Context and Challenge
A large cross-border pipeline operator manages several hundred kilometers of transmission infrastructure spanning three jurisdictions. The network includes compressor stations, metering sites, valve yards, and maintenance depots—some staffed around the clock, others visited only during inspections or callouts. The operational footprint had grown through a mix of expansions and acquired assets, leaving each country with its own established way of working.
The business faced a pressing need to demonstrate consistent compliance with Critical Entity Resilience (CER) requirements across all sites. While the regulatory expectations differed in language and enforcement style from one jurisdiction to the next, the common theme was clear: critical services must remain available during disruptions, and operators must be able to prove they can anticipate, withstand, respond to, and recover from a wide range of hazards.
The key challenges were practical rather than theoretical:
- Fragmented risk ownership: Security, health and safety, engineering, and operations each maintained separate risk registers with inconsistent assumptions.
- Inconsistent site baselines: Physical security controls, access management practices, and incident response procedures varied widely between countries and even between sites within the same country.
- Uneven documentation quality: Some locations had robust plans but limited evidence of testing; others had informal practices that worked in practice but were hard to audit.
- Supply chain dependency risk: Specialized parts and contractor availability differed across borders, complicating recovery time commitments.
- Cross-border escalation complexity: Incident communication pathways were optimized for national operations rather than multi-jurisdiction coordination.
The immediate trigger was an upcoming cycle of assessments and internal governance reviews. Leadership recognized that compliance would not be sustainable if it relied on local heroics and ad hoc document refreshes. A standardized, repeatable compliance model was needed—one that could satisfy CER expectations while still fitting the realities of pipeline operations.
Approach and Solution
The operator designed a program to standardize resilience and compliance without forcing every site into identical operational patterns. The goal was to create a single, defensible framework that could be “translated” into local requirements, supported by consistent evidence, and maintained with minimal friction.
1) A Unified CER Control Framework with Local Mapping
The first step was establishing a single control framework aligned to CER themes—risk assessment, resilience measures, incident response, continuity and recovery, and assurance. Instead of creating three separate compliance systems, the operator built one master set of controls and mapped each control to:
- jurisdiction-specific CER interpretations and expectations
- local laws or sectoral guidance relevant to the site type (e.g., compressor stations vs. unmanned valve sites)
- internal operational standards (engineering integrity, maintenance, safety management)
This “one-to-many” mapping allowed teams to speak one operational language while still demonstrating compliance in each jurisdiction.
Outcome of this step: a common baseline that reduced ambiguity, prevented duplicated work, and provided a clear structure for audits and self-assessments.
2) Asset and Service Criticality: Defining What Must Not Fail
CER compliance depends on clarity about what constitutes a critical service and what must be protected to keep it running. The operator conducted a structured criticality assessment that linked:
- critical pipeline services (e.g., transmission availability, pressure control)
- enabling assets (power, telecoms, compressors, control systems)
- key processes (dispatch, integrity management, emergency shutdown)
- dependencies (grid power, fuel delivery, contractors, data connectivity)
Sites were then grouped into tiers based on operational consequence and recoverability. This avoided a common pitfall: treating every site as equally critical and overspending on controls that did not materially improve resilience.
Outcome of this step: prioritized investments and differentiated requirements, while maintaining a consistent compliance narrative.
3) Standardized Risk Assessment Methodology Across Borders
Each jurisdiction had different legacy approaches to risk—some more qualitative, others more engineering-driven. A standardized risk methodology was introduced with a consistent scale and definitions for:
- threats and hazards (natural hazards, sabotage, cyber disruption, insider risk, supply chain failure)
- likelihood and impact
- existing controls and residual risk
- target risk tolerance and required treatment plans
To ensure usability, the methodology was implemented through facilitated workshops that included operations, security, engineering, maintenance, and site leadership. The process emphasized evidence-based assumptions (e.g., known flood history, historical outage patterns) and clear documentation of rationale.
Outcome of this step: comparable risk statements across all sites, enabling leadership to see risk concentration and track remediation consistently.
