UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities 7.4-PLAN: Physical security plan and layered controls

The risk assessment feeds a physical security plan stating required measures, implementation and assurance, with a clear link from each risk to its controls. Controls deter, delay, detect, assess and respond, including against insiders, in layers proportionate to asset sensitivity, supported by SQEP, standards and procedures, and training so staff can recognise and report signs of attack. Planning from early design integrates physical controls with the CPS (SyAPs paragraph 193), and substantial access and proximity controls protect high-risk operational technology, which may be a vital area, and information assets (paragraph 194). Guard and alarm response forces have defined responsibilities and are trained and resourced.