OBER measures: what the model covers and where the survey fits

Where OBER comes from

OBER is first of all a term from ABRO 2026. Annex 5 of that decree opens with the reason for physical security: preventing an unauthorised person from gaining physical access to an interest requiring protection, and detecting or signalling compromise. To achieve that, “a combination of Organisational, Structural, Electronic and Reactive (OBER) measures” is applied. ABRO 2026, annex 5

Chapter 3 of the ABRO follows that division literally: 3.1 organisational measures, 3.2 structural, 3.3 electronic, 3.4 reactive. Anyone meeting a requirement number from chapter 3 can therefore read its category straight off the second digit group.

OBER is thus a term defined within the ABRO and not a national standard. Other Dutch frameworks use their own division, sometimes with the same letters and a different reach.

The four letters

The E causes the most confusion in practice. Electronic measures in this model are the installations: cameras, access control, intrusion detection. An electronic security survey is an examination of what has been left behind in the room. The names resemble each other and the ABRO places them in the same section.

The calculation: delay time against intervention time

The ABRO reasons from the inside outwards, with the interest requiring protection as the starting point. That interest belongs in a compartment; a compact one, such as a laptop, goes inside a storage means within it. Around that come the measures that counter compromise, detect it and allow timely intervention. ABRO 2026, annex 5

The layering has an explicit purpose. The decree calls it a shell structure and gives two reasons: the layers together produce delay time, and defeating one measure does not immediately lead to compromise.

Above that sits the concept the whole chapter turns on. Security performance follows from the delay time and the intervention time: how long the measures hold an intruder back after detection, set against how long it takes before someone is on the scene. Which delay is needed follows from a risk analysis, in which the means available to a potential offender count as well. The offender profile can be used for that, and is made available by the NBIV on request.

The worked example in the annex makes this concrete. With an intervention time of thirty minutes, the physical measures together have to produce at least thirty minutes of delay. If the compartment yields ten minutes, a storage means adding twenty will do. ABRO 2026, annex 5, figure 1

Which adversary the calculation models

The ABRO is not unclear on this point. Annex 5 begins with the unauthorised person gaining physical access. Annex 6 describes structural measures as a barrier against unauthorised persons attempting to gain physical access, naming burglary “usually for the purpose of theft, espionage or sabotage”, alongside accidental access by unauthorised employees.

Requirement 3.1.1 adds to that: the contractor includes in the risk analysis which methods and tools potential offenders have available to compromise the interest physically. From that follows, in 3.1.2 and in consultation with the NBIV, the required security performance. ABRO 2026, requirements 3.1.1 and 3.1.2

This is a progression model: someone is noticed, has to get through a number of layers after that, and the question is whether they get through before anyone reaches them. For burglary that works; it is also what the international chain of detect, delay and respond describes. Which adversary is realistic in your case is covered under threat profiles.

Where the examination lands in the classification

Three requirements in chapter 3 touch technical security examination, and they do not apply at the same levels. Requirement 3.3.31 calls for an electronic security survey and a sound attenuation measurement, in consultation with the NBIV, before a compartment is taken into use and on the addition or alteration of equipment. It is ticked at TBB 2 and TBB 1. Requirement 3.3.32 calls for TEMPEST measures and applies at TBB 3 only. Requirement 3.3.33 calls for a zoning measurement and again applies at TBB 2 and TBB 1. ABRO 2026, requirements 3.3.31 to 3.3.33

All three sit in section 3.3, under electronic measures. At the same time, annex 6 treats the visual and acoustic limiting measures as part of the structural measures, adding that visual limitation is needed regardless of classification and that acoustic limitation is not needed for TBB 4.

The placement therefore runs across two categories, which means the letters cannot be read as separate disciplines. A sound attenuation measurement tests a structural property, sits in the electronic section, and acquires its meaning through an organisational agreement about what may be discussed in the room.

What such an examination can and cannot establish is set out in what a sweep can and cannot establish; the TEMPEST requirements are worked out in TEMPEST and compromising emanations.

What the time calculation does not measure

Security performance measures one thing accurately: the time between detection and intervention, set against the time the layers cost an intruder. That calculation assumes an adversary on their way to the interest, meeting resistance along the route.

