How to Prepare a Crew for a Restricted or Secure Site

Why this matters

Crews get removed from restricted sites for conduct, almost never for craft. A phone raised to photograph a nameplate in a room with a person in it, a door propped for two minutes to carry a spool through, an honest answer given to an occupant who asked a question that should have gone to staff: any one of those ends a day and can end an account. The preparation that prevents it is not a toolbox talk. It is a set of rules about what the crew may carry, record, say and touch, and it has to be given before the truck leaves, because the moment it is needed the person needing it is standing alone in a corridor.

The steps below are ordered by what you lose if you skip them, largest loss first, not by the order you would perform them. Sequence them however your day runs; prioritise them in this order when the prep time is short.

1. Set the conduct rules, because breaking one removes you from site

This is first because it is the only step whose failure mode is losing the account outright, on day one, with no way to work back from it. Everything below costs hours or days; this costs the relationship.

Give the crew five rules, in plain language, and give them the reason for each. A rule without a reason gets bent by the person who thinks they understand the situation better than the rule does.

• No cameras, no video, no audio, including for your own records. Assume every space contains something you are not entitled to record: a person, a screen, a document, a security layout. If you need a photo, ask your escort to take it or to authorise you, and log the permission.
• No propping, no holding, no tailgating. If a door needs to stay open to move material, that is a request to your escort, not a decision you make with a wedge. A controlled door on a secure floor is somebody's safety control, and the consequence of defeating it lands on the people it was protecting.
• Stay in your zone. A restricted site is a set of permissions, not a building, and walking through the wrong door is a security incident even when it opened for your badge.
• Route questions, do not answer them. When an occupant asks what you are doing or how long the water will be off, the answer is that you will find the staff member who can tell them. In an institution the answer belongs to the person who owns the communication, and a well-meant estimate from a contractor becomes a promise the institution has to keep.
• Touch nothing outside the scope. Not a bench, not a cart, not a switch on a panel you are not working in, not a personal item.

What you lose by skipping it: the contract, and on some sites a reportable incident that follows your company name into other vendor files.

2. Sit the orientation properly and take away the site-specific hazards

Site orientation is treated as a room to endure. It is the only place you will be told the things that are true about this building and no other: which alarm tone means evacuate and which means shelter, where the muster point is, which chemical is stored where, who has authority to stop work, and what the facility's own emergency codes mean. None of that is inferable from experience elsewhere.

Send every person who will set foot on site, including the one who is "just delivering." Take notes on four items: alarm tones and the response to each, the muster point and the alternate, the number to call for an incident, and the name of the person with stop-work authority on your shift.

What you lose by skipping it: the ability of your crew to respond correctly to somebody else's emergency, in a building where a wrong move puts occupants in the wrong place. This sits second only because it materialises rarely; when it materialises it outranks everything on this list.

3. Learn the permit system before you need a permit

Restricted sites run permit-to-work systems, and the permit is not paperwork protecting the institution from you. It is the mechanism by which people who are not in your work area find out that your work is happening, so they can be moved, protected or told to stay out.

• Hot work. Cutting, welding, brazing and grinding under a permit, with the area surveyed, combustibles removed or shielded, and a fire watch maintained during the work and for the required period after it, under 29 CFR 1910.252(a) and NFPA 51B. In the blast radius: everyone on the other side of the wall you are heating, and everyone downstream of the smoke detector your torch is about to trip.
• Confined space. A wet well, tank, basin, large duct plenum or pit is treated as a permit-required confined space until testing says otherwise. Entry runs under a written program with atmospheric testing in order (oxygen first, then flammable, then toxic), continuous forced-air ventilation, an attendant outside who never enters, and a retrieval system. The duty sits at 29 CFR 1910.146 for general industry and at 29 CFR 1926 Subpart AA, sections 1926.1200 through 1926.1213, for construction work, and which one applies is settled in advance rather than in the hole. In the blast radius: the attendant, and every rescuer who follows an unprepared entrant in, which is how these incidents multiply.
• Energized work. The disconnecting means locked and tagged under 29 CFR 1910.333(b)(2), and the circuit proved dead with an adequately rated tester checked on a known live source immediately before and immediately after the test, per NFPA 70E-2021, 120.5. For mechanical isolation and stored energy, meaning a pressurised vessel, an accumulator, a spring or a rotating mass, the standard is 29 CFR 1910.147, and it is a different permit and a different lock.
• The site's own permits. Many facilities add their own: line breaking, excavation, roof access, ceiling access above a clinical space, alarm impairment. Ask for the full list at orientation and get blank copies.

What you lose by skipping it: a stop-work order at best, and at worst an event landing on people who did not choose to be near your work. A crew that arrives without knowing the permit exists will start the task, and starting is the violation.

4. Control the tools and materials before you cross the line

On a secure or process site, what you carry in has to come out, and what you leave behind can shut down a system. Inventory in, inventory out, with a count both ways.

