What qualifies as critical infrastructure depends on jurisdiction, sector, function, and formal designation.
Protection must address deliberate attacks, accidents, equipment failure, natural hazards, and dependencies across energy, communications, water, transport, digital services, supply chains, and other essential functions. Priorities should follow service consequences, not merely asset count or replacement cost.
Key points
Understand essential functionsIdentify services, minimum delivery, critical assets and people, dependencies, single points of failure, geographic concentration, and consequences for communities and other sectors.
Reduce multiple hazardsCombine physical barriers, access control, secure engineering, monitoring, maintenance, supplier controls, workforce preparation, emergency procedures, and risk-informed upgrades.
Build response and resilienceEstablish coordination, communications, alternate operations, tested recovery priorities, mutual assistance, exercises, and decision authority that preserve safety during disruption.
Important limitationA sector label, regulatory designation, or checklist does not prove protection or resilience. Requirements vary by jurisdiction, and securing one asset can shift risk or create safety consequences elsewhere.