National Security Memorandum 22 was issued on 30 April 2024 and replaced Presidential Policy Directive 21 from 2013. It names CISA as National Coordinator for infrastructure security and resilience, clarifies the role of sector risk management agencies, and directs regulators to set minimum requirements. Check whether it still stands before relying on it.
What it replaced
PPD-21, signed by President Obama in 2013, created sector-specific agencies. Those became sector risk management agencies, or SRMAs, with a clearer job: issue sector risk management plans and coordinate within the sector and with CISA.
The main points
From a Nozomi Networks summary of the memorandum:
- CISA is National Coordinator for Security and Resilience.
- Systemically important entities are those whose disruption could significantly affect national security, public health or safety. CISA keeps a non-public list, and these entities get priority access to risk mitigation information and operational resources.
- Minimum requirements. Federal regulators are told to draw on existing voluntary consensus standards and to establish minimum requirements and accountability mechanisms.
The sector list stayed at 16 sectors, per CISA's own sector page.
What this means for operators
If you are in a regulated sector, expect more detail from your SRMA over time. If you are a small operator, the practical change is mostly who to call and what plans to read. Your SRMA is listed on CISA's sector pages, and our companion post on finding it walks through six of them.
A caution on status
This summary is from May 2024. Policy documents of this kind can be revised by later administrations. We did not verify the status as of October 2026, so read the current White House and CISA pages before citing it.
What to do
- Find your SRMA and read its sector plan.
- Check whether your sector regulator has issued minimum requirements.
- Join your sector information sharing group.
Safeguard offers compliance and evidence automation for teams that need to show control status to regulators.
Why the vocabulary change matters
Changing sector-specific agency to sector risk management agency looks cosmetic. The summary points to a real shift in emphasis: the agency is expected to manage risk for its sector and issue plans, not just act as a point of contact. For an operator that means more expectation of structured risk work, such as documented assessments and a plan that someone senior has signed.
The minimum requirements line is the other part to watch. It tells regulators to build on existing voluntary standards rather than invent new ones from scratch. If your sector already has a recognized standard, adopting it early is usually safer than waiting.
Quick check
Did NSM-22 change the number of sectors?
No. The sector count is 16 on CISA's page.
Who is on the list of systemically important entities?
The list is non-public.
Sources
Last reviewed: 19 October 2026.
