation. Findings are mapped to the requirements so your compliance team can use them.
Can you assess the cybersecurity of the OT network as well?
We assess the security systems (cameras, access control and their monitoring links) and where they touch the OT network. A full OT cybersecurity assessment is scoped separately; tell us at scoping if you need it.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Critical infrastructure
We reply within one business day.
Nothing you send is shared outside Calibre.