The threshold served as the regulatory starting point for the project, but it was not the ultimate objective. For the operator of a thermal Waste-to-Energy Plant, 3-core developed a security concept that integrates regulatory requirements, site-specific operating conditions, the identified threat and risk environment, and planned facility expansions. The central question was how risk analysis could transform a critical facility into a demonstrably secure, resilient, and auditable site.
Our costumer operates a thermal Waste-to-Energy Plant for the recovery of municipal solid waste. The facility generates electricity and supplies district heating. The site therefore performs not only a waste-management function, but also forms part of infrastructure relevant to the supply of energy and heat.
A particularly important factor was the annual volume of municipal solid waste processed. In this case, the applicable threshold is 79,500 tonnes per year. With an actual annual throughput of more than 300,000 tonnes, the facility significantly exceeds this threshold. It must therefore be classified as a critical facility and assessed on the basis of a risk analysis.
For the project, this meant that the scope extended beyond conventional physical site protection. The objective was to develop a security concept integrating regulatory requirements, operational criticality, physical protection measures, alarm and notification procedures, documentation, and continuous improvement.
The site is scheduled for future expansion. The plans include additional facility areas and dedicated construction site compounds. During the construction phase, increased construction traffic, temporary storage areas, external contractors, and new traffic routes are expected.
The security concept therefore had to reflect not only the current site conditions, but also anticipated future changes. Construction phases, modified access points, and an increased number of people on site can significantly alter the risk analysis and the overall risk profile.
Das Sicherheitskonzept wurde entlang von sechs Schutzzielen und den Schwellenwert der Anlage aufgebaut. Diese bildeten den roten Faden für Risikoanalyse, IST-Bewertung, Schutzzonenkonzept und technische Systemanforderungen.
Prevention: Prevent security incidents wherever possible before they occur—for example through clear policies, physical security measures, and controlled access.
Detection: Identify anomalies and security-relevant events at an early stage, allowing sufficient time for assessment and response.
Identification and Verification: Review and assess alerts to determine whether they relate to an actual incident, a technical malfunction, or a false alarm.
Intrusion Delay: Delay and impede unauthorized actions so that critical areas cannot be reached immediately.
Response: Respond effectively to verified incidents through clearly defined responsibilities, alarm and notification procedures, and escalation processes.
Documentation: Record incidents, decisions, and measures in a traceable manner to provide evidence and support the continuous improvement of security processes.
This protection logic ensured that individual measures were not considered in isolation. Each recommendation had to contribute to the effectiveness of the overall security chain.
The risk analysis covered natural hazards such as flooding, heavy rainfall, storms, earthquakes, and wildfires, as well as technical failures and various threat actor profiles. Risks were also assessed at country, corporate, and site level.
The site’s existing security posture was subsequently evaluated. The focus was not on isolated findings, but on whether the perimeter, access points, detection and verification systems, and organizational processes collectively formed an effective layer of protection.
The analysis included, among other aspects:
Adjacent pathways, wooded areas, transport routes, visibility into the site, and planned construction logistics were particularly relevant to the assessment.
A key outcome of the risk analysis was a risk-based security zoning concept. It integrates the facility’s regulatory classification based on the applicable threshold with protection requirements, threat actor profiles, assumed tool categories, and the required resistance time.
The objective was not to apply the same level of protection to all areas, but to implement graduated security measures based on criticality and threat exposure. Particularly sensitive areas require more stringent access control, physical separation, detection, verification, and response measures.
An additional key consideration was whether security zones could be bypassed or circumvented—for example through secondary routes, temporary construction access points, or gaps in organizational processes.
“We knew that our site was of particular strategic importance. The security zoning concept showed us where the critical areas are actually located, which protection lines are required, and how security can be managed in a transparent and traceable manner.”
The security zoning concept was used to derive system requirements for security monitoring and alarm management.
These included:
An effective system must do more than simply report events. It must enable events to be assessed, prioritized, escalated, and documented. This level of traceability is particularly important for a facility that significantly exceeds the relevant threshold.
The result was a security concept that treats the site as a critical facility while also taking its future development into account.
The costumer received a robust basis for:
The key added value was that the security concept did not end with the applicable threshold. It translated the regulatory classification into specific, auditable, and continuously updatable security requirements.
3-core GmbH reviewed the regulatory requirements applicable to the site and assessed the implications of exceeding the relevant threshold for the risk analysis, resilience requirements, protective measures, and the documentation and evidence of compliance.
The 3-core team assessed the criticality of the site and conducted a risk analysis of relevant hazards and threats, including natural events, technical failures, various threat actor profiles, and risks at country, corporate, and site level.
The 3-core team analyzed the site’s existing security posture. The assessment covered, among other aspects, perimeter protection, access points, buildings, detection and verification systems, organizational processes, and potential social engineering risks.
Finally, 3-core GmbH derived recommendations from the risk analysis relating to security awareness, documentation and evidence of compliance, the regular review and updating of the security concept, and the consideration of future site expansions and construction phases.
You are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Facebook. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Instagram. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from X. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information
