A Framework for creating a Safety and Security Management System (SSMS)

Abstract

Safety and security risks to critical infrastructure organizations are well known, and incidents in both fields have taken place. To help critical infrastructure organizations manage these areas, safety and security standards have been created. The main aim of this paper is to present a framework that has been created to manage both safety and security by providing guidance on how to create a Safety and Security Management System (SSMS). The framework identifies and remediates conflicts and issues between IT, OT, safety, and security. While also creating processes that can combine safety and security compliance to standards to reduce duplication of work and allow one process to manage both areas. A survey was carried out to understand if the framework would be of use to organizations and to better understand the issues users have with managing safety and security and how they manage conflicts that can occur. The survey showed key areas of concern for organizations and how the framework can be of use to them. It identified six themes from the research and identified improvements opportunities for the framework that can be implemented.