Critical infrastructure protection is the work of securing and keeping running the physical and digital systems a society depends on, such as power, water, health care and communications. CISA identifies 16 critical infrastructure sectors. Operators typically organize their program around a framework such as the NIST Cybersecurity Framework 2.0.
Which sectors count?
CISA lists 16 sectors: chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors materials and waste, transportation systems, and water and wastewater systems.
The sectors depend on each other. A power outage stops water pumping and hospital operations. A failure at a telecommunications provider hits payments. CISA describes the sectors as a complex, interconnected ecosystem, and that interdependence is why a single compromise can cascade.
What makes these systems hard to protect?
Operational technology. Many sectors run industrial control systems that were designed for reliability and long life, not for connection to the internet. Some run for decades, cannot be patched without scheduled downtime, and speak protocols with no authentication.
Safety. A bad patch in an office laptop is an annoyance. A bad change to a controller can hurt people or equipment. Security changes need operational approval.
Mixed ownership. Most infrastructure in many countries is owned by private companies, while the public bears the consequences of failure. That makes voluntary frameworks, sector coordination and information sharing important.
Supply chain. A utility depends on vendors for control software, remote support tools and components. A weakness at one supplier can reach many operators at once.
How should an operator organize a program?
The NIST Cybersecurity Framework 2.0 offers a common structure. It has six functions: govern, identify, protect, detect, respond and recover. Govern, added in version 2.0, covers strategy, roles and risk management decisions. NIST describes the framework as applicable to organizations of all sizes and sectors, which makes it a useful shared language between an operator, its regulators and its suppliers.
A constructed example. A small municipal water utility has 12 staff. Under identify, it lists its pumps, treatment controllers, remote access paths and vendors. Under protect, it removes direct internet exposure from controllers and requires multifactor authentication for remote support. Under detect, it logs remote sessions. Under respond and recover, it writes a manual operations procedure so plants can run if the control network is offline. None of it needs a large budget. It needs an inventory and decisions.
What does good look like for a small operator?
Scale the work to the size of the organization. A small operator does not need a security operations center. It needs to know what it runs, who can reach it, and what it will do when something fails. Practical signs of progress are simple: no control system reachable directly from the internet, remote access that requires a second factor and is logged, backups of controller configurations stored offline, and a printed procedure for running by hand.
It also helps to join the information sharing community for your sector, where operators trade warnings about threats that target similar equipment. Many incidents in this area start with a flaw that others have already seen, so hearing about it early is valuable.
How do regulations fit in?
Many sectors face sector specific rules or mandatory incident reporting, and requirements differ by country and by sector. They change often. Check with your regulator and counsel for the obligations that apply to you instead of relying on a general summary. A framework helps you meet most of them, but it does not replace them.
How to check or apply this
- Identify which sector or sectors your organization belongs to, and whether any rule applies.
- Build an asset inventory that includes operational technology, not only IT.
- Map every path from the internet and from corporate IT into control systems, and close or protect each one.
- Require multifactor authentication and logging for all remote access.
- Write and rehearse a manual fallback for your most important service.
- Ask critical suppliers how they notify you of vulnerabilities.
- Score yourself against the six CSF functions and choose three gaps to close this year.
Quick check
Is critical infrastructure only a government concern?
No. Much of it is run by private companies. Government agencies coordinate, share information and sometimes regulate, but operators carry the day to day work.
Does the NIST framework apply outside the United States?
NIST states the framework is for organizations of any size or sector. Many non-US organizations use it as a common structure alongside local rules.
Sources
Last reviewed: 18 October 2026.
