Authorization Is
Not a Certificate.
Five Gates. Most Providers Clear One.
Critical infrastructure deployment requires sequential clearance through five independent verification layers. Each layer has a different authority, a different lead time, and a different documentation standard. Standard agencies verify qualifications. CNI clearance is gate four.
Six Sub-Sectors. One Compliance Framework.
Power Generation & Distribution
Thermal, hydro, nuclear, substations, transmission, distribution. CNI clearance mandatory.
Power generation assets are tier-1 CNI. Every worker with OT access requires NIS2-aligned vetting and destination-country security clearance. Authorization is employer-specific — BS 7671/VDE 0100/NF C 18-510 competency assessed per destination grid operator. CNI vetting initiated at programme start: 6-9 month lead time cannot be absorbed mid-programme.
Renewable Energy
Onshore/offshore wind, solar PV, battery storage, hydrogen electrolysis.
GWO certification verified against issuing RTO records — not self-declared. BESS roles require high-voltage DC competency rarely tested by standard agencies. Offshore deployment: HUET/BOSIET in addition to GWO. Manufacturer-specific service training (Siemens Gamesa, Vestas, Nordex) assessed separately — not inferred from GWO.
Water & Wastewater
Treatment plants, pumping stations, pipeline networks, desalination.
Water infrastructure classified as essential service under NIS2 — OT security obligations apply. SCADA technicians accessing control systems require NIS2-aligned vetting documentation. Chemical handling competency assessed against destination-country COSHH/TRGS equivalents. Process safety documentation required for high-consequence sites.
Telecommunications
Fibre optic, 5G infrastructure, data centres, FTTH deployment.
Telecoms CNI classification varies by operator and asset type — backbone infrastructure may require enhanced vetting. Fibre splicing competency assessed against destination-country standards. Tower climbing: IRATA or national equivalent (FISAT DE, SCA UK). Data centre facilities: EN 50600 tier classification awareness.
Oil & Gas Downstream
Refineries, LNG terminals, gas distribution, storage facilities.
ATEX-rated electricians must hold Ex certification to IEC 60079 standards — zone-specific, not generic. Pipefitters on pressure systems: PED category I-IV scope-matched per vessel classification. CNI security clearance mandatory for LNG terminals and strategic storage. COMAH (UK) / Seveso III (EU) safety case obligations drive vetting depth.
Smart Grid & OT
AMI, demand response, grid-edge computing, SCADA, energy management systems.
OT-layer access is the highest-risk utilities category. IEC 62443 security awareness mandatory. NIS2 Article 21(2)(i) obligation is explicit for all personnel with OT access — not interpretable as optional for contractors. SCADA/DCS platform-specific training (ABB, Siemens, Schneider) verified against employer records, not assumed from generic certification.
Authorization Resets. Every Time.
BA4/BA5 under EN 50110-1 is not a certificate you carry. It is a formal employer authorization, issued per site, renewed when the worker changes employer. A worker authorized on one network cannot operate on another without reauthorization. Standard agencies don't track this — BSS builds it into every deployment.
Worker authorized by Employer A. Contract ends. Employer B must re-assess and re-issue Schaltberechtigung before first switching operation. Authorization from Employer A: void.
Habilitation électrique (NF C 18-510) is employer-issued. Employer change = new habilitation required. Previous level B2V/BC document: not valid at new employer without re-assessment.
BEI authorization for HV under NEN 3840 is employer-specific. Transfer to new employer requires new BEI designation. Worker cannot operate HV switchgear on arrival.
Network operators (National Grid, Scottish Power, UKPN) issue their own switching authorisation. Authorization from one network operator is not valid at another. New employer = new authorization.
Elektrofachkraft status per §3 DIN VDE 1000-10 is employer-issued. Worker cannot self-designate as EFK at new employer. DGUV Vorschrift 3 compliance requires re-assessment.
B1 habilitation is employer-issued with annual renewal. Change of employer triggers new habilitation. No transfer mechanism exists.
EVT (Elektrotechnisch Verantwoordelijke) designation under NEN 3140 is employer-issued. Worker qualification assessed against employer-specific installation scope.
BS 7671 qualification is portable but employer site authorization is not. Most network operators and large contractors require their own internal authorization before unsupervised LV work.
Ex competency certificate is portable. Site-specific zone authorization remains employer-issued. Worker cannot enter ATEX zone without site authorization from new employer regardless of certificate.
Formation habilitation ATEX certificate is portable. Employer must still issue zone-specific authorization per NF C 18-510. Certificate does not equal site authorization.
ATEX competency certification is portable but zone authorization at specific plant requires employer re-issuance. Valid CompEx equivalent still requires site authorization.
CompEx certificate is genuinely portable across employers. However, specific zone classification authorization at each site is employer-issued. CompEx allows work to begin faster — zone authorization still required.
Worker's SÜG clearance is tied to employing entity. New employer requires new SÜG application. BSI KRITIS OT access authorization: non-transferable. No bridging mechanism.
DGSI enquête is specific to employing entity and access scope. OIV status obligations require new vetting on employer change. Worker may have no access on day one.
VGB (Verklaring van Geen Bezwaar) is specific to sensitive position. New employer, new VGB required. Cannot transfer. OT access authorization by employer is separate and non-portable.
UK security clearance (SC/DV) is sponsored by employing entity. Change of employer requires new sponsorship and new vetting application. DV clearance: 6-9 months. Infrastructure still unstaffed.
BSS initiates employer-specific authorization documentation from day one of deployment — not after assignment confirmation. Every change of employer, site, or jurisdiction triggers a fresh authorization workflow. We track this across the full deployment lifecycle.
Five Roles. Distinct Authorization Chains.
BA5 is not a certificate. Reissued by every employer. CNI clearance adds 6-9 months.
CompEx/Ex-cert is portable. Zone assignment and site-specific authorization is not.
GWO is a safety baseline, not a competency standard. Manufacturer training is separate and employer-specific.
OT access is the highest-risk utilities category. No agency track record. NIS2 awareness at 3%.
Water infrastructure is NIS2 essential service. OT access obligations apply. Most agencies don't know.
Regulatory Exposure by Market.
Hover any country for full vetting, authorization, and posting obligations. Full regulatory mapping provided during technical scoping.
Germany operates KRITIS framework (BSI-KritisV). Electrical authorization (Schaltberechtigung, Elektrofachkraft) is Bundesland-specific — no single national authority. DIN VDE 1000-10 governs personnel qualification. DGUV Vorschrift 3 mandates annual installation testing. IT-SiG 2.0 and NIS2 both apply. A1 certificate required. SOKA-EWL posting notification.
France classifies critical operators as OIV and OSE. Habilitation électrique (NF C 18-510): 30+ authorization levels (B0 through H2V) per voltage and work type. Employer-issued, annual renewal. ANSSI coordinates NIS2 implementation. SIPSI portal for posted worker notification. DREETS enforcement.
Dutch electrical authorization: NEN 3140 (LV), NEN 3840 (HV). BEI and VIAG for specialist work. Vitale Infrastructuur classification for energy, water, telecoms, transport. ACM regulates electricity and gas networks. NIS2 via Wet Cyber Weerbaarheid. A1 certificate required. WOR notification.
CPNI and NCSC coordinate CNI security requirements. NSI Act 2021 has workforce implications for sensitive roles. Electrical authorization: 18th Edition BS 7671 for LV, network-operator-specified for HV. CompEx for hazardous area. ECS card for site access. Post-Brexit: skilled worker visa required. NIS2 equivalent via NIS Regulations 2018.