Chapter 2 — Critical infrastructure and sector security: current practice

Chapter 2 — Critical infrastructure and sector security: current practice

Lesson map

Lesson 02 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["2.1 What current practice means for a specialist"]
  N2["2.2 Cross-sector baselines"]
  N3["2.3 Sector regimes create different kinds of obligat"]
  N4["2.4 Why sector practice differs"]
  N5["2.5 Claimed, documented and verified"]
  N6["2.6 Prioritizing by consequence"]
  N7["2.8 Practical activity: claimed versus verified cove"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["2.1 What current practice means for a specialist"]
  N2["2.2 Cross-sector baselines"]
  N3["2.3 Sector regimes create different kinds of obligat"]
  N4["2.4 Why sector practice differs"]
  N5["2.5 Claimed, documented and verified"]
  N6["2.6 Prioritizing by consequence"]
  N7["2.8 Practical activity: claimed versus verified cove"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX007"]

[Learning outcomes and connection]
    |
    v
[2.1 What current practice means for a specialist]
    |
    v
[2.2 Cross-sector baselines]
    |
    v
[2.3 Sector regimes create different kinds of obligat]
    |
    v
[2.4 Why sector practice differs]
    |
    v
[2.5 Claimed, documented and verified]
    |
    v
[2.6 Prioritizing by consequence]
    |
    v
[2.8 Practical activity: claimed versus verified cove]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes and connection

After this chapter you should be able to:

1. Describe the main cross-sector and sector-specific baselines and regimes an essential-service operator is likely to meet, and what kind of obligation each creates.
2. Explain why sectors that share technology still need different practice: consequence, physics, regulation and workforce differ.
3. Distinguish claimed, documented and verified implementation of a practice, and measure the gap.
4. Prioritize gaps by consequence for the essential service rather than by count.
5. Critique a common practice and propose a better-evidenced alternative.

Chapter 1 gave you a way to choose among options. This chapter supplies the options a competent specialist is expected to know and the evidence standard for saying they are in place. Chapter 3 then asks what counts as evidence when something goes wrong.

2.1 What "current practice" means for a specialist

"Current practice" is not a single list. It is the overlap of three things: what regulators and standards require in your jurisdiction and sector; what authoritative guidance recommends based on observed attacks; and what comparable operators actually do and can show. A specialist must know all three, and must be able to say which statements in a security programme come from which source, because they carry different weight. A legal obligation is a constraint; a standard's requirement may be contractual or certifiable; guidance is advice to be weighed against your own consequence analysis.

Practice also ages. Advisories about pre-positioning in infrastructure networks by state-sponsored actors using legitimate administration tools (CISA, AA24-038A, 2024) changed what "adequate logging" and "adequate credential hygiene" mean for operators who had treated those as IT housekeeping. A baseline that was current three years ago may now be a floor.

2.2 Cross-sector baselines

Four families of documents recur across sectors:

• Outcome frameworks. NIST CSF 2.0 organizes outcomes under Govern, Identify, Protect, Detect, Respond and Recover (NIST, 2024). The UK NCSC Cyber Assessment Framework sets four objectives — managing security risk, protecting against cyber attack, detecting cyber security events and minimizing the impact of incidents — with indicators of good practice for each principle, and is designed around essential functions (NCSC, CAF). Outcome frameworks say what must be achieved, not how; they are good for structuring a programme and poor as test scripts.
• Prioritized baselines. CISA's Cross-Sector Cybersecurity Performance Goals list a small set of practices with high risk-reduction value for organizations of any size (CISA, CPGs); the U.S. Department of Health and Human Services published healthcare-specific performance goals in the same spirit (HHS, HPH CPGs, 2024). They are useful precisely because they are short; they are not a complete programme.
• Control catalogues. NIST SP 800-53 Rev. 5 is a comprehensive catalogue of security and privacy controls (NIST); NIST SP 800-82 Rev. 3 adapts guidance to operational technology, including overlays and the particular constraints of control systems (NIST, 2023).
• Industrial standards. The ISA/IEC 62443 series addresses security of industrial automation and control systems across asset owners, integrators and product suppliers, including zones and conduits, security levels and secure product development (ISA overview). Its risk-assessment part for system design, IEC 62443-3-2, is the usual starting point for an OT architecture review (IEC catalogue page).

2.3 Sector regimes create different kinds of obligation

At organization scale, the question is not "which framework is best" but "which obligations apply to us, and what evidence will each regulator expect". Examples, all to be re-verified for your jurisdiction and date:

Two lessons follow. First, an operator spanning sectors — a multi-utility, a port with its own power network — may sit under several regimes with different reporting clocks and evidence styles; harmonizing them into one internal control set with mappings is a core specialist task. Second, compliance is a floor and a constraint, as Chapter 1 argued: two operators fully compliant with the same regime can have very different resilience.

