Site security

Scope

Site security can affect employees, supervisors, security staff, contractors, temporary workers, customers, vendors, and visitors. It also protects the buildings, equipment, records, and computer systems they rely on. Because people are an organization's most important asset, protecting them should be central to the site security effort.

Regulatory requirements

There is no federal OSHA standard specifically for site security. However, employers should consider:

• 29 CFR 1910.38 — Emergency action plans
• 29 USC 654 — General duty clause of the OSH Act
• Applicable OSHA State Plan, state, and local requirements

Definitions

• Site security: The combination of physical measures, policies, and everyday practices used to allow authorized people in and keep unauthorized people out.
• Layered security: The use of more than one safeguard at a time, so protection does not depend on any single measure. If one layer misses a problem, another one may catch it.
• Asset: Anything worth protecting, including people, property, equipment, records, information, and reputation.
• Threat: Any circumstance, event, or person that could cause harm or loss. Threats may be natural, human, or environmental.
• Insider threat: A risk from someone who has legitimate access to the organization's people, facilities, systems, or information and uses that access to cause harm, either intentionally or accidentally.
• Vulnerability: A weak spot, such as an unlocked door, blind corner, or gap in a procedure, that a threat could take advantage of.
• Physical security: Measures that keep people out of areas they should not enter, such as locks, fences, badges, and cameras.
• Information security: Measures that protect sensitive information and computer systems and keep them operating.

Summary of requirements

Although OSHA does not require a specific site security program, protecting employees means taking reasonable steps to identify and control recognized security risks. Employers should:

• Assign responsibility for site security and involve employees;
• Identify what needs protection and assess security threats and vulnerabilities;
• Give added attention to higher-risk areas, such as site perimeters, entrances, loading docks, parking lots, cash-handling areas, records rooms, and locations where employees work alone or remotely;
• Use layered safeguards, combining physical, procedural, and information measures so that no single safeguard carries the full burden of protection:
  • Physical measures: Controlled entrances, locks, fences, lighting, identification badges, visitor sign-in, security staff, cameras, and alarms.
  • Procedural measures: Visitor rules, escorts, buddy systems, key and badge control, cash-handling procedures, and incident reporting.
  • Information measures: Restricted access to records and computer areas, secure disposal of sensitive documents, passwords, firewalls, and backups.
• Control access for employees, visitors, contractors, keys, and badges;
• Establish procedures for reporting threats, suspicious activity, and security incidents;
• Coordinate security procedures between your emergency action plan and internal and external emergency response procedures;
• Train employees, in language and terms they can understand, on the main security risks, access and visitor procedures, how to recognize and report suspicious activity, alarms, emergency response, and parking-lot and travel safety; provide additional training for employees with specific security duties or higher-risk responsibilities;
• Respond to security incidents by protecting employees and visitors from further harm, contacting law enforcement or emergency responders when appropriate, providing medical attention per individual training levels, investigating and documenting what happened, addressing identified gaps and strengthening safeguards, and restoring operations safely;
• Retain records of incidents, threats, and corrective actions; and
• Evaluate the program through drills, tabletop exercises, audits, and incident follow-up. Update the program as conditions change and make improvements when needed.