--- title: "Critical site security monitoring | Nexus Observatory" description: "Substations, pumping stations, telecom hubs and observing sites run unstaffed. Their fences, doors and control networks are where physical and cyber attacks…" url: https://observatory.global/industries/resilience/site-security/ publisher: Nexus Observatory Inc. updated: 2026-11-02 --- [Nexus Observatory](https://observatory.global/) / [Civil resilience](https://observatory.global/industries/resilience/) / [Specialized fields](https://observatory.global/industries/resilience/fields/) / **Critical site security** # Unstaffed critical sites, guarded in the physical and the digital. Substations, pumping stations, telecom hubs and observing sites run unstaffed. Their fences, doors and control networks are where physical and cyber attacks begin. Perimeter sensing, intrusion alarms and passive watch over the control network report to one record, so operators respond before service is lost. [Plan a deployment](https://observatory.global/contact/deployment/) How it works [Station Builder](https://observatory.global/studio/builder/) **Industry**: Civil resilience **Measurements**: 5 **Sources cited**: 5 1. Civil resilience · Critical site security Where attacks begin Unstaffed substations, pumping stations and telecom hubs keep a country running, and their fences, doors and control networks are where physical and cyber attacks begin. Operators of essential services must manage both risks and report incidents. Knowing the moment a fence is crossed or a strange device appears changes the outcome. 2. What is measured Perimeter, doors and the network Radar and thermal cameras watch fence lines and approaches day and night, fixed cameras cover each detection zone, contacts watch doors, gates and cabinets, and a passive tap listens to the site control network for new devices and unusual traffic without ever sending into it. InstrumentsRadar · Thermal cameras · Fixed cameras · Door contacts · Passive network tap 3. The base node Verified before it is raised The site node fuses radar, thermal and video so animals and weather do not raise alarms, and attaches a clip to every alarm it does raise. It learns the normal devices and traffic of the control network and flags anything new, signing every event for the incident record. 4. Radio and links Two paths, one guarded Alarms and clips ride the operator's fibre to the control room through a security gateway that keeps the monitoring separate from the control network. A cellular path on another network keeps alarms flowing when the fibre is cut, often an intruder's first move. LinksFibre · Public cellular 5. How it works From a cut fence to a response At night radar picks up a person approaching a substation fence. The thermal camera confirms it, the node raises a verified alarm with a clip, and security operations sends responders and alerts the police. Control engineers check the network view: no new device has appeared. 6. From order to operation · Order Scope the sites and the threats The scope reads the operator's site list, its risk assessment under the critical entity rules, past incidents, the control system architecture and its response arrangements. Nexus Observatory Inc. returns a kit by site type, the alarm and verification design, the network monitoring design and a price per site and per year. [Plan a deployment](https://observatory.global/contact/deployment/) 7. From order to operation · Survey Survey perimeters and networks Crews walk each site type with the operator's security and control engineers: fence lines and approaches, detection zones and camera positions, entry points, the control network layout, tap points and the two backhaul paths. Findings are recorded with photographs and drawings. 8. From order to operation · Permits Access, privacy and change control Work in substations follows the operator's switching and access rules, cameras are aimed and masked to follow privacy rules for public land, and connecting a tap to the control network goes through the operator's change control. Every approval is kept with the site record. 9. From order to operation · Build Build and harden Kits are built per site type; nodes are hardened, enrolled with their identities and configured with the zones and alarm rules. The whole kit is tested together, including a simulated intrusion and an unknown device on a test control network, before it ships. [Open the Station Builder](https://observatory.global/studio/builder/) 10. From order to operation · Install Install without an outage Crews install radar and cameras on poles, contacts on doors and cabinets and the passive tap on the control network without interrupting it. Power and backhaul are connected, and every point is photographed and recorded. Crews follow the site safety plan throughout the work. 11. From order to operation · Commission Commission with a walk test Each node proves its identity. A walk test crosses every detection zone at different speeds, doors and cabinets are opened, alarms are verified in the control room and the network baseline is learned over weeks before anomaly alerts are enabled. 