Critical infrastructure, or critical national infrastructure (CNI) in the UK, describes infrastructure considered essential by governments for the functioning of a society and economy and deserving of special protection for national security. Critical infrastructure has traditionally been viewed as under the scope of government due to its strategic importance, yet there is an observable trend towards its privatization, raising discussions about how the private sector can contribute to these essential services. It is important to distinct between critical maritime infrastructure (CMI) and critical terrestrial infrastructure (CTI) because CMI reflects the maritime dimension of critical infrastructure while CTI reflects the land-based dimension.
Characteristics of critical infrastructure
Critical infrastructure systems share several common characteristics that distinguish them from non-critical assets. These systems provide essential services whose disruption can result in significant impacts to public safety, economic stability, national security, and societal well-being.
Critical infrastructure is typically characterized by high levels of interdependency across sectors, meaning that failures in one system can trigger cascading effects in others. For example, disruptions to electrical power systems can impair telecommunications, healthcare delivery, water treatment, and financial services simultaneously.
Many critical infrastructure assets are owned and operated by private entities, while regulatory oversight and coordination are often managed by government agencies. This structure necessitates close public–private collaboration to ensure effective risk management and continuity of essential services.
Interdependencies and cascading failures
Critical infrastructure sectors are highly interconnected through physical, cyber, geographic, and logical dependencies. As a result, disruptions can propagate across multiple sectors, amplifying the overall impact of an incident. These cascading failures have been observed during large-scale power outages, natural disasters, and cyber incidents affecting industrial control systems.
Understanding and managing these interdependencies is a central component of infrastructure risk assessment and resilience planning. Researchers and policymakers emphasize that failure to account for cross-sector dependencies can lead to underestimation of risk and ineffective mitigation strategies.
Resilience and preparedness
Modern critical infrastructure protection strategies increasingly emphasize resilience in addition to prevention. Resilience refers to the ability of systems to withstand disruptions, continue delivering essential functions, and recover rapidly following adverse events. This approach recognizes that not all threats can be fully prevented, particularly in complex and highly connected environments.
Resilience planning typically includes redundancy, system diversity, incident preparedness, coordinated response planning, and recovery mechanisms. These measures are designed to reduce both the likelihood and severity of service disruptions across critical sectors.
Additional discussion of infrastructure resilience, interdependencies, and incident management approaches is provided in practitioner-focused literature on critical infrastructure operations and response planning.
Emerging threats and evolving risk landscape
The threat landscape affecting critical infrastructure has expanded with increased digitalization and connectivity. Cyber attacks targeting operational technology and industrial control systems have become more frequent, with incidents ranging from ransomware to state-sponsored intrusions.
Geopolitical tensions, hybrid warfare tactics, and climate-related hazards have further heightened concern regarding infrastructure vulnerability. In response, many governments have introduced regulatory requirements focused on risk assessment, incident reporting, and resilience enhancement for critical infrastructure operators.
Governance and coordination
Effective protection of critical infrastructure relies on coordinated governance models that integrate government authorities, private operators, and sector-specific organizations. Information sharing initiatives, such as Information Sharing and Analysis Centers (ISACs), support collaboration by enabling the exchange of threat intelligence and best practices among stakeholders.
National frameworks and sector-specific strategies are commonly used to align risk management, preparedness, and response activities across jurisdictions and industries. These frameworks reflect the recognition that critical infrastructure security is both a technical and organizational challenge.
