A framework for complying with conflicting safety and security standards within critical infrastructure organisations
type: CreativeWork
description: Safety and security risks to critical infrastructure organisations are well known, and incidents in both fields have taken place. To help critical infrastructure organisations manage these areas, safety and security standards have been created. The standards can vary from general standards to industry-specific standards. Complying with both safety and security standards within critical infrastructure organisations can be difficult due to the conflicting requirements in the standards between safety objectives and security objectives and controls for information technology cannot always be applied to operational technology. The main aim of the thesis was to identify and remediate conflicts and issues between information technology, operational technology, safety, and security, while also creating processes that can combine safety and security compliance to standards to reduce duplication of work and allow one process to manage both areas. The main output of the thesis is the creation of the Safety and Security Standards Framework for Critical Infrastructure (SSS Framework for CI) that can be used by critical infrastructure organisations to produce a Safety and Security Management System (SSMS). To achieve this a case study was created and multiple safety and security standards were analysed to see what processes and controls they required. Questionnaires, workshops and experiments with safety and security professionals were conducted to inform and validate the framework. The SSS Framework for CI has 14 processes, 22 control areas and over 1000 conflicts, issues and resolutions for those conflicts and issues. Other findings were that conflict resolution and risk management are critical to successfully creating a SSMS and both need to be in place and designed to consider both safety and security objectives. The thesis has demonstrated that safety and security can be managed together, and it can bring benefits to critical infrastructure organisations both in efficiency o…
abstract: Safety and security risks to critical infrastructure organisations are well known, and incidents in both fields have taken place. To help critical infrastructure organisations manage these areas, safety and security standards have been created. The standards can vary from general standards to industry-specific standards. Complying with both safety and security standards within critical infrastructure organisations can be difficult due to the conflicting requirements in the standards between safety objectives and security objectives and controls for information technology cannot always be applied to operational technology. The main aim of the thesis was to identify and remediate conflicts and issues between information technology, operational technology, safety, and security, while also creating processes that can combine safety and security compliance to standards to reduce duplication of work and allow one process to manage both areas. The main output of the thesis is the creation of the Safety and Security Standards Framework for Critical Infrastructure (SSS Framework for CI) that can be used by critical infrastructure organisations to produce a Safety and Security Management System (SSMS). To achieve this a case study was created and multiple safety and security standards were analysed to see what processes and controls they required. Questionnaires, workshops and experiments with safety and security professionals were conducted to inform and validate the framework. The SSS Framework for CI has 14 processes, 22 control areas and over 1000 conflicts, issues and resolutions for those conflicts and issues. Other findings were that conflict resolution and risk management are critical to successfully creating a SSMS and both need to be in place and designed to consider both safety and security objectives. The thesis has demonstrated that safety and security can be managed together, and it can bring benefits to critical infrastructure organisations both in efficiency o…
author: Kemp, Robert
license: https://dora.dmu.ac.uk/bitstreams/53e26c52-8d03-4385-b701-84590df8bf99/download
date published: 2023-06
date modified: 2026-07-24T06:18:27Z
provider: De Montfort University
publisher: Networked Digital Library of Theses and Dissertations
type: WebPage
source organization: De Montfort University