What Oil & Gas Operators Expect of Security Officers: Competence, Safety and Compliance

Industry Insight · Extractives

What an oil and gas operator expects of the security officer at its gate is remarkably consistent from the Niger Delta to Kazakhstan to the Albertine Graben. That is not because any one country is being held to an unusual standard. It is because the industry converged on this position a quarter of a century ago, and the reasons it did are operational, financial and — above all — about safety.

Security requirements in operator contracts are sometimes read as procurement formality: a schedule of clauses to be acknowledged, signed and filed. That reading survives right up to the moment a contractor is asked to produce competence evidence at an audit and finds it holds certificates of attendance where it needed records of assessment.

It is worth setting out where these expectations come from and why they exist — not from the regulator’s side, but from inside the operator’s own risk model.

The Voluntary Principles on Security and Human Rights were established in 2000, when the governments of the United States and the United Kingdom, extractive companies and non-governmental organisations created a common framework for providing security to operations in a manner that respects human rights (US Department of State, n.d.). The participant list reads as a roll-call of the industry — among them Shell, BP, Chevron, ExxonMobil, ConocoPhillips, Eni, Repsol, TotalEnergies and Woodside on the energy side, alongside Anglo American, AngloGold Ashanti, Barrick, BHP, Glencore, Newmont, Rio Tinto and Vale in mining (Voluntary Principles Initiative, n.d.b). Although developed for the extractive sector, the Principles are now applied well beyond it (Voluntary Principles Initiative, n.d.c).

The framework has three limbs: risk assessment, relations with public security forces, and relations with private security providers. It is the third that matters here, and its expectations are unambiguous. Private security should act consistently with the law and international guidelines, and hold policies on appropriate conduct and the use of force. Services should be preventative and defensive. Individuals implicated in human rights abuses should not provide security services. Incidents involving the use of physical force should be investigated and reported. And companies should include the Principles in their contract agreements with private security providers, and ensure their personnel are trained (Voluntary Principles Initiative, n.d.a).

Look at how that is implemented and the consistency is striking.

• Shell states that its group companies have implemented the Voluntary Principles since their development in 2000, that it incorporates them into its core security-related processes and contracts, that it carries out annual risk assessments and implementation plans, and that it delivers training and awareness briefings with the security forces it relies upon (Shell, 2022). Its reporting to the initiative records private security personnel being trained on the Principles as part of their contractual obligations (Shell, n.d.).
• TotalEnergies has been a member of the initiative since 2012 (TotalEnergies, n.d.b), states that personnel assigned to protect its people and facilities are vetted and have received adequate training, and carries out annual assessments of the human rights risks attached to its security activities (TotalEnergies, n.d.a). It requires certification against the International Code of Conduct for Private Security Service Providers in regions of heightened security risk (ICoCA, 2024).
• CNOOC Uganda, operator of the Kingfisher production licence, sets out in published expression-of-interest notices the criteria it applies to service providers: registration on the National Supplier Database maintained by the Petroleum Authority of Uganda; experience of HSE policy, procedures and processes compliant with Ugandan petroleum regulations, ISO performance standards and international industry standards; suitably qualified and experienced personnel; compliance with national content law; and possession of relevant certifications and approvals from national and international bodies (CNOOC Uganda Limited, 2025).

IOGP notes that over the past thirty years there has been a growing trend towards greater use of contractors across oil and gas operations (IOGP, n.d.), and managing HSE across that contracted workforce is precisely why IOGP Report 423 exists — the industry’s guidance on health, safety and environmental management throughout the life of a contract, updated in 2017 to place further emphasis on collaboration between clients and contractors, their respective responsibilities including subcontracting, and a focus on risk management and assurance mechanisms (IOGP, 2017).

Security is a contracted service. There is nothing in that framework that carves it out. The operator pre-qualifies the provider, defines competence requirements, inducts the workforce, monitors performance, audits against the contract and holds the contractor to enforceable HSE terms. Operators staff for this: roles exist specifically to supervise and audit contractors and third-party vendors against the company’s safety management system, applicable industrial standards and national law, and to track contractor HSE reporting on weekly, monthly, quarterly and annual cycles (CNOOC Uganda Limited, 2024).

So a security provider is scrutinised the way a drilling or civils contractor is scrutinised. That is not security being singled out. It is security being treated consistently — and providers who have built genuine assessed competence into their model find that consistency works strongly in their favour.

The clearest way to understand the operator’s position is to stop thinking of the gate as a commercial threshold and start thinking of it as a barrier in the process safety sense — one of the layers of protection standing between normal operations and a major accident.

Consider what the officer at that barrier actually controls.

