HSE Professional Guide · Construction Safety Coordination · Issue 10
One Vendor, Total Protection: Integrating HSE & Security
ℹ️ A note on this topic
The organisational models and recommendations presented here are professional, business-oriented suggestions, not legal requirements – Hungarian law does not prescribe a mandatory organisational form for integrating Security and HSE. The statutory duties of the Construction Safety and Health Coordinator (Decree 4/2002 SzCsM-EüM) remain unchanged under any form of integration.
Introduction
On a construction site, the responsibilities of physical Security (site protection, access control, asset protection) and HSE coordination (occupational safety, health protection, environmental protection) overlap and depend on each other at numerous points.
In the previous, Issue 9, we examined the future challenges facing the construction safety coordinator profession. This closing issue explores a different question rarely made explicit in practice: how does HSE coordination fit into a security approach integrated with physical asset protection – and what happens when the organisations responsible for the two areas simply don't talk to each other.
In practice, on most Hungarian construction projects these two areas belong to two entirely separate organisations, two separate contracts, and two separate managers at the gate. The security service running access control often has no way of knowing who holds a valid safety induction; the safety coordinator often only finds out after the fact that unauthorised individuals had been on site. Separating the two functions doesn't save money – it simply relocates the cost to where it is most expensive: the liability gap.
1 · Where Security and HSE Intersect
The two disciplines don't run in parallel – they play out on the same physical ground, through the same population of people. The most common points of contact:
Access control and authorisation
Security decides who may enter the site – without any data relevant to occupational safety. Valid safety training, medical fitness, and PPE should in principle be checked before entry; in practice, this data rarely reaches the gate.
Site zoning
The security fence, camera system, and patrol route are built around the same hazard zones as the occupational risk assessment. When the two zoning exercises are done independently, the boundaries don't line up – and the gap opens exactly in the most dangerous spots.
Incident response
In an accident, fire, or intrusion, security and the safety coordinator often respond in parallel, independently – authorities get called twice, two reports get written. A shared alert chain and a pre-agreed division of roles eliminates this duplication.
Subcontractor records
Security knows who is physically on site; the coordinator knows who is authorised to be there. Without merging the two records, neither party has a complete picture of who is actually working on site.
ℹ️ Where the regulation actually meets
Personnel and asset protection services carrying out site protection and access control are governed by Act CXXXIII of 2005, which requires a licence and registration. If the access control or CCTV system processes employee data, joint data handling between Security and HSE also requires GDPR / Hungarian data protection compliance – something to clarify at the integration design stage, not after the fact.
2 · Three Organisational Models for Integrated Management
Three organisational models for aligning the two areas have emerged in practice. None is a legal obligation – each is a business decision shaped by project size, risk profile, and client capacity.
A single partner delivers both functions with a shared database and alert chain. On larger, continuous-presence projects (e.g. solar park construction), typically the most cost-effective option.
Separate partners, but a shared procedure: unified access policy, shared zone map, shared alert chain. The right choice when the client already has a trusted security partner.
The coordinator gains visibility and input without taking over security's operational management. Least costly, weakest integration – fine for smaller projects.
3 · Concrete Benefits by Project Phase
- Site handover – access rights and the zone map are unified from day one.
- Active construction – a single subcontractor register, real-time visibility.
- Incident response – one alert chain, one report, no contradictory communication with authorities.
- Regulatory inspection – Security and HSE documentation reinforce each other.
- Handover / commissioning – documentation handed over in one package, at one time.
4 · Conditions and Limits of Integration
✅ What it requires
- A clearly documented division of roles.
- A shared, continuously updated access rights and subcontractor register.
- The coordinator's statutory authority (e.g. ordering a work stoppage) stays intact.
⛔ What it doesn't solve
- It doesn't replace the coordinator's independent statutory responsibility.
- It doesn't fix fundamental client-side resourcing shortcomings.
- It doesn't guarantee quality on its own.
5 · When Integration Is Not Recommended
⚠️ Consider Model B instead, if…
- The project's size and risk profile are low.
- The client already has a well-functioning procedure in both areas.
- One party is significantly less qualified than the other.
In these cases, a well-documented Model B (two independent partners, shared protocol) is usually a better choice than forcing an organisational merger.
6 · International Outlook – Where the Practice Is Heading
In Hungary, an integrated security-HSE approach is still the exception, not the rule. The UK's National Protective Security Authority (NPSA, formerly CPNI) provides integrated – information, personnel, and physical – security advice at an institutional level, and its site security plan guidance explicitly includes occupational safety among physical security design considerations. Under the EU's Seveso III Directive (2012/18/EU), literature on sites within scope already describes the concept of integrated safety and security management – implementation is at an early stage, but it signals the direction of EU regulatory thinking.
💡 Real-world example: automated drone surveillance
In early 2026, Skyports Drone Services deployed a BVLOS drone-in-a-box system on a major bridge construction project on the Rhine, delivered by HOCHTIEF Infrastructure – replacing manual methods with continuous, automated data collection. The same flight serves security (intrusion and theft monitoring) and HSE (missing PPE, hazard-zone entry) simultaneously. In Hungary, this activity falls under both EASA drone regulation and GDPR / Hungarian data protection law.
7 · BIM Integration and HSE Coordination Software
All three models above work fully without BIM or dedicated software – the digital layer is an enhancement, not a prerequisite. Where the client has a BIM model, it can manage hazard zones and access rights as a spatially located, continuously updatable digital layer, linked to the schedule (4D BIM), acting as a single source of truth for security, the coordinator, and the contractor.
Day-to-day operations are then carried by dedicated HSE coordination software: a digital site diary, electronic work permits, training records, and incident / near-miss reporting all in one interface – linked to the access control system, so security can also see who holds a valid authorisation.
Conclusion
Separating Security and HSE is not a neutral default – it's an active decision with a cost, even if it never appears as a line item in the contract. The liability gap opens exactly where the two areas meet every day: at the gate, at the zone boundary, and in the first minutes of an incident. The question isn't whether some level of coordination is needed, but whether it's designed deliberately, matched to the project's risk profile – or only becomes visible once it's too late.
This closes the 10-part HSE Professional Guide series – thank you to everyone who followed along.