What critical infrastructure operators can learn from event security

Events and critical infrastructure serve different purposes and have different protection requirements. In practice, however, they overlap where protective functions have to be provided for a limited time under changed conditions. Experience from event security can offer additional perspectives here.

Planning temporary operating states deliberately

At events, infrastructure, responsibilities and procedures are set up for a limited period. Set-up, operation and dismantling have to mesh safely. The UK Health and Safety Executive (HSE) therefore stresses the importance of safety management in every phase of an event and of coordinating the companies involved [1].

Critical facilities can face a similar planning need during maintenance, refurbishment or disruptions. What matters then is which protective functions are affected by the changed state and how they are to be fulfilled during that time.

Read more: Security technology that works through power and network failures.

Linking protective functions with operations

A fictitious example: because of construction work, the regular entrance to an operating site is moved temporarily. Besides access control, lighting, communication and the overview of the affected area may also need to be adapted.

Here, an approach from temporary event operations can be transferred: agree the required functions together, clarify interfaces with existing systems and name who is responsible for set-up, operation and fault handling. Mobile technology is one possible measure. Whether it is suitable depends on the specific requirements of the site.

Read more: Mobile site surveillance: off-grid CCTV for construction sites.

Checking readiness in practice

Before the changed area is used, the interplay of the measures should be checked. Do reports reach the responsible point of contact? Does operation work? Are fallback procedures known? The return to normal operations also needs an orderly hand-over.

The importance of organisation, exercises and follow-up is already established in critical infrastructure protection: the BMI guide on risk and crisis management explicitly treats them as part of preparedness and continuous improvement [2]. Event security adds complementary experience for operations of limited duration.

What can be transferred, then, are above all methods for preparing, coordinating and checking temporary protective functions. Sector-specific requirements, access rights, information security and required evidence remain decisive. Event experience can support planning; on its own, it does not demonstrate suitability for a critical site.

Read more: Integrated security infrastructure, not isolated measures and Germany’s KRITIS Umbrella Act: physical protection explained.

Applying this to temporary protective functions is an editorial conclusion drawn from the two technical perspectives. The access example is fictitious. No empirical claim is made that event methods are generally superior to existing critical infrastructure procedures.