Myth: the government runs critical infrastructure, so the government will fix its security. Fact: CISA's sector pages say most of it is privately owned. They say more than 80 percent of energy infrastructure is private, most health assets are private, and the private sector owns and operates most communications infrastructure.
What the pages say
- Energy: more than 80 percent of the country's energy infrastructure is privately owned.
- Healthcare and Public Health: most assets are privately owned and operated, so collaboration and information sharing between public and private sectors is essential.
- Communications: the private sector owns and operates most of it and is primarily responsible for protecting it. CISA and the federal government support by helping the private sector anticipate and respond to outages.
- Water: the sector includes about 152,000 public drinking water systems. A self-governed council of owner-operators sits next to the government council.
Why the myth persists
Roads, dams and schools look public. A power line or an internet exchange does not. And news about "attacks on infrastructure" often comes from government statements, which can make it sound like a government system.
Why it matters
If the owner is private, the owner pays for the fix, sets the patch schedule and writes the incident plan. Government helps with information, guidance and in some sectors rules, but the daily work sits with the operator.
Mixed ownership also means mixed capability. A large utility has a security team. A small water system may have one person who does everything.
What to do with this fact
- If you operate infrastructure, assume the job is yours.
- Use the free help that exists. CISA offers resources through its sector pages, and our post on EPA's free assessment covers water.
- Join your sector group, so you hear early.
- If you supply software, remember your customer may have a very small team. Clear fixes and plain advisories help.
A caution
The fact above is about ownership, not about who is responsible when something goes wrong. Regulation varies by sector. Check your own agency.
Safeguard can help software suppliers and operators with SBOM and dependency scanning, and with fix PRs for code they maintain (off by default).
What it changes for a software vendor
If your customers are privately owned utilities, hospitals or carriers, you are a supplier to a private operator who answers to regulators, not an agency. Questionnaires will come from the operator. Keep standard answers ready: SBOM availability, patch timelines, incident notice and the contact for security reports. Doing this once, well, saves hours per customer.
Quick check
Is all critical infrastructure private?
No. The pages say most is, and some assets are public. Public water systems are an example.
Does private ownership mean no government role?
No. The government coordinates, shares information and in some sectors regulates.
Sources
Last reviewed: 19 October 2026.