4) Minimum Resilience Baseline: The “Non-Negotiables”
A key deliverable was a set of minimum baseline measures applicable to all sites, regardless of jurisdiction. These were positioned as operational “non-negotiables” to simplify training, reduce compliance drift, and avoid inconsistent interpretations.
The baseline included:
- Physical security: perimeter integrity expectations, access control standards, visitor management, and alarm monitoring requirements scaled by site tier
- Operational resilience: backup power expectations, spare parts strategy for single points of failure, and minimum telecom redundancy for priority sites
- People and process: standardized shift handover requirements, incident classification triggers, and escalation pathways
- Documentation and evidence: consistent log retention, test records, and maintenance evidence needed to show control effectiveness
Where national rules required additional measures, the baseline was extended locally rather than forked into a separate system.
5) Incident Response and Cross-Border Coordination Playbooks
The operator developed a unified incident management model that worked across three jurisdictions, with playbooks tailored to common pipeline scenarios:
- compressor station outage with cascading pressure impacts
- third-party interference and suspected tampering
- extended power loss
- telecom disruption affecting remote operations
- cyber incident affecting operational technology environments
A single incident taxonomy and severity model ensured that when an event occurred in one country, it could be understood, escalated, and managed consistently across the wider network. Communication protocols were adjusted so that jurisdiction-specific reporting steps could be executed without slowing operational response.
Tabletop exercises were scheduled on a rotating basis, with at least one cross-border scenario per cycle to test coordination and decision-making under time pressure.
6) Evidence-First Compliance: Making Audits a Byproduct of Operations
To reduce the burden of proving compliance, the operator shifted from document-heavy compliance to evidence-first routines:
- standard templates for site risk registers, treatment plans, and control attestations
- a consistent testing calendar (backup power tests, alarm checks, emergency drills)
- centralized storage rules and retention periods
- clear ownership for each control and associated evidence
This approach made compliance less dependent on last-minute document collection and more embedded in routine operations.
Results
After implementation across the three jurisdictions, the operator achieved tangible improvements in both resilience and compliance readiness.
- Reduced variance between sites: The minimum baseline measures created a more consistent security and resilience posture, especially across smaller and remote sites that previously had limited formalization.
- Faster readiness for assessments: Teams no longer had to reinvent compliance artifacts for each jurisdiction. The unified control framework and mapping simplified preparation and reduced duplication.
- Clearer investment decisions: Criticality tiers and standardized risk scoring improved prioritization for upgrades such as backup power, spares, and monitoring enhancements.
- Improved cross-border incident execution: Playbooks and shared severity definitions reduced confusion during escalations and improved coordination between operational teams.
- Sustained compliance maintenance: Evidence routines and ownership assignments reduced the risk of compliance “fade” after the initial rollout.
Where outcomes were quantified internally, improvements were treated as approximate and tracked as trend indicators rather than absolute performance claims—particularly for exercise performance, evidence completeness, and remediation cycle time.
Key Takeaways
- Standardize the framework, not every local practice. A single control framework with jurisdictional mapping can unify compliance while respecting operational realities.
- Start with criticality to avoid wasting effort. Tiering sites and dependencies prevents over-control on low-consequence assets and focuses resources where resilience matters most.
- A shared risk method is the backbone of multi-country compliance. Consistent definitions for likelihood, impact, and residual risk make cross-site comparisons meaningful.
- Define a minimum baseline of “non-negotiables.” This reduces ambiguity, supports training, and improves consistency across unmanned and remote sites.
- Design incident management for cross-border execution. Shared severity levels, playbooks, and reporting pathways prevent delays during high-consequence events.
- Build compliance from operational evidence. When testing, maintenance, and monitoring generate audit-ready records by default, compliance becomes sustainable rather than cyclical.
This case demonstrates that meeting CER requirements across multiple jurisdictions is less about producing perfect documents and more about building a repeatable, evidence-based resilience system that operational teams can execute under real-world conditions.