12. From order to operation · Operate Respond with evidence The security operations view shows every site, its alarms, verified clips and network anomalies. Responders are sent only to verified events, control engineers see unknown devices at once, and every incident is recorded for reporting to the authorities. Every alert and action is kept on the record. 13. From order to operation · Maintain Test, patch and review Detection zones are walk-tested on the agreed plan, cameras are cleaned and re-aimed, node software is patched in rings, and network baselines are reviewed after every planned change. Incident reviews feed back into zones and rules, and every change is kept with the site record. [Book field services](https://observatory.global/contact/field-service/) 14. Data products For security, control and compliance Security operations and responders receive verified alarms with clips; control system engineers receive new device and traffic alerts; resilience and compliance teams receive incident records; executives and regulators receive site risk and response reports, each tied to the site and time. [See the data products](https://observatory.global/data-products/) 15. Evidence Records the rules ask for Measures support the critical entity resilience directive and the cybersecurity directive. Intrusion detection follows the alarm system standard, video follows the surveillance standard, and control network monitoring follows the industrial automation security series. Every alarm, clip and response is signed and kept. Drawn againstDirective (EU) 2022/2557 · Directive (EU) 2022/2555 · EN 50131 · IEC 62676 · IEC 62443 16. What you get Operational-technology assurance for observing sites Identity, attestation, segmentation and monitoring for instruments and edge nodes, with evidence for audits. Stated as services, never as a security guarantee. Delivered as managed service and professional services, for operators of critical sites, agencies. Scale: Fleets of sites. Service levels are written as numbers you can measure on your own dashboard. [Talk to sales](https://observatory.global/contact/sales-enquiry/) 17. Next step Plan critical site security with us Tell us the site, the measurements and the rules it answers to. We reply with a survey proposal, a design and a scope for critical site security. An engineer replies with a survey proposal and a scope, and the plan grows from one site to the network you need, at your pace. [Plan a deployment](https://observatory.global/contact/deployment/) [Open the Station Builder](https://observatory.global/studio/builder/) [Open the Studio](https://observatory.global/studio/) **01** The place and its hazards ## Where it runs, and what can go wrong. Operating contextOperators of essential services must manage physical and cyber risks to the sites that deliver them. Critical entities are required to take resilience measures and report incidents, network and information systems must meet cybersecurity duties, industrial control systems are secured to the international series for automation security, and alarm and video systems follow their own standards. Hazards - Fence cutting and break-ins at unstaffed sites - Theft of copper, batteries and fuel - Unauthorised devices on the control network - Remote access that bypasses the operator's controls - Alarms that flood a control room with false triggers **02** What must be measured ## What, where, how often, and under which rules. Each measurement names where it is taken, how often, and the public standard or regulation behind it. Numbers in the sources column open the cited source below. | Measurement | Where | Cadence | Sources | | --- | --- | --- | --- | | Perimeter intrusion | Fences and approaches, by radar and thermal cameras | Continuous, events on detection | 12 | | Door, cabinet and gate state | Every entry point and control cabinet | On event | 1 | | Video verification of alarms | Cameras covering each detection zone | On event, with recorded clips | 3 | | Control network traffic and new devices | A passive tap on the site control network | Continuous | 45 | | Incidents and response times | Every alarm from detection to closure | Every event | 25 | **03** The observation stack ## From one base unit to a network. The same blocks at every scale: instruments and a base node, a site with its radio, a fleet run as one, and a network federated on the open protocol. 