A surveillance device left behind stands in a different relation to it. It is brought in once, often at a moment when that presence is not itself unauthorised, and keeps working afterwards without any shell being crossed again. The delay time realised from then on also protects the device against discovery. This inference follows from the model; the decree does not phrase it that way.

The ABRO does not leave the scenario unaddressed. Four requirements in section 3.3 bear on it:

• 3.3.27 permits only electronic equipment strictly necessary for the work.
• 3.3.28 calls for procedural measures to keep the rest outside.
• 3.3.29 treats building management and IoT equipment as a system with a security level.
• 3.3.30 excludes cameras, smart devices, microphones and other equipment with recording or communications functionality from the compartment.

On top of that comes the examination obligation in 3.3.31 itself.

OBER does not ignore eavesdropping, then. What holds is that security performance is not the measure by which this risk is covered; the equipment requirements, the access rules and the examination at commissioning and on change serve that purpose.

Who is allowed in

Because the calculation concerns unauthorised access, authorised presence is handled elsewhere in the decree. Only authorised employees have independent access to a compartment, and access to an interest follows only after authorisation by the security officer. ABRO 2026, requirements 3.1.10 and 3.1.11

Visitors fall under their own regime: the visit must be in the direct interest of the assignment, be notified in advance, the identity is checked, access is registered and there is continuous escort by an authorised employee. At the higher levels, proposed visits are submitted for approval at least five working days beforehand. ABRO 2026, requirements 3.1.12 and 3.1.15

Suppliers and subcontractors run through the contract chain: where they come into contact with an interest requiring protection, the ABRO is passed down contractually. ABRO 2026, requirement 1.5.3

The decree assigns no fixed status to occupations. Whether an installer, cleaner or engineer is treated as an employee, a visitor or a subcontractor follows from the assignment rather than from the trade. That choice does determine which regime applies, and with it whether someone is escorted.

VRKI: the same ring to it, a different system

Outside government a second tradition exists around the same concepts. The Verbeterde Risicoklassenindeling, VRKI 2.0, is owned by the Dutch Association of Insurers and is managed and published by the Centre for Crime Prevention and Safety. Two things set it apart from the ABRO division.

The letter set is wider. The VRKI works with eight categories: O, BK, CO, ME, EL, SD, AT and RE, meaning organisational, structural, compartmentation, removal-limiting, electronic, shell detection, alarm transmission and response. Each category has levels, usually four, with performance requirements in minutes.

Its status differs as well. The VRKI says so in its own introduction: it “is not legally mandatory and is also not a recognition or certification scheme”. It becomes relevant through an insurer, a policy, a contract or a certification arrangement, not as a general rule.

Behind the difference in letters sits a difference in purpose. The VRKI classifies risk on the basis of the attractiveness and value of goods and inventory. Its shell theory opens by stating that the starting point for securing businesses is to compartmentalise the “loot” and surround it with detection. The object to be protected there is something that gets carried off. That is a different problem from information that is listened to and stays where it is.

No conversion between VRKI risk classes and TBB categories exists, and none can be made from the sources. They are two scales for different quantities. That a building falls in risk class 3 says nothing about which security performance the ABRO would require.

The same holds for BORG. The ABRO names a BORG certificate once, as an example under the requirement that security systems be maintained and checked at least annually by a certified company. That makes BORG an indication about installation and maintenance, not a statement about suitability for classified information. ABRO 2026, requirement 3.3.2

What VIRBI 2025 adds

Within central government a different decree applies. It does not use the OBER letters but does share the same logic of resistance and delay, and on one point it goes further than the ABRO.

The ABRO ties the examination to two moments: commissioning, and the addition or alteration of equipment. It names no fixed interval. VIRBI 2025 does, in row K of table 5.1: “Periodically and on every structural alteration or the addition of new items”, where the decree gives ICT equipment, furniture, paintings and corporate gifts as examples. VIRBI 2025, annex, table 5.1, rows J and K

A painting and a corporate gift do not come through a structural shell; they are carried in by someone entitled to be there. That the decree names precisely those objects as grounds for renewed examination makes change inside the room a control moment of its own, separate from the resistance on the outside.

The zoning rules and the full requirements table are set out in zoning and secured zones under VIRBI 2025; the examination obligation itself in the Dutch national TSCM/EVO policy advice.