Items Most commonly associated with the term are assets and facilities for: Shelter; Heating (e.g. natural gas, fuel oil, district heating); Agriculture, food production and distribution; Education, skills development and technology transfer / basic subsistence and unemployment rate statistics; Water supply (drinking water, waste water/sewage, stemming of surface water (e.g. dikes and sluices)); Public health (hospitals, ambulances); Transportation systems (fuel supply, railway network, airports, harbours, inland shipping); Security services (police, military). Electricity generation, transmission and distribution; (e.g. natural gas, fuel oil, coal, nuclear power) Renewable energy, which are naturally replenished on a human timescale, such as sunlight, wind, rain, tides, waves, and geothermal heat. Telecommunication; coordination for successful operations Economic sector; Goods and services and financial services (banking, clearing);
Protection programmes
Canada The Canadian Federal Government identifies the following 10 Critical Infrastructure Sectors as a way to classify essential assets. Energy & Utilities: Electricity providers; off-shore/on-shore oil & gas; coal supplies, natural gas providers; home fuel oil; gas station supplies; alternative energy suppliers (wind, solar, other) Information and Communication Technology: Broadcast Media; telecommunication providers (landlines, cell phones, internet, wifi); Postal services; Finance: Banking services, government finance/aid departments; taxation Health: Public health & wellness programs, hospital/clinic facilities; blood & blood products Food: Food supply chains; food inspectors; import/export programs; grocery stores; Agri & Aqua culture; farmers markets Water: Water supply & protection; wastewater management; fisheries & ocean protection programs Transportation: Roads, bridges, railways, aviation/airports; shipping & ports; transit Safety: Emergency responders; public safety programs Government: Military; Continuity of governance Manufacturing: Industry, economic development
European Union
European Programme for Critical Infrastructure Protection (EPCIP) refers to the doctrine or specific programs created as a result of the European Commission's directive EU COM(2006) 786 which designates European critical infrastructure that, in case of fault, incident, or attack, could impact both the country where it is hosted and at least one other European Member State. Member states are obliged to adopt the 2006 directive into their national statutes.
It has proposed a list of European critical infrastructures based upon inputs by its member states. Each designated European Critical Infrastructures (ECI) will have to have an Operator Security Plan (OSP) covering the identification of important assets, a risk analysis based on major threat scenarios and the vulnerability of each asset, and the identification, selection and prioritisation of counter-measures and procedures.
Germany The German critical-infrastructure protection programme KRITIS is coordinated by the Federal Ministry of the Interior. Some of its special agencies like the German Federal Office for Information Security or the Federal Office of Civil Protection and Disaster Assistance BBK deliver the respective content, e.g., about IT systems.
Singapore In Singapore, critical infrastructures are mandated under the Protected Areas and Protected Places Act. In 2017, the Infrastructure Protection Act was passed in Parliament, which provides for the protection of certain areas, places and other premises in Singapore against security risks. It came into force in 2018.
United Kingdom
In the UK, the National Protective Security Authority (NPSA) provides information, personnel and physical security advice to the businesses and organizations which make up the UK's national infrastructure, helping to reduce its vulnerability to terrorism and other threats.
It can call on resources from other government departments and agencies, including MI5, the National Cyber Security Centre (NCSC) and other government departments responsible for national infrastructure sectors.
United States
The U.S. has had a wide-reaching critical infrastructure protection program in place since 1996. Its Patriot Act of 2001 defined critical infrastructure as those "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters."
In 2014 the NIST Cybersecurity Framework was published, and quickly became a popular set of guidelines, despite the significant costs of full compliance.
These have identified a number of critical infrastructures and responsible agencies:
Agriculture and food – Departments of Agriculture and Health and Human Services Water – Environmental Protection Agency Public Health – Department of Health and Human Services Emergency Services – Department of Homeland Security Government – Department of Homeland Security Defense Industrial Base – Department of Defense Information and Telecommunications – Department of Commerce Energy – Department of Energy Transportation and Shipping – Department of Transportation Banking and Finance – Department of the Treasury Chemical Industry and Hazardous Materials – Department of Homeland Security Post – Department of Homeland Security National monuments and icons - Department of the Interior Critical manufacturing - Department of Homeland Security (14th sector announced March 3, 2008; recorded April 30, 2008)
National Infrastructure Protection Plan The National Infrastructure Protection Plan (NIPP) defines critical infrastructure sector in the US. Presidential Policy Directive 21 (PPD-21), issued in February 2013 entitled Critical Infrastructure Security and Resilience mandated an update to the NIPP. This revision of the plan established the following 16 critical infrastructure sectors:
Chemical Commercial facilities Communications Critical manufacturing Dams Defense industrial base Emergency services Energy Financial services Food and agriculture Government facilities Healthcare and public health Information technology Nuclear reactors, materials, and waste Transportation systems Water and wastewater systems
National Monuments and Icons along with the postal and shipping sector were removed in 2013 update to the NIPP. The 2013 version of the NIPP has faced criticism for lacking viable risk measures. The plan assigns the following agencies sector-specific coordination responsibilities:
Department of Homeland Security Chemical Commercial facilities Communications Critical manufacturing Dams Emergency services Government facilities (jointly with General Services Administration) Information technology Nuclear reactors, materials, and waste Transportation systems (jointly with Department of Transportation)
Department of Defense Defense industrial base
Department of Energy Energy
Department of the Treasury Financial services
Department of Agriculture