1. **01** Base unit A site point: radar, thermal and fixed cameras, door and cabinet contacts and a passive network tap on an edge node. [Build a station →](https://observatory.global/studio/builder/) 2. **02** Site A site: the node behind a security gateway, two backhaul paths and its own protected power. [Plan a site →](https://observatory.global/contact/deployment/) 3. **03** Fleet Every unstaffed site of an operator watched from one security operations view, with one incident record. [Managed offers →](https://observatory.global/industries/resilience/solutions/) 4. **04** Network Operators share incident records with authorities and sector bodies under the critical entity and cybersecurity rules. [The open protocol →](https://observatory.global/protocol/) - **01** Thermal camera - **02** Fixed camera - **03** Surveillance radar (FMCW) - **04** Edge node (Wedge) - **05** Zero-trust gateway - **06** Fibre terminal - **07** Cellular modem/router - **08** Pole Radio and links ### Fibre Most substations and pumping stations have operator fibre; alarms and clips ride it to the control room. Radio and links ### Public cellular A cellular path on another network keeps alarms flowing when the fibre is cut, often the first thing an intruder does. Edge computeThe node fuses radar, thermal and video so animals and weather do not raise alarms, verifies every alarm with a clip, learns the normal devices and traffic on the control network and flags anything new, and signs every event. PowerThe security node runs from the site's protected DC supply with its own battery, so it keeps reporting when an intruder cuts the mains. **04** How it works ## From the instrument to the product. One observation's path, tier by tier, with the interface on every link and a bill of materials below; then how the one node grows to a site, a fleet and federated networks. Critical site security: data path – of 07 01 Instruments Measurement with sensor identity andcalibration 02 Node – Wrap in an observation envelope with timequality– Measure quality and uncertainty, attachquality flags– Buffer locally (store-and-forward when thelink drops) 03 Local network 04 Backhaul Commit with transactional outbox andpublish, delivered at least once 05 Site Consumer inbox deduplicates and applieseach record once into governed data 06 Data store Governed product through API, map orexport, correction-aware 07 Products ONVIFMQTTSyslog 08 Power and structure 01 Thermal camera Ethernet 02 Fixed camera Ethernet 03 Surveillance radar(FMCW) Ethernet Passive tap on the sitecontrol network Not in the reference kit Door, gate and cabinetcontacts Not in the reference kit 04 Edge node (Wedge) Ethernet · Fibre · USB · RS-485 ·BMC 05 Zero-trust gateway Ethernet · Fibre 06 Fibre terminal Fibre · Ethernet 07 Cellular modem/router Ethernet · USB · RS-232 Site MQTT 5 with Sparkplug B Governed data store Versioned, correction-aware Verified intrusion alarms with clips New device and traffic alerts Incident records Site risk and response reports 08 Pole Ethernet · RTSP/ONVIF Ethernet · RTSP/ONVIF Ethernet · MQTT 5 Ethernet RS-485 Ethernet Fibre Ethernet Fibre LTE/NR From the instrument to the published product: each band is a tier, each connector names its interface, and the numbers match the bill of materials. Hover or focus a block to trace its path; scroll or step to follow one observation. | Item | Equipment | Data ports | Protocols | Power in | | --- | --- | --- | --- | --- | | 01 | **Thermal camera** Long-wave infrared camera for fire detection, equipment hot spots and night monitoring. | Ethernet | RTSP with ONVIF profiles, MQTT 5 | PoE | | 02 | **Fixed camera** Fixed visible-light camera for site security, scene monitoring and machine vision. | Ethernet | RTSP with ONVIF profiles, MQTT 5 | PoE | | 03 | **Surveillance radar (FMCW)** Short-range FMCW radar for perimeter, traffic, drone and water-surface detection. | Ethernet | MQTT 5, OGC SensorThings API | 12 V DC | | 04 | **Edge node (Wedge)** Rugged edge node that boots from signed media, attests itself and establishes a site cell from little or no infrastructure. | EthernetFibreUSBRS-485BMC | MQTT 5, DMTF Redfish, IEEE 1588 PTP, NTP with NTS, OPC UA | 12 V DC, 24 V DC, 48 V DC, AC mains | | 05 | **Zero-trust gateway** Gateway that terminates encrypted tunnels, enforces segmentation and gates every flow by identity and policy. | EthernetFibre | — | 12 V DC, AC mains | | 06 | **Fibre terminal** Optical network terminal or media converter that lands fibre backhaul at a site. | FibreEthernet | IEEE 1588 PTP | 12 V DC, 48 V DC, AC mains | | 07 | **Cellular modem/router** LTE or NR modem or router that uses a public carrier or private network as backhaul. | EthernetUSBRS-232 | 3GPP E-UTRA air interface, 3GPP NR air interface, OMA LwM2M | 12 V DC, PoE | | 08 | **Pole** Utility, street or dedicated pole with clamp positions. | — | — | — | How it scales 01 Instruments Arbitrary qualified sensors and instruments whosemeasurements are ingested with calibration, units,geometry, time, custody and uncertainty. ×n 02 Node The