Critical Infrastructure

Protecting what people depend on.

Critical infrastructure has to do more than withstand disruption. It has to keep the essential services people depend on moving.

From energy and data centres to transport, healthcare and water, every environment has different priorities. But each depends on people, technology and operations working together.

Effective security starts by understanding the environment as a whole:

• What needs protecting?
• Who needs access?
• What needs to keep moving?
• Where does the level of risk change?
• How will people and operations respond when conditions change?
• How might requirements evolve over time?

Preparedness means considering these questions before disruption occurs, so security can support both protection and operational continuity.

Protecting the environments society depends on.

Critical infrastructure is defined differently around the world, but the principle is broadly consistent: these are the systems, facilities and services whose continued operation matters to society, public safety and the economy.

We support physical security requirements across environments including:

• Energy and utilities
  Power generation, electricity transmission, renewable energy facilities, oil and gas sites, utility control rooms and supporting infrastructure.
• Water and wastewater
  Drinking water treatment plants, wastewater facilities, reservoirs, dams, pumping stations and distribution networks.
• Transport and logistics
  Airports, seaports, railways, freight hubs, public transport networks, road infrastructure and logistics facilities.
• Digital infrastructure and communications
  Data centres, telecommunications networks, internet exchange points, cloud infrastructure, operational technology environments and communication systems.
• Healthcare and public health
  Hospitals, laboratories, pharmaceutical sites, emergency care facilities and medical supply chains.
• Government and public administration
  National, regional and local government buildings, courts, civic infrastructure, public agencies and administrative services.
• Emergency services
  Police, fire, ambulance, emergency coordination centres and disaster response facilities.
• Financial services
  Banks, payment systems, trading infrastructure, insurance operations, financial data environments and other essential financial services.
• Food and agriculture
  Food production, processing, storage, distribution and agricultural supply chains.
• Chemical and hazardous materials
  Chemical production, storage, handling and distribution facilities where safety and controlled access are critical.
• Critical manufacturing
  Manufacturing facilities that produce essential components, equipment or materials for other critical sectors.
• Defence, aerospace and space
  Defence facilities, aerospace sites, satellite infrastructure, space technology environments and high-security research locations.
• Nuclear and high-risk industrial environments
  Nuclear facilities, radiological sites and other high-consequence environments with strict safety and security requirements.

Every environment is different. What needs protecting, who needs access and what needs to remain operational should shape the security approach.

Security designed around how people really move.

Critical infrastructure depends on movement.

Employees arrive for shifts. Contractors need access to specialist areas. Visitors move through reception. Engineers respond to operational requirements. Emergency teams may need rapid access when conditions change.

Movement is more than getting people from one place to another. It is an operational capability that supports continuity, coordination and resilience.

Effective entrance security considers who needs to move, where they need to go, when access is required and what happens when normal conditions change.

During an incident, shift change or operational disruption, movement patterns and access requirements can change. Certain teams may need to move quickly while protection remains in place elsewhere.

Designing security around real movement helps create clarity, confidence, and control during everyday operations and when conditions change. It also means considering accessibility and inclusive movement, so protection works around the people who use the environment.

It also means considering accessibility and inclusive movement, so protection works around the people who use the environment rather than creating unnecessary barriers.

The right people. The right spaces. The right time. The right level of protection.

Looking beyond the entrance.

Buildings, people, technology and operations are interconnected. A strong critical infrastructure security strategy considers how they work together, and how a vulnerability in one part of the environment could affect another.

Physical entrance security can form part of a wider ecosystem incorporating:

• Access control systems
• Identity and access management
• Biometric authentication
• Digital and mobile credentials
• Visitor management
• Video surveillance
• Workforce management
• Building management systems

Connected systems can support greater visibility and more consistent control around who is authorised and where access is granted.

But ecosystem thinking is about more than connecting technology. It means bringing together an understanding of security, facilities, operations, architecture, technology and people to create an approach shaped around the environment as a whole.

For us, that means looking beyond an individual entrance to understand the building it serves, the people who use it, the operations it supports and the protection it needs to provide.

The strongest security concepts are shaped around the people, operations and environment they are there to protect.

How prepared is your physical security environment?

Review your approach to access security, resilience and critical zones with our Critical Infrastructure Readiness Assessment.

Responding to an evolving security landscape.

Critical infrastructure requirements vary by country, sector and organisation, but increasingly bring together physical security, cybersecurity, risk management and operational continuity.

Understanding the requirements is important. Preparedness means translating them into an approach that works for the people, operations and environment in practice.

European Union

The NIS2 Directive strengthens cybersecurity and risk-management requirements across critical sectors, while the Critical Entities Resilience Directive (CER) focuses on the resilience of essential services against physical and other non-cyber risks. Together, they reinforce the need to consider cyber, physical and operational resilience as connected priorities.

The Netherlands

The Cyberbeveiligingswet (Cbw) and Wet weerbaarheid kritieke entiteiten (Wwke) came into force on 15 August 2026, implementing NIS2 and CER respectively and strengthening both digital and physical resilience requirements.

Germany

Germany’s KRITIS framework is supported by sector-specific requirements, cybersecurity legislation and the KRITIS-Dachgesetz, which strengthens cross-sector requirements around the resilience of critical infrastructure and implements the EU CER framework.