• Take the count at the gate, not at the shop, because what matters is the number that crossed the line.
• Ask what is prohibited before you pack: knives, lighters, personal phones, radios on certain frequencies, and in some facilities anything ferrous near specific equipment.
• Stage consumables for the full scope. On a restricted site you cannot leave and re-enter freely, and each re-entry can cost a full escort cycle.

What you lose by skipping it: hours inside a window you cannot extend, plus the chance that a missing item stops a process while somebody searches for it.

5. Build the escort and communications plan

Escorted access is a throughput limit, not a formality. One escort serves one work front, so a plan with three fronts against one escort is a one-front job with two crews watching.

Agree in advance: who escorts, what happens at their lunch and shift change, what the crew does when the escort is called away, and what number reaches them. Then agree the same for the after-hours case, because the person who badges you in at 07:00 is not there at 23:00.

What you lose by skipping it: a predictable one to two hours a day per crew, which on a five-day scope is close to a full crew-day, spent standing.

6. Decide where the record lives, in their system

On institutional work the accepted record is frequently their work order or maintenance management ticket, not your invoice and not your service report. Before mobilization, find out what closes a ticket, who closes it and what evidence it needs, then have the crew produce that evidence as they go rather than from memory at the end.

What you lose by skipping it: payment timing, and on a disputed scope the ability to prove the work happened at all.

7. Debrief the same day

Fifteen minutes at the truck: what ran long, which access failed, what the escort said, what you promised anybody. Write it into the job file. This is last because its loss is real but slow, and it is the only item here you can recover later.

Worked example: two days in a municipal water treatment plant

A three-person crew is scheduled for two 8-hour days replacing a pump seal and its associated valving in a treatment plant pump room, with a wet well adjacent.

Prep, run in the order above. Conduct rules given at the shop, with the plant-specific addition that the control room and the chlorine building are outside the zone entirely. All three sat orientation the previous week, and the notes name two alarm tones: one for evacuate, one for shelter in place, which at this plant signals a possible chlorine release and means going indoors and upwind rather than out to a muster point. That distinction is why orientation was not skippable; the reflex learned on every other site is the wrong action here.

Permits identified in advance: a line-breaking permit for opening the pump's suction and discharge, and a confined space permit if anyone enters the wet well. The crew's plan avoids wet well entry entirely, which is why it is planned rather than decided on the day.

Isolation before anything is opened. The pump's electrical disconnect is locked and tagged under 29 CFR 1910.333(b)(2) and proved dead with an adequately rated tester checked on a known live source before and after, per NFPA 70E-2021, 120.5. The suction and discharge valves are closed, the isolating devices locked under 29 CFR 1910.147, and the line drained to the plant's designated point with the pressure gauge read at zero before a flange bolt is loosened. Bolts on the far side are cracked first with the body kept out of the parting line, because a line reading zero at the gauge can still hold trapped liquid behind a closed valve.

The hazard the crew's own plan created. Taking this pump down leaves the plant single-string on that duty for two days, which is not the crew's decision to make. The shift operator and the plant supervisor agreed the timing, and the crew's abort condition is that if the running pump faults, they stop and restore theirs to service ahead of finishing. That condition was written on the permit rather than agreed verbally.

Tool control. The inventory at the gate lists 41 items. At the end of day one the count comes back 40. The crew stops, retraces, and finds a socket in a drip pan under the pump rather than in the wet well, which took eleven minutes. Without the gate count nobody would have known to look, and the plant would have carried an unaccounted-for tool in a room adjoining an open basin.

Escort throughput and the number. The plant provided one escort, so the crew planned one work front deliberately and the third technician spent day one staging rather than opening a front nobody could cover. Day one ran 8 hours as planned. Day two ran 9 hours, one over, because the seal kit was short a gasket and a runner had to make a full escort cycle out and back, 55 minutes of the 60-minute overrun. That is the staging step failing, and it cost about 12 percent of a scheduled 8-hour day. Both days still landed inside the agreed outage.

What would have changed the conclusion. Had the crew planned wet well entry, the shape changes entirely: entry adds an attendant who can do nothing else, atmospheric testing before and continuously during entry, ventilation and a retrieval system, which turns a three-person crew into a two-person working crew and roughly doubles setup on that task. Shops that price entry as if it were access price it wrong.

References

• 29 CFR 1910.146 (permit-required confined spaces, general industry) and 29 CFR 1926 Subpart AA, 1926.1200 to 1926.1213 (confined spaces in construction)
• 29 CFR 1910.252(a) (welding, cutting and brazing, fire prevention) and NFPA 51B (fire prevention during hot work)
• 29 CFR 1910.333(b)(2) (electrical work practices) and 29 CFR 1910.147 (control of hazardous energy, mechanical and stored energy)
• NFPA 70E-2021, 120.5 (establishing and verifying an electrically safe work condition)
• See related: Badging, Background Checks and Getting Onto the Site; Executing Work Inside a Fixed Outage Window