minimum useful deployable unit: server, ruggedappliance, radio node, sensor gateway, satelliteterminal, AI, scientific, vehicle or virtual node. Node Node agent 03 Site The minimum independently operable localgovernance and failure domain: one or more nodesplus local network, identity, policy, evidence,storage, products and operator surfaces. SITE Node Node Node ×n 04 Cluster An optional scale or specialisation domain forscheduling, shared storage, accelerators or datalocality. CLUSTER ×n 05 Fleet Coordinates plans, acknowledgements,convergence evidence, update campaigns andcorrection propagation across nodes and sites. FLEET Fleet controller ×n 06 Federation An exchange of products, capabilities, events orwork across approved, independently administeredtrust domains, using explicit trust, policy,data-locality, version and correction contracts. TRUST DOMAIN TRUST DOMAIN TRUST DOMAIN ×n Verifier Applications Data in the field Telemetry Control Data upstream Control Data upstream Control Exchange Evidence Events Exchange The smallest deployable unit is one node; the same unit is replicated to meet the demand. Nodes form a site, sites may form a cluster, sites and clusters are coordinated as a fleet, and fleets exchange across independently administered trust domains. Each plane is a separate channel with its own open binding. **Data in the field**: MQTT 5 with Sparkplug B; connectors for LoRaWAN, OPC UA and instrument buses. **Telemetry**: OpenTelemetry OTLP. **Control**: TLS 1.3 with mutual authentication; protobuf messages over gRPC or HTTP/2. **Data upstream**: At-least-once publication with repeat-safe keys over the control channel or NATS JetStream; QUIC MAY be used on lossy links. **Evidence**: DSSE-signed in-toto statements; SLSA provenance; SCITT transparency receipts. **Events**: Event envelopes mapped to CloudEvents 1.0; channels described in AsyncAPI 3. **Exchange**: OpenAPI 3.1; the OGC API family; SensorThings; STAC; WIS 2.0. **05** From order to operation ## Every step, from the first call to a running site. The same crew and the same record carry the work from scope to maintenance. 1. 01 Order Scope the sites and the threats The scope reads the operator's site list, its risk assessment under the critical entity rules, past incidents, the control system architecture and its response arrangements. Nexus Observatory Inc. returns a kit by site type, the alarm and verification design, the network monitoring design and a price per site and per year. 2 2. 02 Survey Survey perimeters and networks Crews walk each site type with the operator's security and control engineers: fence lines and approaches, detection zones and camera positions, entry points, the control network layout, tap points and the two backhaul paths. Findings are recorded with photographs and drawings. 4 3. 03 Permits Access, privacy and change control Work in substations follows the operator's switching and access rules, cameras are aimed and masked to follow privacy rules for public land, and connecting a tap to the control network goes through the operator's change control. Every approval is kept with the site record. 4. 04 Build Build and harden Kits are built per site type; nodes are hardened, enrolled with their identities and configured with the zones and alarm rules. The whole kit is tested together, including a simulated intrusion and an unknown device on a test control network, before it ships. 4 5. 05 Install Install without an outage Crews install radar and cameras on poles, contacts on doors and cabinets and the passive tap on the control network without interrupting it. Power and backhaul are connected, and every point is photographed and recorded. Crews follow the site safety plan throughout the work. 6. 06 Commission Commission with a walk test Each node proves its identity. A walk test crosses every detection zone at different speeds, doors and cabinets are opened, alarms are verified in the control room and the network baseline is learned over weeks before anomaly alerts are enabled. 1 7. 07 Operate Respond with evidence The security operations view shows every site, its alarms, verified clips and network anomalies. Responders are sent only to verified events, control engineers see unknown devices at once, and every incident is recorded for reporting to the authorities. Every alert and action is kept on the record. 5 8. 