Security Policy

What is a safety and security policy?

A safety and security policy, filed here as security policy after the Dutch veiligheidsbeleid, is the documented set of principles, responsibilities, procedures and measures through which an organisation systematically safeguards the safety and health of employees, installations and processes. In the Netherlands it is how an employer meets Article 3 of the Working Conditions Act: the employer must ensure safety and health at work and pursue a policy aimed at the best possible working conditions. In industrial plants the policy also covers the digital side, because control systems in OT determine whether a machine stops safely and whether a process stays within its limits.

A sound safety and security policy complies with the Working Conditions Act, is based on the organisation’s real risks, and is visibly embedded in day-to-day work.

🧠 What does a safety and security policy contain?

A workable policy is short at the top level and refers to procedures for the detail. Almost every policy contains these five building blocks:

1. Vision and accountability - safety as a core value, an explicit statement by senior management and named roles, such as the prevention officer required by Article 13 of the Working Conditions Act, an HSE manager and line managers with their own safety duties.
2. Risk inventory - the written RI&E (risk inventory and evaluation) with its action plan (Article 5), supplemented by technical risk assessments such as a HAZOP for process plants.
3. Preventive measures - technical: guarding, emergency stops, Lock-out Tag-out and PPE; organisational: work permits, the LMRA and training.
4. Procedural framework - work instructions, emergency plans and evacuation (Article 3 requires measures for first aid, firefighting and evacuation), plus a structure for reporting and following up incidents and near misses.
5. Continuous improvement - objectives, measurements, audits, safety observations and a periodic management review following the PDCA cycle.

The order of measures is fixed by the hierarchy of controls in Article 3, known in Dutch as the occupational hygiene strategy: tackle the hazard at source first, then apply collective protection, then individual measures, and only as a last resort personal protective equipment. A policy that consists mostly of PPE rules turns that order upside down.

⚖️ Which laws and standards require a safety and security policy?

The policy is not optional. Several frameworks require it, each with its own emphasis:

ISO 45001 lists in clause 5.2 six commitments that the policy must contain: providing safe and healthy working conditions, providing a framework for objectives, fulfilling legal and other requirements, eliminating hazards and reducing risks, continual improvement, and consultation and participation of workers. The policy must be documented, communicated within the organisation and available to interested parties as appropriate. Clause 5.4 additionally requires that non-managerial workers are consulted when the policy is established.

For Seveso establishments, the major accident prevention policy must be reviewed at least every five years, and the safety management system has seven fixed elements, including management of change and planning for emergencies.

🔄 How does it differ from an information security policy?

In Dutch, veiligheid (safety) and beveiliging (security) are easily confused, which is why this policy is sometimes translated as a security policy. Its focus is preventing injury, occupational disease and major accidents. The information security policy covers the availability, integrity and confidentiality of information and systems.

They remain separate documents with different owners, but they overlap in OT. An attack on a safety PLC or a manipulated control loop is a cyber incident with a safety risk. That is why both policies refer to each other and are often housed in one integrated management system.

🏭 How does the policy work in industrial environments?

In factories and process plants the policy has to become concrete for many kinds of work:

• Machines and processes - manufacturing, chemicals, energy and food, with a risk assessment per machine and per change.
• Technical installations - electrical work under NEN 3140, hydraulics and pneumatics, with stored energy that is released during maintenance.
• Special conditions - working at height, in confined spaces or in explosive atmospheres (ATEX).
• Control and networks - work on PLCs, drives, control cabinets and the OT network, where a software change can have the same effect as a loosened guard.

A safety and security policy must align with day-to-day practice, drawing on input from operators, technicians and engineers.

🔐 How do you include OT security in the policy?

