Critical Infrastructure (Utilities) Security Checklist

This critical infrastructure security checklist ensures compliance with NERC CIP (Critical Infrastructure Protection) standards for bulk electric systems, DHS CFATS (Chemical Facility Anti-Terrorism Standards), ASIS International Critical Infrastructure Security Guidelines, and CISA Critical Infrastructure Security and Resilience requirements. Designed for critical infrastructure security officers and site security managers at utility, water, and energy facilities.

  • Industry: Security Services
  • Frequency: Daily
  • Estimated Time: 45-60 minutes
  • Role: Critical Infrastructure Security Officer / Site Security Manager
  • Total Items: 30
  • Compliance: NERC CIP-006-6 Physical Security of BES Systems, DHS CFATS 6 CFR Part 27 Anti-Terrorism Standards, ASIS International Critical Infrastructure Security, CISA Critical Infrastructure Security Guidelines, NIST SP 800-82 ICS/SCADA Security

Physical Security Perimeter

Physical security zone compliance per NERC CIP-006.

  • Physical Security Perimeter (PSP) fencing intact?
  • All PSP access points monitored or alarmed?
  • Perimeter and security area lighting operational?
  • CCTV coverage of all access points and perimeters?
  • Perimeter intrusion detection system functional?

Electronic Access Control

NERC CIP-006 electronic access control system verification.

  • Electronic Access Control (EAC) system operational?
  • Access authorization list current and reviewed?
  • Terminated personnel access revoked within 24 hours?
  • All visitors escorted and logged?
  • Access logs current and secured for 90-day retention?

Critical System Security

Control systems and critical equipment protection.

  • Control room/SCADA room secured and access controlled?
  • Operational Technology (OT) systems isolated from IT networks?
  • No unauthorized devices connected to control system networks?
  • No evidence of equipment tampering?
  • Backup power systems (UPS, generators) operational?

CFATS Compliance (Chemical Facilities)

DHS CFATS security program compliance checks.

  • Chemicals of Interest (COI) secured per SVA-based plan?
  • Security training current for all personnel?
  • CFATS personnel surety (background check) current?
  • COI inventory levels within CFATS-approved thresholds?
  • CFATS Compliance Notes

Threat Monitoring and Intelligence

Threat awareness and intelligence sharing.

  • ISAC (E-ISAC, WaterISAC, etc.) threat alerts reviewed?
  • CISA security advisories reviewed this week?
  • Insider threat awareness program active?
  • Any suspicious activity near facility perimeter?
  • Threat observations reported to management and law enforcement?

Incident Response and Documentation

Security incident management and NERC CIP reporting.

  • All physical security incidents documented?
  • Any NERC CIP reportable incidents evaluated?
  • Law enforcement notified of serious security incidents?
  • Management notified of all significant security events?
  • Daily Security Log Entry

Related Safety & Compliance Checklists

Related Workplace Safety Checklists

Why Use This Critical Infrastructure (Utilities) Security Checklist?

This critical infrastructure (utilities) security checklist helps security services teams maintain compliance and operational excellence. Designed for critical infrastructure security officer / site security manager professionals, this checklist covers 30 critical inspection points across 6 sections. Recommended frequency: daily.

Ensures compliance with NERC CIP-006-6 Physical Security of BES Systems, DHS CFATS 6 CFR Part 27 Anti-Terrorism Standards, ASIS International Critical Infrastructure Security, CISA Critical Infrastructure Security Guidelines, NIST SP 800-82 ICS/SCADA Security. Regulatory-aligned for audit readiness and inspection documentation.

Frequently Asked Questions

What does the Critical Infrastructure (Utilities) Security Checklist cover?

This checklist covers 30 inspection items across 6 sections: Physical Security Perimeter, Electronic Access Control, Critical System Security, CFATS Compliance (Chemical Facilities), Threat Monitoring and Intelligence, Incident Response and Documentation. It is designed for security services operations and compliance.

How often should this checklist be completed?

This checklist should be completed daily. Each completion takes approximately 45-60 minutes.

Who should use this Critical Infrastructure (Utilities) Security Checklist?

This checklist is designed for Critical Infrastructure Security Officer / Site Security Manager professionals in the security services industry. It can be used for self-assessments, team audits, and regulatory compliance documentation.

Can I download this checklist as a PDF?

Yes, this checklist is available as a free PDF download. You can also use it digitally in the POPProbe mobile app for real-time data capture, photo documentation, and automatic reporting.

Browse More Checklists