Reporting, Regulating and Merging

George Miserendino is the owner and president of security consultancy Triton Security Solutions, which specializes in infrastructure protection strategies for the electricity, gas and water industries. He also has 30 years of experience in security services management. CSO contacted him to tap his extensive industry expertise on matters of compliance, consolidation and critical infrastructure.

The BZPP (Buffer Zone Protection Plan) is an initiative of the Department of Homeland Security that specifies the types of equipment to be used near identified “critical assets.” I envision that, during 2005, this DHS project may receive considerable attention from the various critical infrastructures where it will be applied to assist in countersurveillance and incident deterrence initiatives.

Physical and data security are partnering on a more frequent basis. The NERC Cyber Security Standards will help facilitate a clearer working relationship. Reporting relationships in the utility industry vary broadly, with security functions being located in shared services, administrative services, legal departments, human resources and (in a few rare instances) operating line organizations. The reporting location is not as important as the proactive support of corporate senior management, specifically the CEO, COO, CIO and so on.

Recent surveys indicate that both the electric and gas sectors are meeting FERC, Coast Guard, TSA and NERC security initiatives. Companies are modifying policies and procedures, conducting tabletop exercises, and applying technologies (card access, CCTV, intrusion detection systems) at facilities determined to be “critical” to the company.

Mergers have slowed progress in some areas due to the new senior management team coming in and identifying what their priorities will be and how they will achieve them. In most cases, security projects and initiatives have been placed in abeyance until strategic plans are finalized. However, in all instances where government regulatory initiatives have been identified, companies have responded favorably to meet the new standards.

Without a doubt, we are significantly safer today than we were prior to 9/11 as a result of a number of regulatory initiatives. These include bulk electric power transmission, dams, facilities on navigable waterways and so on.

Companies should continue to validate their processes to identify critical facilities, assets and systems. In this regard, a better understanding of these systems and their interdependencies with other infrastructures should be further researched and understood.

The development of companywide “security councils” to address and validate security program initiatives. Generally, these councils are made up of senior management representatives who are subject-matter experts, representing their respective organizations. These councils have been successful in raising security awareness issues and opportunities across many corporate business functions, thereby facilitating progress.