Chapter 19 — Critical infrastructure and sector security: scope and theory
Lesson map
Lesson 19 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes and connection"]
N1["19.1 What critical means"]
N2["19.2 Three lenses"]
N3["19.3 What is distinctive about the field"]
N4["19.5 Practical activity"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["19.1 What critical means"]
N2["19.2 Three lenses"]
N3["19.3 What is distinctive about the field"]
N4["19.5 Practical activity"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]
[Learning outcomes and connection]
|
v
[19.1 What critical means]
|
v
[19.2 Three lenses]
|
v
[19.3 What is distinctive about the field]
|
v
[19.5 Practical activity]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes and connection
After this chapter you can (1) explain what makes infrastructure "critical" and compare how the United States, the European Union and the United Kingdom define and organise it; (2) use the ideas of critical functions, interdependency and resilience to analyse a service; (3) compare three theoretical lenses — risk, resilience and safety/systems — and say what each sees and misses; and (4) place an organisation in its regulatory and sector context. It opens the field core of the book and builds on all of Chapters 1–18.
19.1 What "critical" means
Infrastructure is critical when its disruption would seriously harm health, safety, economic security or the functioning of society. Governments operationalise this differently. The United States designates sixteen critical-infrastructure sectors, from energy and water to healthcare and financial services (CISA, Critical Infrastructure Sectors), and complements sectors with a set of National Critical Functions — functions such as "supply water" or "provide medical care" whose disruption would be debilitating (CISA, NCF set). The European Union regulates cybersecurity of "essential" and "important" entities across many sectors through the NIS2 Directive (Directive (EU) 2022/2555), the broader physical and operational resilience of "critical entities" through the CER Directive (Directive (EU) 2022/2557), and the digital operational resilience of financial entities through DORA (Regulation (EU) 2022/2554). The UK's National Cyber Security Centre publishes the Cyber Assessment Framework used to assess operators of essential services (NCSC CAF).
The functions view is often more useful than the sector view. Calder Valley Hospital is "healthcare", but the function people need is "provide emergency care", which depends on electricity, water, communications, dispatch and supply chains run by other sectors.
19.2 Three lenses
Risk (Chapter 23) asks: what could happen, how likely, how bad, and which controls reduce it most for the money? Its strength is prioritisation; its weakness is that rare, novel or cascading events are poorly captured by likelihood estimates. Resilience asks: when disruption happens — whatever its cause — how does the service absorb, adapt and recover? Haimes defines resilience as the ability to withstand a major disruption within acceptable degradation and recover within acceptable time and cost (Haimes, 2009); Bruneau and colleagues measured it as the loss of service quality over time (Bruneau et al., 2003). NIST's cyber-resiliency engineering guidance applies these ideas to systems (SP 800-160 Vol. 2 Rev. 1). Safety and systems views treat accidents as the result of inadequate control over interacting components rather than single failures (Leveson, 2004) and remind us that human error is usually a symptom of system design (Reason, 2000). A competent analyst uses all three: risk to prioritise, resilience to prepare for what risk analysis missed, systems thinking to understand how organisations and technology fail together.
19.3 What is distinctive about the field
Five features recur across sectors: physical consequences (harm to people and environment, not only data); long-lived technology (Chapter 2); interdependency (Chapter 22); regulation and public accountability; and mixed ownership — most infrastructure is privately operated but publicly relied upon, so incentives to invest in rare-event protection are weak. These features explain why "apply the enterprise IT playbook" fails and why sector-specific knowledge matters.
At Calder these features are concrete: CVH's harm is physical (patients), CPN's RTUs last decades, the substation feeds four other services (Lab 3), each operator answers to its own regulator, and most are private companies whose failure harms county residents who are not their customers.
19.4 Worked example: profiling CEDC (synthetic)
This case is synthetic. A sector profile of the County Emergency Dispatch Centre: function — receive emergency calls and dispatch ambulances, fire and police; harm from loss — delayed response within minutes; dependencies — telecom (calls and CAD data), power (UPS and generator), CAD vendor cloud services, staff; regulatory context — public-service duties and, depending on jurisdiction, cybersecurity obligations for essential entities (to be verified with counsel); lenses — risk: ransomware on CAD is the top scenario; resilience: the paper-and-radio fallback must sustain dispatch for hours; systems: a 2 a.m. switchover to paper is a human-factors problem as much as a technical one. The profile does not yet say what to do; it says what questions matter.
19.5 Practical activity
Choose one real sector in your country. From official sources, find: who designates it as critical, which law or framework sets its cybersecurity obligations, which agency supervises it and which public guidance applies. Record each source with its date. Do not assume the EU, US or UK model applies elsewhere.
Record the jurisdiction and the date of each source, because definitions change: the EU replaced its earlier network-security directive with NIS2, and national transposition dates differ. Where a framework applies only above a size threshold, note the threshold and whether the operator you chose meets it.
19.6 Common errors and limits
- Equating "critical infrastructure" with "OT".
- Reading a sector list as a list of independent sectors.
- Using one lens and ignoring what the others reveal.
- Stating legal obligations without checking the current text and jurisdiction.
CEDC shows the first error: a dispatch centre has almost no OT and is still critical. Lab 3 shows the second: the substation, telecom and water entries depend on each other. Using only the risk lens on CEDC would miss the 2 a.m. paper-switchover problem. And the CEDC profile deliberately leaves its legal obligations "to be verified with counsel".
Exercises — chapter 19
EX037 — Functions not sectors. Objective: apply the functions view. Inputs: Calder Mutual. Steps: name two critical functions it supports, their dependencies on other sectors, and the harm timeline if each stops. Expected evidence: short profile. Rubric: 3 = functions such as "provide payment services" and "provide cash access", dependencies on power/telecom/other financial infrastructure, harm timeline (hours for payments, days for salaries/benefits); 2 = sector-level only; 1 = vague; 0 = none.
EX038 — Three lenses. Objective: compare theories on one case. Inputs: CW treatment works. Steps: write one question each lens would ask and one thing each might miss. Expected evidence: three pairs. Rubric: 3 = risk (likely scenarios; misses novel cascades), resilience (recovery/degraded modes; may underweight prevention economics), systems (control structure, human/organisational factors; harder to quantify); 2 = two lenses; 1 = one; 0 = none.
Chapter synthesis
Infrastructure is critical because society depends on its functions. Jurisdictions organise it differently through sectors, functions and laws such as NIS2, CER and DORA. Risk, resilience and systems thinking are complementary lenses, and the field's distinctive features — physical consequence, longevity, interdependency, regulation and mixed ownership — explain why it needs its own discipline.
Continue studying — chapter 19 of 40
← Chapter 18 · Course chapter index · Chapter 20 →
Continue to the next authored lesson.