Each US critical infrastructure sector has a sector risk management agency, or SRMA, that works with owners and operators. CISA's pages name HHS for health, EPA for water, the Department of Energy for energy, DHS and DOT jointly for transportation, CISA for emergency services, and DHS for communications.
The six, from CISA's pages
- Healthcare and Public Health: Department of Health and Human Services.
- Water and Wastewater: Environmental Protection Agency.
- Energy: Department of Energy.
- Transportation Systems: DHS and the Department of Transportation as co-SRMAs.
- Emergency Services: CISA, within DHS.
- Communications: Department of Homeland Security.
CISA lists 16 sectors in total. The other ten have their own pages.
What an SRMA does for you
The agency coordinates its sector, publishes plans and runs a coordinating council with owners and operators. The water page, for example, names a Government Coordinating Council and a self-governed Water Sector Coordinating Council of owner-operators.
For a small operator, the useful moves are:
- Read the sector-specific plan. Several pages note a 2015 plan, so some content is dated.
- Find the sector coordinating council and ask how members join.
- Look for sector guidance on cyber, such as EPA material for water.
A note on gaps
The dams page we read does not name an SRMA, so do not assume every page lists one. Where it is missing, check the CISA sector page or ask CISA.
Why bother
When an incident touches several sectors, for example a power outage that hits water pumping and hospitals, knowing the agency for each is faster than searching mid-crisis. Put the six names in your incident contact sheet.
A contact sheet you can build in ten minutes
Make a one page sheet with four columns: sector, agency, the CISA page link, and the person at your organization who owns the relationship. Add the sector coordinating council if you have found it. Print it and keep a copy off the network.
During a multi-sector event, such as a regional power loss, this sheet saves the first twenty minutes of searching. It also shows gaps: if nobody owns the relationship with your agency, that is worth fixing before the day you need it.
Quick check
Is CISA the SRMA for every sector?
No. CISA is the SRMA for emergency services among these six. Others are led by agencies such as HHS, EPA and the Department of Energy.
Who covers transportation?
DHS and the Department of Transportation are co-SRMAs, per CISA's page.
Sources
- CISA: Critical infrastructure sectors
- CISA: Healthcare and Public Health
- CISA: Water and Wastewater
- CISA: Energy
- CISA: Transportation Systems
- CISA: Emergency Services
- CISA: Communications
Last reviewed: 19 October 2026.
