Browse Definitions :

critical infrastructure

What is critical infrastructure?

Critical infrastructure is the collection of systems, networks and public works that a government considers essential to its functioning and safety of its citizens. The specific infrastructure that each nation considers critical varies. It usually includes electrical grids, public services and communication systems. Special attention must be given to protect critical infrastructure from cyber attacks.

Critical infrastructure cybersecurity

Critical infrastructure is important to day-to-day life and the safety of civilians. Protecting it is becoming more and more important as malicious actors are increasingly targeting critical infrastructure. These attacks can come from ransomware gangs trying to extort money or advanced persistent threat groups attempting to disrupt another country's operations.

There have been examples where a cyber attack has impacted a nation's critical infrastructure. Smaller incidents may only leak information, as with cyberespionage. Larger attacks could severely impact operations. Attacks on hospitals have even sadly resulted in the loss of life.

Operators of critical infrastructure face many challenges when defending against cyber attacks. Security standards may have been set before cyber threats became such a large concern. They may also employ older operational technology or insecure internet of things devices. The majority of critical infrastructure is also privately held, so it may be more profit-focused and may not pay sufficient attention to security. Security teams should emphasize the financial and operational potential impact of a cyber attack to decision-makers to get additional support.

In the United States, the National Institute of Standards and Technology (NIST) provides its Cybersecurity Framework to help protect organizations from threats. NIST also provides additional resources for critical infrastructure that is specific to particular industries. For most sectors, though, following this guidance is not mandated by law.

diagram of NIST Cybersecurity Frameworks five core concepts
The NIST Cybersecurity Framework includes five core concepts around the lifecycle of cybersecurity risk.

Critical infrastructure in the United States

The United States government gives the following explanation for critical infrastructure:

There are 16 critical infrastructure sectors whose assets, systems and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

Each sector is overseen by a specific government agency. These agencies can provide sector-specific direction.

Chemical sector

Overseen by the Department of Homeland Security (DHS), it covers the manufacturing, storage, transportation and use of potentially dangerous chemicals. It includes base chemicals, specialty chemicals, agricultural chemicals and consumer products.

Commercial facilities sector

Overseen by DHS, it has eight subsectors: entertainment and media, gaming, lodging, outdoor events, public assembly, real estate, retail and sports leagues.

Communications sector

Overseen by DHS, it covers privately owned communications infrastructure, including satellite, terrestrial, wireless communications and the internet.

Critical manufacturing sector

Overseen by DHS, it includes manufacturing that has national significance. The subsectors include primary metals manufacturing; machinery manufacturing; electrical equipment, appliance and component manufacturing; and transportation equipment manufacturing.

Dams sector

Overseen by DHS, it includes water retention and control services.

Defense industrial base sector

Overseen by the Department of Defense, it includes research, design, production and maintenance of military weapons systems.

Emergency services sector

Overseen by DHS, it includes emergency management, emergency medical services, fire and rescue services, law enforcement, public works and other specialty emergency services.

Energy sector

Overseen by the Department of Energy, it covers the production and distribution of electricity, oil and natural gas.

Financial services sector

Overseen by the Department of the Treasury, it covers banks, credit unions, insurance companies and investment institutions. It protects the ability to deposit, withdraw, loan, invest and transfer funds.

Food and agriculture sector

Overseen by the Department of Agriculture and the Department of Health and Human Services (HHS), it includes farms, restaurants and food manufacturing.

Government facilities sector

Overseen by DHS and the General Services Administration, it covers federal, state, local and tribal government facilities. It includes government offices, embassies, courthouses, schools, national monuments and election facilities.

Healthcare and public health sector

Overseen by HHS, it helps to protect against infectious disease, infectious disease outbreaks and terrorism.

Information technology sector

Overseen by DHS, it produces and provides hardware, software, IT systems and services.

Nuclear reactors, materials and waste sector

Overseen by DHS, it includes nuclear power plants, medical radioactive sources and transportation of radioactive materials.

Transportation systems sector

Overseen by DHS and the Department of Transportation, it includes seven subsectors: highway and motor carrier, aviation, maritime transportation system, mass transit and passenger rail, pipeline systems, freight rail, and postal and shipping.

Water and wastewater sector

Overseen by the Environmental Protection Agency, it includes public water supplies and water treatment.

DHS manages the National Infrastructure Protection Plan (NIPP). NIPP outlines how the government and the private sector can work together to protect critical infrastructure from physical, environmental and cyber threats. It does not define any specific requirements, but instead provides instruction for collaboration and common goals.

Critical infrastructure in the European Union

In the European Union (EU), the European Programme for Critical Infrastructure Protection establishes the overall strategy to protect against terrorism and other types of attacks.

The European Commission gives the following description for critical infrastructure:

Critical infrastructure is an asset or system which is essential for the maintenance of vital societal functions. The damage to a critical infrastructure, its destruction or disruption by natural disasters, terrorism, criminal activity or malicious behavior, may have a significant negative impact for the security of the EU and the well-being of its citizens.

The EU Agency for Cybersecurity provides guidance to critical infrastructure sectors, including information and communications technology, energy, financial, health and transportation.

Learn four steps to critical infrastructure protection readiness, and see how to create a critical infrastructure incident response plan.

This was last updated in August 2023

Continue Reading About critical infrastructure

  • local area network (LAN)

    A local area network (LAN) is a group of computers and peripheral devices that are connected together within a distinct ...

  • TCP/IP

    TCP/IP stands for Transmission Control Protocol/Internet Protocol and is a suite of communication protocols used to interconnect ...

  • firewall as a service (FWaaS)

    Firewall as a service (FWaaS), also known as a cloud firewall, is a service that provides cloud-based network traffic analysis ...

  • identity management (ID management)

    Identity management (ID management) is the organizational process for ensuring individuals have the appropriate access to ...

  • single sign-on (SSO)

    Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials -- for ...

  • fraud detection

    Fraud detection is a set of activities undertaken to prevent money or property from being obtained through false pretenses.

  • change management

    Change management is a systematic approach to dealing with the transition or transformation of an organization's goals, processes...

  • IT project management

    IT project management is the process of planning, organizing and delineating responsibility for the completion of an ...

  • chief financial officer (CFO)

    A chief financial officer (CFO) is the corporate title for the person responsible for managing a company's financial operations ...

  • core HR (core human resources)

    Core HR (core human resources) is an umbrella term that refers to the basic tasks and functions of an HR department as it manages...

  • HR service delivery

    HR service delivery is a term used to explain how an organization's human resources department offers services to and interacts ...

  • employee retention

    Employee retention is the organizational goal of keeping productive and talented workers and reducing turnover by fostering a ...

Customer Experience
  • martech (marketing technology)

    Martech (marketing technology) refers to the integration of software tools, platforms, and applications designed to streamline ...

  • transactional marketing

    Transactional marketing is a business strategy that focuses on single, point-of-sale transactions.

  • customer profiling

    Customer profiling is the detailed and systematic process of constructing a clear portrait of a company's ideal customer by ...