08 Maintain Test, patch and review Detection zones are walk-tested on the agreed plan, cameras are cleaned and re-aimed, node software is patched in rings, and network baselines are reviewed after every planned change. Incident reviews feed back into zones and rules, and every change is kept with the site record. **06** Data products and integration ## What it delivers, to whom, and into which systems. Data products - **Verified intrusion alarms with clips** Security operations and responders - **New device and traffic alerts** Control system engineers - **Incident records** Resilience and compliance teams - **Site risk and response reports** Executives and regulators Integration - **Security operations** Verified alarms reach the operator's alarm receiving platform through its own interfaces. - **Control system** Network anomalies are sent to the operator's security monitoring, never into the control system itself. - **Incident reporting** Records are exported for notification to the competent authorities. Exchanged through ONVIF, MQTT, Syslog. **07** Questions buyers ask ## Before you scope it. Does the tap touch our control system? It is passive: it listens and never sends into the control network. Will animals set off alarms? Radar, thermal and video are fused so most animals and weather are filtered. Does it help with reporting duties? Yes. Incident records hold what authorities ask for. Can it run if the fibre is cut? Yes. Alarms switch to a cellular path on another network. **08** Resources ## The sources behind this page. Public standards, regulations and guidance, cited where they apply. Each applies only where its jurisdiction or scope does. 1. **1** [EN 50131: Alarm systems, intrusion and hold-up systems](https://www.cenelec.eu/) European Committee for Electrotechnical Standardization 2. **2** [Directive (EU) 2022/2557 on the resilience of critical entities](https://eur-lex.europa.eu/) European Union · 2022 3. **3** [IEC 62676: Video surveillance systems for use in security applications](https://webstore.iec.ch/) International Electrotechnical Commission 4. **4** [IEC 62443: Security for industrial automation and control systems](https://webstore.iec.ch/) International Electrotechnical Commission 5. **5** [Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union](https://eur-lex.europa.eu/) European Union · 2022 **09** Related ## Use cases and solutions. [Solution Operational-technology assurance for observing sitesIdentity, attestation, segmentation and monitoring for instruments and edge nodes, with evidence for audits.Solutions for civil resilience →](https://observatory.global/industries/resilience/solutions/#ot-site-assurance) [Solution Structural and ground-movement monitoringGNSS, InSAR, tilt, strain and fibre sensing on bridges, dams, slopes, tailings and pipelines, with alert thresholds set by the owner.Solutions for civil resilience →](https://observatory.global/industries/resilience/solutions/#infrastructure-monitoring) [Solution Power-grid edge and right-of-way monitoringLine temperature and sag, vegetation encroachment from EO and LiDAR, substation sensors and fire-weather at the right-of-way.Solutions for civil resilience →](https://observatory.global/industries/resilience/solutions/#grid-edge-monitoring) **10** Civil resilience: specialized fields ## Other fields of this industry. [Specialized field Timing integrityTime references with holdover and monitoring for grids, telecom and finance, so a country's critical systems keep accurate time when satellite signals are jammed, spoofed or lost.The full field →](https://observatory.global/industries/resilience/timing-integrity/) [Specialized field Backup power at critical sitesGenerators, fuel, batteries and transfer switches at hospitals, water plants and telecom hubs, monitored and tested so backup power starts when the grid fails.The full field →](https://observatory.global/industries/resilience/backup-power/) [Specialized field Northern and Arctic observingWeather, permafrost, ground movement and river and lake ice stations for northern civil authorities, built for polar night, deep cold and satellite-only backhaul.The full field →](https://observatory.global/industries/resilience/arctic-observing/) ### Bring us the site. Plan a deployment, configure a station, model it in the Studio or talk to sales. The form names who receives your details. [Plan a deployment](https://observatory.global/contact/deployment/) [Station Builder](https://observatory.global/studio/builder/) [Open the Studio](https://observatory.global/studio/) [Talk to sales](https://observatory.global/contact/sales-enquiry/) [Request a quote](https://observatory.global/contact/hardware-quote/) [Nexus Observatory](https://observatory.global/)**Civil resilience** . Infrastructure that reports before it fails.