Belgium

Belgium has implemented NIS2 through national legislation, creating cybersecurity risk-management, governance, reporting and supervision requirements for essential and important entities. Its critical-entity resilience regime also links designated critical entities into the wider NIS2 framework.

France

France has a long-established framework for protecting Operators of Vital Importance (OIV) and their critical sites, covering both physical and cyber security, risk assessment and continuity planning. European NIS2 and CER requirements add to this wider resilience landscape.

Ireland

Ireland has implemented the CER Directive through the European Union (Resilience of Critical Entities) Regulations 2024 and published a National Strategy on the Resilience of Critical Entities 2026–2029. NIS2 transposition remains a separate developing part of the cybersecurity framework.

Sweden

Sweden’s Cybersecurity Act came into force in January 2026 and implements NIS2 requirements for relevant public and private-sector organisations. Separate legislation to strengthen the resilience of critical operators is also progressing.

Norway

Norway’s Digital Security Act came into force in October 2025, introducing baseline digital-security requirements for organisations providing important societal and digital services. Wider national-security requirements may also apply depending on the organisation.

United Kingdom

The UK’s current cyber regime for operators of essential services includes the Network and Information Systems Regulations 2018, while the Cyber Security and Resilience Bill proposes further reform. The NPSA also provides protective-security guidance for critical national infrastructure.

United States

The United States regulates critical infrastructure largely through sector-specific requirements, supported by national guidance from organisations such as CISA and frameworks including NIST Cybersecurity Framework 2.0.

Australia

Australia’s Security of Critical Infrastructure Act 2018 (SOCI Act) sets obligations for specified critical infrastructure assets, including incident reporting and, for relevant entities, critical infrastructure risk-management programmes.

United Arab Emirates

The UAE’s Critical Information Infrastructure Protection Policy establishes a national framework for identifying critical assets, managing risk and setting baseline security and cyber-resilience requirements across vital sectors.

India

India protects Critical Information Infrastructure through the Information Technology Act, with the National Critical Information Infrastructure Protection Centre (NCIIPC) acting as the national nodal agency for CII protection.

Malaysia

Malaysia’s Cyber Security Act 2024 establishes responsibilities around National Critical Information Infrastructure (NCII) and sector leadership, strengthening governance and cybersecurity risk management across critical national services.

China

China’s critical-information-infrastructure regime is built around the Cybersecurity Law and the Regulations on the Security Protection of Critical Information Infrastructure, with enhanced requirements for important systems in sectors such as energy, transport, finance, water and public services. The Cybersecurity Law was amended in 2025.

Regulations establish important requirements. Preparedness is about understanding what those requirements mean for your own environment.

Different spaces. Different risks. Different levels of protection.

Every secure environment begins with a decision:

Who should move forward? Who shouldn't?

Physical access is where those decisions become operational - where identity is verified, access is controlled and trusted movement begins.

In critical infrastructure, entrances and access points are more than physical boundaries. They are strategic control points within a wider security ecosystem, protecting critical areas while enabling employees, contractors, visitors and emergency teams to move where they need to go.

Physical and digital security are increasingly connected too. Cybersecurity protects data, systems and operational technology, but those assets exist within physical environments. Protecting digital infrastructure therefore also means controlling physical access to the spaces and systems that support it.

Unauthorised access to a data hall, control room or other sensitive area can put more than the physical space at risk. It can expose critical technology and information, interfere with operations or create wider security risks. That is why physical security and cybersecurity need to work together.

Layered physical security

Perimeter access
Helps manage authorised pedestrian movement at site boundaries and external entry points, supported where appropriate by physical security entrances such as full-height turnstiles.

Public and reception areas
Balances security with accessibility, visitor experience and efficient movement, with solutions such as speed gates helping manage authorised passage.

Employee and operational areas
Supports frequent authorised movement while maintaining the level of access control appropriate to the environment.

Critical and high-security areas
Provides stronger verification and selective access where people, assets, systems or operations require greater protection, including the use of security doors and portals where appropriate.

Each layer has a purpose. Together, they can help:

• unauthorised access
• tailgating and piggybacking
• employee, contractor and visitor access
• restricted and high-security zones
• shift changes and peak people flow
• emergency access and egress
• accessibility
• operational continuity

Our security entrances can work with wider access control and security technologies, helping turn access permissions into controlled physical movement. The approach should be shaped around the environment, its risks and the people who move through it.

Effective security is not about creating more barriers. It is about applying the right protection in the right place, while enabling the right people to keep moving.

Experience that looks beyond the entrance.

For more than 150 years, we have been shaping how people move through buildings.

Today, we bring that experience to complex security environments around the world — combining precision engineering, entrance security expertise and knowledge of people flow to help organisations protect what matters.

We work with customers and partners to understand the wider environment — its people, operations, security zones, existing technologies, accessibility requirements and future priorities.

Whether we are supporting a new facility, strengthening an existing site or helping develop a layered entrance strategy across multiple locations, our starting point remains the same:

What needs protecting? What needs to keep moving?

Strong physical security is not simply about stopping the wrong person.

It is about giving the right people the confidence to move forward, protecting the operations they support and helping essential infrastructure remain resilient for the people who depend on it.

150+ years of experience. Always looking ahead.