• Who is on the facility. Access control determines whether every person inside the fence has been inducted, is competent for the work and is accounted for. If that control is weak, the muster list is wrong — and the muster list is what tells an incident commander whether anyone is still inside.
• What comes onto the facility. Search and vehicle control at a hydrocarbon site is not principally theft prevention. It is ignition source control, contraband control and the first defence against deliberate interference with plant.
• What happens in the first minutes. On a remote well pad or pump station the security officer is frequently the first person on scene and, until help arrives, may be the only trained responder present. Definitive medical care can be hours away.
• Whether the emergency plan works. Gate control during an evacuation, marshalling emergency services, keeping access routes clear and holding a cordon are security tasks sitting directly on the critical path of the emergency response plan.

The industry’s own instinct here is instructive. OPITO — the global not-for-profit skills body for the energy industry — developed the International Minimum Industry Safety Training standard as a programme introducing the key safety elements required by all employees working in the oil and gas industry. It comprises nine mandatory units, and certification is renewed on a four-year cycle through a further standard (OPITO, n.d.a; OPITO, n.d.b). Requirements vary by site, by operator and by contract, and each must be read on its own terms. But the principle is instructive: a minimum framed around employees generally rather than particular job titles, and renewed rather than issued once.

The consequence follows plainly. A security lapse at an upstream facility does not produce a security incident. It produces a fire, a spill, an injury, an unplanned shutdown or a fatality — and those are the categories the operator, the regulator and the insurer all count.

What the lenders require

IFC Performance Standard 4 is frequently mistaken for a corporate responsibility document. It is not. It is a financing standard: IFC requires its clients to apply the Performance Standards to manage environmental and social risks and impacts, and notes that they may also be applied by other financial institutions (IFC, 2012). Its security provisions are obligations placed on the client — meaning the operator — and not on the security company.

Under paragraph 12, an operator retaining direct or contracted workers to provide security must assess the risks its security arrangements pose to those within and outside the project site; be guided by the principles of proportionality and good international practice in relation to hiring, rules of conduct, training, equipping and monitoring; make reasonable inquiries to ensure that those providing security are not implicated in past abuses; train them adequately in the use of force and, where applicable, firearms, and in appropriate conduct toward workers and affected communities; sanction no use of force except for preventive and defensive purposes in proportion to the threat; and provide a grievance mechanism for affected communities to raise concerns about the security arrangements and the acts of security personnel (IFC, 2012).

Every one of those obligations is discharged through the contractor. If the contractor cannot evidence the training, the operator cannot evidence the condition — and it is the operator that answers to the lender.

What the insurers are looking at

The insurance logic applies to any major hydrocarbon development anywhere. The perils that security controls bear upon are among the most expensive on the programme: interference with plant or pipeline, sabotage and malicious damage, the business interruption and deferred production that follow an unplanned shutdown, and third-party liability arising from the conduct of security personnel towards a member of the public. Cover for risks of this kind is commonly written subject to warranties and conditions concerning the controls the insured has represented to be in place. That is where competence evidence stops being administrative: a control that cannot be evidenced is a control that may not be recognised when a claim is examined.

What the market gets to read

There is a third mechanism, and it is the one most often overlooked. GRI 410: Security Practices — the global sustainability reporting standard on this topic, effective from 1 July 2018 — addresses the conduct of security personnel towards third parties and the potential risk of excessive use of force or other violations of human rights, and expressly notes that security personnel may be employees of the reporting organisation or of third-party organisations providing security forces (GRI, 2016).

Disclosure 410-1 requires the organisation to report the percentage of security personnel who have received formal training in its human rights policies or specific procedures and their application to security, and to state whether those training requirements also apply to third-party organisations providing security personnel. The accompanying guidance is that the percentage should be calculated using the total number of security personnel, whether they are employees of the organisation or of third-party organisations (GRI, 2016).

In other words, the proportion of contracted security officers who have been properly trained is not an internal matter. It is a figure that appears in a published report, read by investors, lenders and analysts. A contractor that cannot supply the underlying data does not merely fail an audit — it puts a gap in its client’s disclosure.

Here is the part most often misread. Neither the Code of Conduct nor Performance Standard 4 prescribes a named course, and that is sometimes taken to mean the paperwork is flexible. It means the opposite. Rather than naming a syllabus, they specify the things a syllabus is supposed to produce.

• Recurrence. The Code requires that all personnel performing security services receive initial and recurrent professional training, and are fully aware of the Code and applicable international and national law, including international human rights law, international humanitarian law and international criminal law (ICoCA, 2021, para. 55).
• Assessment. Companies must maintain records adequate to demonstrate attendance and results from all professional training sessions, including from practical exercises (ICoCA, 2021, para. 55). A register of who sat in the room is not evidence that anyone can do the job.
• Retention. Employment and service records on all past and present personnel are kept for seven years and made available to a compliance mechanism or competent authority on request (ICoCA, 2021, para. 53).

