Because codes set a minimum for safety, while mission assurance asks whether the facility keeps working under deliberate stress. Facilities for AI, energy, water and communications need an assurance layer that ordinary compliance was never built to prove.
A certificate of occupancy tells an owner that a building met the adopted code when it was inspected. For most buildings, that is the right question. For a facility whose loss would cut power, water, communications or computing for others, it is the wrong one.
What a code is for
The International Building Code states its purpose in Section 101.3: to establish minimum requirements providing a reasonable level of safety, health and general welfare through structural strength, means of egress, stability, sanitation, light and ventilation and energy conservation, and a reasonable level of life safety and property protection from fire, explosion and other dangerous conditions. The words that matter are "minimum" and "reasonable." Codes protect occupants and first responders from accident and natural hazard. They do not address deliberate attack, and they do not ask whether the function inside the building continues.
Where assurance standards already exist
The federal government closes that gap for its own buildings. The Interagency Security Committee's Risk Management Process, current edition 2024, applies to nonmilitary federal facilities. It assigns each facility a security level from I to V, sets a baseline level of protection for that level, and then requires a risk assessment that either confirms the baseline or replaces it with a documented, customized level, including a record of any risk the agency accepts. For defense facilities, UFC 4-010-01, now titled Antiterrorism, Force Protection and Security Engineering, sets minimum engineering standards that build antiterrorism measures into design.
Private critical facilities have no equivalent obligation. Some sectors have their own rules, such as NERC's physical security standard for transmission and federal risk and resilience assessment requirements for larger community water systems. Most data centers and continuity sites rely on the owner deciding what to require.
Component tests are not the whole answer
Test standards cover parts of the problem well. UL 752 rates bullet-resisting equipment, ASTM F3038 measures timed forced-entry resistance for doors, windows and walls, and ASTM F1233 covers security glazing. Each is useful. Each measures a specimen under defined conditions. The gap appears between a tested component and a finished room with its penetrations, anchors, adjacent construction and the people who operate it.
What an assurance trail should contain
A credible trail connects evidence that is usually kept in separate places:
- A stated threat basis. What the facility is designed to withstand, and what it is not.
- Tested assemblies. Test reports that match what was specified.
- Construction evidence. Inspection of the installed condition, including concealed work, against the tested assembly.
- Operating evidence. Access records, maintenance and the sensor and alarm data that show the protection still works.
- Trained people. Designers, installers, inspectors and responders who describe the same risk the same way. Without a shared vocabulary, a specification does not survive contact with the site.
- A recorded risk decision. Who accepted the remaining risk, and when.
Until owners and insurers can tell a tested, documented facility from a compliant one, the market will not reward the difference. The assurance trail is how that difference becomes visible.
Sources
- International Code Council, 2024 International Building Code, Chapter 1
- CISA, ISC Standard: The Risk Management Process
- Interagency Security Committee, The Risk Management Process, 2024 Edition
- U.S. EPA, America's Water Infrastructure Act Section 2013
- WBDG, UFC 4-010-01 Antiterrorism, Force Protection and Security Engineering
- UL Standards & Engagement, UL 752: Bullet-Resisting Equipment
- ASTM F3038-21, Timed Evaluation of Forced-Entry-Resistant Systems
- ASTM F1233-21, Security Glazing Materials and Systems
Cite this article: Authentic Intelligence Research, “Why Isn't Code Compliance the Same as Mission Assurance?” Authentic Intelligence, September 30, 2026, https://authenticint.com/articles/code-compliance-is-not-mission-assurance.html.