[Talk to us](https://observatory.global/contact/) Civil resilience - [Overview](https://observatory.global/industries/resilience/) - [Explainer](https://observatory.global/industries/resilience/explainer/) - [Specialized fields](https://observatory.global/industries/resilience/fields/) - [Use cases](https://observatory.global/industries/resilience/use-cases/) - [Solutions](https://observatory.global/industries/resilience/solutions/) - [Platforms](https://observatory.global/industries/resilience/platforms/) - [Resources](https://observatory.global/industries/resilience/resources/) - [Contact](https://observatory.global/industries/resilience/contact/) Platforms - [Observatory Protocol](https://observatory.global/protocol/) - [Protocol & Grid](https://observatory.global/grid-services/) - [Software](https://observatory.global/software/) - [Hardware & power](https://observatory.global/hardware/) - [Sensors & instruments](https://observatory.global/sensors/) - [Connectivity](https://observatory.global/connectivity/) - [Edge compute & AI](https://observatory.global/edge-ai/) - [Earth observation & GeoAI](https://observatory.global/earth-observation/) - [Space and satellite systems](https://observatory.global/space/) - [Digital twins and simulation](https://observatory.global/digital-twins/) - [Data & licensing](https://observatory.global/data-products/) - [Field services](https://observatory.global/field-services/) - [Frontier labs](https://observatory.global/labs/) Solutions - [Early warning](https://observatory.global/use-cases/street-flood/) - [Wildfire and fire weather](https://observatory.global/use-cases/wildfire-camera/) - [Environmental compliance](https://observatory.global/use-cases/methane-fenceline/) - [Asset monitoring](https://observatory.global/industries/infrastructure/) - [Private networks](https://observatory.global/connectivity/private-5g/) - [Remote power and sites](https://observatory.global/use-cases/remote-microgrid/) - [Climate and resilience](https://observatory.global/industries/climate/) - [Site twins](https://observatory.global/digital-twins/) - [Data licensing](https://observatory.global/data-products/) Industries - [Public safety](https://observatory.global/industries/public-safety/) - [Government](https://observatory.global/industries/government/) - [Cities](https://observatory.global/industries/cities/) - [Civil resilience](https://observatory.global/industries/resilience/) - [Communities](https://observatory.global/industries/communities/) - [Humanitarian](https://observatory.global/industries/humanitarian/) - [Climate](https://observatory.global/industries/climate/) - [Water](https://observatory.global/industries/water/) - [Nature](https://observatory.global/industries/nature/) - [Oceans](https://observatory.global/industries/oceans/) - [Agriculture](https://observatory.global/industries/agriculture/) - [Energy](https://observatory.global/industries/energy/) - [Telecom](https://observatory.global/industries/telecom/) - [Transport](https://observatory.global/industries/transport/) - [Infrastructure](https://observatory.global/industries/infrastructure/) - [Mining](https://observatory.global/industries/mining/) - [Industry](https://observatory.global/industries/industry/) - [Research](https://observatory.global/industries/research/) - [Education](https://observatory.global/industries/education/) - [Health](https://observatory.global/industries/health/) - [Insurance and finance](https://observatory.global/industries/insurance/) - [Events](https://observatory.global/industries/events/) Products - [Field Deployment Studio](https://observatory.global/studio/) - [Station Builder](https://observatory.global/studio/builder/) - [Field services](https://observatory.global/field-services/) - [Data products](https://observatory.global/data-products/) - [APIs and SDKs](https://observatory.global/protocol/developers/) - [Edge runtime and fleet](https://observatory.global/software/) - [Hardware catalogue](https://observatory.global/hardware/) - [Reference designs](https://observatory.global/protocol/reference-designs/) Resources - [Learn](https://observatory.global/learn/) - [Stories](https://observatory.global/stories/) - [Environments](https://observatory.global/environments/) - [Network scenes](https://observatory.global/environments/networks/) - [Observatories atlas](https://observatory.global/observatories/) - [Earth and maps](https://observatory.global/earth/) - [Technologies](https://observatory.global/technologies/) - [Countries](https://observatory.global/countries/) - [Spectrum](https://observatory.global/spectrum/) - [Specification](https://observatory.global/protocol/specification/) - [Conformance](https://observatory.global/protocol/conformance/) - [Open source](https://observatory.global/open/) - [Data credits](https://observatory.global/credits/) Company - [About](https://observatory.global/about/) - [Open governance](https://observatory.global/consortium/) - [Security and trust](https://observatory.global/security/) - [Contact sales](https://observatory.global/contact/) - [Privacy requests](https://observatory.global/privacy-request/) © 2026 Nexus Observatory Inc. [Security and trust](https://observatory.global/security/) [Privacy choices](https://observatory.global/privacy-choices/) [Accessibility](https://observatory.global/legal/accessibility/) [Privacy](https://observatory.global/legal/privacy/) [Terms](https://observatory.global/legal/terms/)