The Code is equally specific elsewhere. Selection requires verifiable vetting and ongoing performance review, and personnel are to be regularly evaluated to ensure they meet appropriate physical and mental fitness standards for their contracted duties (ICoCA, 2021, paras. 45, 47). Where personnel carry weapons, authorisation follows only on completion or verification of training specific to the type and model carried; they must not operate with a weapon until that training is successfully completed; and training must be regular, verifiable and recurrent, with use-of-force instruction based at minimum on the Code, the UN Basic Principles on the Use of Force and Firearms by Law Enforcement Officials (UN, 1990) and the law in force where duties are performed (ICoCA, 2021, para. 59). Companies are also to provide hostile environment training, adequate protective equipment and medical support (ICoCA, 2021, para. 64).

Set those requirements side by side and the practical conclusion is unavoidable. A structured qualification, delivered against a defined standard, assessed by someone other than the person who taught it, dated, recorded and scheduled for renewal, is not one way of meeting the requirement among many. It is the most efficient instrument available for producing precisely the evidence the frameworks demand — and, as it happens, precisely the data a GRI 410 disclosure needs. What fails an audit is not training. It is undocumented training, and the attendance certificate standing in for an assessment record.

Where Uganda sits in this

Uganda is not being asked to invent anything. It is joining a market that already runs on this specification, and the evidence that the standard is reachable in country is on the record. Code-related requirements were advocated for inclusion in the security tenders for the EACOP, Tilenga and Kingfisher projects from the late 2010s, at a point when no member companies were operating in Uganda at all. Six Ugandan private security companies have since joined the Association, and a Ugandan director now serves on its board. On 25 March 2026 the first Responsible Security Forum in Uganda, co-hosted by the Association, convened in Kampala, bringing together private security companies, the Uganda Private Security Association, extractive-sector clients, government ministries, the Uganda Police in its role as regulator and the Uganda National Bureau of Standards (ICoCA, 2026).

There is an opportunity in that which is easy to miss. A specification this consistent across jurisdictions means competence built in Uganda is competence recognised elsewhere. An officer trained, assessed and documented to this standard is not only employable on the Albertine Graben. They are employable wherever the industry operates.

The pressure point at first oil

Every major project meets the same moment: the transition from construction to production. Thousands of construction roles end, supervisory headcount thins, and workforce reduction on that scale is a recognised security pressure point — in any country, on any project (ICoCA, 2026). The officer on the gate during a demobilisation is the person who most needs de-escalation skill, a clear rule for the use of force and the confidence to apply it under provocation.

Ugandan law has just moved on this ground. On 29 April 2026 the President assented to the Employment (Amendment) Act, described by Ugandan counsel as the most significant overhaul of the country’s labour regulatory framework in nearly two decades (KTA Advocates, 2026). It amends the Employment Act, Cap. 226, expanding the statutory grounds for termination to include redundancy — defined to arise where the employer has ceased business operations, or through reorganisation of work, the introduction of labour-saving devices, changes in work patterns, or a reduced need for employees for existing work — alongside tightened procedural fairness and documentation requirements (MMAKS Advocates, 2026).

On pay, Uganda’s statutory minimum wage has stood at UGX 6,000 per month since 1984, a rate widely regarded as outdated and largely unenforced; a Bill passed in 2019 proposing a substantially higher figure was not assented to (DLA Piper, 2025). The practical reading for a demobilisation is straightforward: it now takes place under a tighter statutory regime with a higher evidential burden on the employer. The contractors most likely to manage that transition well are those already keeping disciplined workforce records — which tends to be the same population already keeping disciplined training records.

One structural point

Uganda’s national content regime derives from the National Oil and Gas Policy 2008 and the Petroleum (Exploration, Development and Production) Act 2013, operationalised through the Petroleum (Exploration, Development and Production) (National Content) Regulations 2016, made under section 183 of that Act (PAU, 2022). Security sits among the goods and services reserved for Ugandan companies, foreign firms participate through joint ventures approved by the Authority, and no entity may provide goods, works or services for oil and gas activities unless registered on the National Supplier Database that the Authority maintains and publishes (PAU, 2021; PAU, n.d.).

So an operator cannot resolve a capability question by importing a provider. The contract will be held by a Ugandan company. The only available lever is the standard that company is required — and equipped — to meet.

A provider operating to standard answers all four inside a day, and should welcome being asked. A provider that cannot answer the fourth has said something about the first three — and an auditor, a lender’s independent consultant or a loss adjuster will reach that conclusion faster than a procurement team will.

A standard, not a supplier

Britannia Elite does not supply security personnel in Uganda, and under the national content framework it could not. The ring-fence is right: it directs the economic benefit of the sector to Ugandan companies and Ugandan workers, and the answer to a capability question is not to dismantle it.

The answer is to close the gap where it sits — in the ability of companies to demonstrate, to an auditor’s satisfaction, that their officers have been trained to an internationally recognised standard, assessed against it, and recorded in a way that will hold up years later and aggregate into a number a client can publish. The industry settled this specification a quarter of a century ago and applies it on every continent. What remains, here as everywhere, is the means to prove it has been met.