10.6 Critical Infrastructure Security

Quick Answer: Critical infrastructure means the facilities a society cannot do without: oil and gas, power and desalination plants, water, telecommunications, transport and financial systems. Protecting it is a separate licensed security service. In Abu Dhabi, access to many such sites also needs a CICPA security pass. Guards control access at layered perimeters, watch for hostile reconnaissance and insider threats, follow strict site safety rules, and report early and accurately to the control room and the authorities.

Critical infrastructure in the regulations

• Critical infrastructure security is one of the company licence categories in Article 17 of Ministerial Decision No. 557. The published fee schedule lists AED 40,000 for issuing or renewing it.
• Private critical infrastructure security guard is an individual licence category (Article 90). As with other specialist categories, a guard first needs a year as a general guard (Article 98).
• NSI lists critical infrastructure as one of the twenty BSG topics, so basic guards are expected to understand the principles even before specialising.

What counts as critical infrastructure

The common feature is that damage or disruption would have serious effects far beyond the site itself.

Abu Dhabi's CICPA security pass system

The Critical Infrastructure and Coastal Protection Authority (CICPA) is responsible for protecting Abu Dhabi's critical installations against threats, sabotage and disruption. It controls access through security passes:

• passes are issued for individuals, companies, vehicles and vessels that work at critical sites such as oil and gas, power and water facilities and restricted port areas;
• temporary passes can be issued for short periods, from one day up to one month;
• a guard at such a site checks that each person and vehicle holds a valid pass for that location before entry, in addition to the client's own permits.

A CICPA pass gives access to a site. It does not replace the guard's own individual licence from the private security licensing authority.

Layered protection

Critical sites use defence in depth: several rings of security, so that an intruder must defeat each one in turn.

Guards are not the armed response. Their value is early detection and accurate reporting.

Insider threats

People with legitimate access cause many serious incidents. Report:

• staff or contractors in areas unrelated to their work, especially out of hours;
• attempts to borrow passes, keys or codes;
• photographing control rooms, plans or security systems;
• unusual interest in shift patterns, alarm responses or patrol routes;
• removing documents, data storage devices or equipment without authorisation.

Hostile reconnaissance and drones

Attacks are usually preceded by reconnaissance. Watch for people or vehicles that repeatedly pass or park near the perimeter, photograph gates or cameras, test responses (for example by touching the fence or setting off an alarm and watching the reaction), or ask staff questions about security.

Drones near critical sites are a growing concern. If you see one:

1. note the time, direction and height;
2. try to locate the operator, without approaching or confronting them;
3. report it immediately to the control room, which will inform the police.

Do not try to interfere with the drone yourself.

Safety rules at energy and industrial sites

Many critical sites contain flammable atmospheres, toxic gases or high voltage. Typical rules include:

• carry only approved, intrinsically safe radios and torches in hazardous areas, and keep personal mobile phones out where the site bans them;
• obey permit-to-work controls, and never enter a fenced or marked hazardous area without authorisation;
• know the site's gas alarm, muster point and wind-direction indicators. In a toxic gas release, move upwind and crosswind as instructed;
• wear the site's required personal protective equipment, such as a helmet, safety boots, flame-resistant clothing or a gas detector.

Escalation and reporting

For any intrusion, sabotage indicator, suspicious item or reconnaissance sighting, report immediately to the site control room using who, what, where, when and direction of travel. The site plan then sets out the alerts to the police (999), CICPA or other authorities. Preserve evidence and record everything in your notebook and the occurrence book.

Section summary checklist

• Separate licences: critical infrastructure security (company, Article 17; AED 40,000) and the critical infrastructure guard (Article 90).
• Sectors: energy, water, communications, transport, finance, health and government.
• Abu Dhabi: CICPA protects critical installations and issues security passes for people, vehicles and vessels.
• Defence in depth: deter, detect, delay, respond. Guards detect and report.
• Watch for insiders, reconnaissance and drones. Obey ignition-source and permit-to-work rules.