Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety. Examples include energy, water, healthcare and transport. Governments set the exact list for their own country.
- Also Called2other namesCNI
- Related Terms3linked entriesNIS2 Directive · Third-party risk · Attack surface
What is critical infrastructure?
NIST gives the definition used in US law: systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. Another NIST entry describes it in terms of the essential services that underpin a nation’s economy, security and wellbeing.
Which sectors count?
CISA lists 16 critical infrastructure sectors: chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government services and facilities, healthcare and public health, information technology, nuclear reactors, materials and waste, transportation systems, and water and wastewater. CISA names Presidential Policy Directive 21 as the policy on critical infrastructure security and resilience. Other countries and regions keep their own lists, so check the rules that apply to you.
Why does it matter?
By definition, these systems are ones society relies on, so a cyber incident against them can affect many people at once. The sectors depend on each other, and a failure in one can spread to another. This is general reasoning, not a claim from the sources. For that reason, operators of critical services are often asked to meet extra security duties under national rules.
How can operators reduce the risk?
- Know which of your systems and assets are vital, and who depends on them.
- Plan for loss of those systems, and practice the plan.
- Watch for outside exposure, including systems that can be reached from the internet.
- Include suppliers in your risk checks, since many services rely on third parties.
These steps are general advice and are not taken from the NIST or CISA pages.
Is critical infrastructure the same as operational technology?
No. Critical infrastructure is a group of vital services and assets. Operational technology is the kind of equipment, such as industrial controllers, that often runs them. A hospital or a bank can fall within the healthcare or financial sectors, and not every part of it is operational technology.
Is critical infrastructure the same as critical systems in a company?
Not exactly. A company can have systems that are critical to its own business without being part of a nation’s critical infrastructure.
Related pages in the Knowledge Hub
Sources
Also Called.
- NameCritical national infrastructure
- NameCNI
Questions.
-
What counts as critical infrastructure?
It means systems and assets, physical or virtual, so vital that losing them would harm security, the economy or public health and safety. CISA lists 16 sectors, including energy, water, healthcare, communications and transportation systems. Other countries keep their own lists.
-
Why is critical infrastructure a target for cyber attacks?
Society relies on these systems, so an incident can affect many people at once. The sectors also depend on each other, so a failure in one can spread to another. Operators are often asked to meet extra security duties under national rules.
-
How can critical infrastructure operators reduce cyber risk?
Know which systems and assets are vital and who depends on them. Plan for losing them and practise the plan. Watch for systems reachable from the internet, and include suppliers in risk checks, since many services rely on third parties.
-
Is critical infrastructure the same as operational technology?
No. Critical infrastructure is a group of vital services and assets. Operational technology is the kind of equipment, such as industrial controllers, that often runs them. A hospital or a bank can fall within a sector without every part being operational technology.
In Our Research
- 1 Protecting Critical Infrastructures with Advanced Digital Risk Monitoring March 2025
- 2 Critical Infrastructure Defense: A Modern Blueprint for Cyber Resilience June 2024
- 3 Ransomware Attacks on Critical Infrastructure: Are We Doing Enough? October 2023
- 4 Exposed PLCs: lessons from the 2026 US advisory October 2026
- 5 Volt Typhoon advisory AA24-038A: what CISA says October 2026
- 6 Cyber compliance calendar 2026 and 2027: key dates October 2026