Now that machines and process plants are networked, a digital change can have a physical consequence. The policy does not need to become a cybersecurity handbook, but it should contain these hooks:

• Changes - changes to PLC programs, setpoints and safety functions go through change management and the work permit, just like mechanical changes.
• Access - physical and digital access control for control cabinets, engineering workstations and remote access, including for suppliers.
• Separation - network segmentation between the office network and OT, so that an IT incident cannot affect a safety function.
• Maintenance - patch management that takes the validation of safety systems under functional safety and IEC 61511 into account.
• Awareness - security awareness as part of the safety induction.

Product legislation is moving in the same direction: from 20 January 2027 the Machinery Regulation requires the control systems of new machinery to be protected against corruption. Seveso legislation does not mention cybersecurity explicitly, but Seveso establishments are expected to include OT security in their safety management system, because a compromised safety system can cause a major accident. Inspectors treat IEC 61511 as the state of the art, and since its 2016 edition clause 8.2.4 of that standard requires a security risk assessment of the safety instrumented system.

🔧 How do you draw up a safety and security policy?

A practical approach for an industrial organisation:

1. Map your obligations - the Working Conditions Act and Decree, sector rules, Seveso, the Cybersecurity Act and customer requirements such as VCA.
2. Use the RI&E as the basis - the policy follows from the largest risks, not from a template.
3. Define roles - senior management, prevention officer, line managers, and for OT a contact person who works with the CISO.
4. Involve employees - Article 12 of the Working Conditions Act requires cooperation, and the works council has a right of consent on working conditions arrangements.
5. Write a short policy, worked out in procedures - one to two pages of policy, with procedures for LOTO, work permits and incident reporting.
6. Communicate and train - at onboarding, at every change and for temporary staff and contractors (Article 8 of the Working Conditions Act).
7. Measure and improve - track accidents, near misses and audit findings, and review the policy with senior management at least once a year.

❓ Frequently asked questions

Is a safety and security policy a legal requirement?

Yes, Article 3 of the Dutch Working Conditions Act requires every employer to pursue a policy aimed at the best possible working conditions. The law prescribes no format, but the mandatory RI&E with its action plan is in practice the written basis of that safety and security policy. Seveso establishments must also draw up a major accident prevention policy.

Who is responsible for the safety and security policy?

The employer, in practice senior management, is ultimately responsible for the safety and security policy. The prevention officer, the HSE manager and line managers implement it, and under the Working Conditions Act employees are obliged to cooperate and to work safely. ISO 45001 explicitly places the establishment of the policy with top management.

How often should a safety and security policy be reviewed?

A safety and security policy should be updated whenever working methods, installations or risks change, just like the RI&E. Organisations certified to ISO 45001 review the policy at planned intervals in the management review, usually once a year. For Seveso establishments, the major accident prevention policy must be reviewed at least every five years.

Does cybersecurity belong in a safety and security policy?

Cybersecurity belongs in a safety and security policy as an interface, while the details sit in the information security policy. The safety and security policy ensures that changes to control systems go through work permits and change management and that safety systems are protected. This keeps a cyber incident with consequences for people visible in both documents.

What is the difference between a safety and security policy and an RI&E?

The RI&E is the inventory of risks with an action plan, while the safety and security policy is the overarching framework that determines how the organisation deals with those risks. The policy sets objectives, roles and principles; the RI&E supplies the concrete risks and measures. Without an up-to-date RI&E, a safety and security policy lacks its factual basis.

Does a contractor need its own safety and security policy?

A contractor with employees falls under the Working Conditions Act itself and therefore needs its own safety and security policy. Many industrial clients also require VCA certification, where the VCA** level also assesses the SHE structure and SHE policy. On the client’s site, the client’s work permits and site rules apply as well.

📌 In summary

A safety and security policy is the backbone of a safe working environment: it translates the Working Conditions Act and the RI&E into objectives, roles, procedures and continuous improvement.

The policy follows the hierarchy of controls, is drawn up together with employees and aligns with standards such as ISO 45001 and VCA. In industrial environments it refers to the information security policy, because changes to control systems and attacks on OT systems can directly affect the safety of people and installations.