Hi
Most of the major operators of these platforms (BP, Shell, Chevron, etc) have their own internal process control secuirty policy, procedures and standards, which includes physical security. As you have asked the question, I am assuming the facility you are looking at does not have any of these.
From experience, a number of factors that you need to consider:
Where is the equipment located?
Is it in a shared room/cabinet with other third party equipment?
Is the facility manned?
Are the networks segregated?
Remotely accessible?
As a basic, equipment should be a in locked cabinet or room. If multiple vendors have access, these should be in seperate cabinets if at all possible (I know, space is limited on a platform). Is this a BPCS (basic process control system) or a safety system? If the later, much more stringent controls need to be in place. Definitly in its own locked cabinet, with controlled access.
Physical access logs would be a useful control, including authorization by one of the controllers/engineers (if present).
I may have documents that I can share - let me look at them and I will see what I can do.
