Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety. Examples include energy, water, healthcare and transport. Governments set the exact list for their own country.
- Also Called2other namesCNI
- Related Terms3linked entriesNIS2 Directive · Third-party risk · Attack surface
What Is Critical Infrastructure?
NIST gives the definition used in US law. It covers systems and assets, physical or virtual, so vital to the United States that losing them would do crippling harm. The harm may hit security, the economy, public health or safety, or any mix of these. Another NIST entry calls it the key services that a nation’s economy, security and wellbeing rely on.
Which Sectors Count?
CISA lists 16 critical infrastructure sectors.
- Chemical
- Commercial facilities
- Communications
- Critical manufacturing
- Dams
- Defense industrial base
- Emergency services
- Energy
- Financial services
- Food and agriculture
- Government services and facilities
- Healthcare and public health
- Information technology
- Nuclear reactors, materials and waste
- Transportation systems
- Water and wastewater
CISA says the 16 sectors were set in 2013 and that a National Security Memorandum replaced Presidential Policy Directive 21 as the policy in 2024. Other countries keep their own lists, so check the rules that apply to you.
How Did US Policy on Critical Infrastructure Develop?
The United States built its approach through a few policy documents. Dates come from the White House archive and CISA.
- 17 Dec 2003HSPD-7 issuedA directive on finding, ranking and protecting critical infrastructure.
- 12 Feb 2013PPD-21 issuedIt revokes HSPD-7 and sets national policy on security and resilience, with 16 sectors.
- Late 2023Sector structure reviewedCISA says the updated structure went to the President.
- 30 Apr 2024National Security Memorandum publishedIt replaces PPD-21, keeps the 16 sectors and makes CISA the national coordinator.
What Is at Stake When One Sector Fails?
The NIST definition turns on crippling harm to security, the economy or public health. The 2013 directive PPD-21 calls these systems varied, complex and tied to each other. CISA says the 2024 memorandum puts more weight on minimum security and resilience rules, within each sector and across sectors.
What Do CISA’s Performance Goals Ask of Operators?
CISA publishes Cross-Sector Cybersecurity Performance Goals for all critical infrastructure entities. They are voluntary.
- CISA calls them a baseline of practices with known risk-reduction value.
- Version 2.0 adds goals on cybersecurity oversight and risks from managed service providers.
- It also adds goals on least privilege and incident communication procedures.
- Operators can use the goals as a benchmark to measure and improve their maturity.
Is Critical Infrastructure the Same as Operational Technology?
No. Critical infrastructure is a group of vital services and assets. Operational technology is the kind of equipment, such as industrial controllers, that often runs them. A hospital or a bank can fall within the healthcare or financial sectors, and not every part of it is operational technology.
Is Critical Infrastructure the Same as Critical Systems in a Company?
Not exactly. A company can have systems that matter a lot to its own business without being part of a nation’s critical infrastructure.
Related Pages in the Knowledge Hub
- Poland energy sector attacks
- Volt Typhoon
- Network segmentation
- Critical infrastructure defense: a blueprint for cyber resilience
- Ransomware attacks on critical infrastructure
- Attack surface reduction
Sources
- NIST: NIST glossary definitions of critical infrastructure.
- CISA: the list of 16 sectors.
- CISA: the 30 April 2024 National Security Memorandum, which replaces PPD-21.
- CISA: Cross-Sector Cybersecurity Performance Goals 2.0.
- White House archive: PPD-21 of 12 February 2013, which revokes HSPD-7 of 17 December 2003.
Also Called.
- NameCritical national infrastructure
- NameCNI
Questions.
-
What counts as critical infrastructure?
It means systems and assets, physical or virtual, so vital that losing them would harm security, the economy or public health and safety. CISA lists 16 sectors, including energy, water, healthcare, communications and transportation systems. Other countries keep their own lists.
-
Why is critical infrastructure a target for cyber attacks?
The 2013 directive PPD-21 describes critical infrastructure as diverse, complex and interdependent. A 2024 White House National Security Memorandum puts more weight on minimum security and resilience requirements within and across sectors.
-
How can critical infrastructure operators reduce cyber risk?
CISA publishes voluntary Cross-Sector Cybersecurity Performance Goals, a baseline of practices for critical infrastructure. Version 2.0 adds goals on cybersecurity oversight, managed service provider risk, least privilege and incident communication.
-
Is critical infrastructure the same as operational technology?
No. Critical infrastructure is a group of vital services and assets. Operational technology is the kind of equipment, such as industrial controllers, that often runs them. A hospital or a bank can fall within a sector without every part being operational technology.
In Our Research
- 1 NCSC: AI-Powered Ransomware on UK Critical Infrastructure Highly Likely by 2028 November 2026
- 2 Protecting Critical Infrastructures with Advanced Digital Risk Monitoring March 2025
- 3 Critical Infrastructure Defense: A Modern Blueprint for Cyber Resilience June 2024
- 4 Ransomware Attacks on Critical Infrastructure: Are We Doing Enough? October 2023
- 5 NCSC Annual Review 2026 Explained: What Changed Since 2025 and What AI-Powered Ransomware by 2028 Means November 2026
- 6 CyberStrikeAI: Inside the AI Pentest Platform Used in Real Attacks November 2026