CISA lists 16 critical infrastructure sectors: chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government services and facilities, healthcare and public health, information technology, nuclear, transportation systems, and water and wastewater.
The full list
According to the CISA page on critical infrastructure sectors, the sixteen are:
- Chemical
- Commercial Facilities
- Communications
- Critical Manufacturing
- Dams
- Defense Industrial Base
- Emergency Services
- Energy
- Financial Services
- Food and Agriculture
- Government Services and Facilities
- Healthcare and Public Health
- Information Technology
- Nuclear Reactors, Materials, and Waste
- Transportation Systems
- Water and Wastewater
The list is short enough to memorize, but the boundaries are blurry. A hospital sits in healthcare, yet it also depends on energy, water and communications. A software vendor sits in information technology, yet its customers may be in any of the other fifteen.
Why the list matters to a security team
Sector membership shapes which guidance reaches you. CISA publishes cross-sector goals, and it also lists sector-specific goals for a few sectors, as described in our post on the cybersecurity performance goals. Reporting rules, regulators and information sharing groups often follow the same sector lines.
Membership also affects how customers read your questionnaire answers. If you sell into water, energy or healthcare, expect buyers to ask about remote access, asset inventories and how you handle software vulnerabilities.
Dependencies cross sector lines
The sector model is a filing system, not a map of risk. Many incidents spread because one sector depends on another. Communications and energy underpin almost everything. Information technology underpins the control systems in the rest.
For a practical view, list the three outside services your operation cannot run without for a day. Then ask what your plan is if each one goes away. That exercise tells you more than a sector label does.
Three questions to ask about your own place on the list
Start with where you sit. Many organizations belong to one sector by regulation and another by practice. A hospital network that runs its own power plant and water treatment is touching three sectors.
Next, ask who depends on you. If a customer in water or energy relies on your software or service, their continuity plan probably includes a line about you, whether you wrote it or not.
Finally, ask what you would tell a regulator or a buyer if they asked how you know your inventory is current. The answer should be a process, not a person's memory.
What the page does not say
The CISA page lists the sectors. It does not, in the version we read, name a risk management agency for each one, and it does not describe the policy directives behind the structure. If you need those details, check the current policy documents directly rather than relying on a secondary summary.
The page does include a note that workers in these sectors who face retaliation for raising concerns may contact the US Department of Labor's OSHA. That is a useful thing to put in front of staff who report safety or security problems.
Quick check
Is healthcare critical infrastructure?
Yes. Healthcare and Public Health is one of the 16 sectors on the CISA list.
Is software part of critical infrastructure?
Information Technology is its own sector, and software also runs inside every other sector. A flaw in a widely used component can therefore reach several sectors at once.
If you build or run software for these sectors, Safeguard can scan your dependencies and generate an SBOM, and there is a free scan at gold.safeguard.sh/scan. It covers the software supply chain side, not the control hardware itself.
Sources
Last reviewed: 19 October 2026.