2.4 Why sector practice differs

Shared technology tempts people to copy practice between sectors. Four differences make that unsafe:

1. Consequence and time. A hospital's clinical systems fail into minutes-to-hours harm; a water system with storage may have hours to days; a payment system's harm accumulates in settlement windows; a port's in cargo dwell time and supply chains. The time to harm sets how much manual fallback and how fast a response must be.
2. Physics and safety. In OT, a security action can itself cause harm: an aggressive scan can crash a controller; isolating a network can blind operators. NIST SP 800-82 stresses that availability and safety constraints shape what security controls are acceptable (NIST, 2023).
3. Regulation and evidence culture. Electricity in North America works to auditable, prescriptive requirements; many water utilities work to periodic certified assessments; healthcare works under privacy law and clinical-safety governance as well as security rules.
4. Workforce and suppliers. Small utilities may have no security staff; hospitals depend on medical-device manufacturers for patching; ports depend on terminal-operating-system vendors and shipping lines. Who can actually implement a practice determines whether it is real.

2.5 Claimed, documented and verified

Most baseline assessments are self-assessments. They are useful, but a specialist must know how much of a "yes" is verified. Use three evidence grades:

• Verified (V): the practice was observed working by test, inspection or reconciliation — a restore was performed and timed; the identity provider's configuration was exported and checked; broker logs were reconciled against firewall sessions.
• Documented (D): a policy, design or procedure exists and says the practice is in place, but nobody tested that reality matches.
• Statement (S): someone said so.

Assessment methods in the NIST catalogue distinguish examining, interviewing and testing for the same reason (NIST SP 800-53 Rev. 5). The gap between claimed and verified coverage is often the most important number in a baseline report, and the most often omitted. It is also where incidents live: offline backups that "exist" but have never been restored; vendor access that is "brokered" except for the one legacy modem.

2.6 Prioritizing by consequence

A practice's importance depends on how much it limits loss of the essential service. Weight practices by consequence — not by how many framework references they map to — and prioritize gaps where the weight is high and the verified score is low. The weights are judgements; record who set them (Chapter 1). For Merrow Bay, the forum agreed that MFA on remote access, IT/OT segmentation, tested offline backups and brokered vendor access carry the highest weight, because each directly limits a pathway to loss of supply seen in public incidents — remote-access compromise of a water treatment system was the subject of a 2021 joint advisory (CISA, AA21-042A), even though the account of that specific event was later disputed (WUSF, 2023); the remote-access weakness the advisory described remains a valid design concern either way.

2.7 Worked example: four operators' self-assessments (synthetic)

The Merrow Bay Resilience Forum asked four operators to self-assess eight practices, scoring 0 (absent), 1 (partial) or 2 (in place), and to grade the evidence V, D or S. The specialist's task is to turn the answers into a regional picture without insulting anyone or believing everything. Rather than "rejecting" statements, Lab 2 gives them zero provisional credit until tested and half credit for documents. Those credits are a policy choice; EX007 tests their effect.

Two conventions shape the results. The weights for each practice were agreed by the forum, so the regional picture reflects their judgement about which practices limit loss of supply. And the operators are named in this example only because it is synthetic; a real forum report would normally show each operator its own row and give the others only the regional summary. The specialist should send each operator its result privately before the forum meets, so that nobody learns of an uncomfortable gap in front of peers.

2.8 Practical activity: claimed versus verified coverage

# Lab 2 - claimed versus verified baseline coverage, weighted by consequence (offline, standard library only)
# Synthetic: four Merrow Bay operators self-assess eight baseline practices (0 = absent, 1 = partial, 2 = in place)
# and say what evidence backs each answer: V = verified by test or inspection, D = document only, S = statement only.
PRACTICES = {  # practice -> consequence weight (how much it limits loss of the essential service; invented)
    "MFA on remote access": 3, "asset inventory incl. OT": 2, "IT/OT segmentation": 3,
    "offline backups restored in test": 3, "central logging retained 90d": 1,
    "incident plan exercised in 12 months": 2, "vendor access brokered and recorded": 3,
    "default credentials removed": 2,
}
ANSWERS = {  # operator -> list of (score, evidence) in PRACTICES order
    "Merrow Water":     [(2,"V"),(1,"D"),(2,"D"),(2,"S"),(1,"V"),(2,"V"),(1,"S"),(2,"S")],
    "Merrow Health":    [(2,"V"),(1,"D"),(1,"D"),(2,"V"),(2,"V"),(2,"D"),(1,"D"),(1,"S")],
    "Merrow Energy":    [(2,"V"),(2,"V"),(2,"V"),(1,"D"),(2,"V"),(2,"V"),(2,"D"),(2,"D")],
    "Port of Merrow":   [(2,"S"),(0,"S"),(1,"S"),(2,"S"),(1,"D"),(1,"S"),(0,"S"),(2,"S")],
}
CREDIT = {"V": 1.0, "D": 0.5, "S": 0.0}  # how much of a claimed score we accept without further testing
W = list(PRACTICES.values()); maxw = 2 * sum(W)
print(f"{'operator':16s} claimed  verified  gap(weighted points)")
gaps = []
for op, ans in ANSWERS.items():
    claimed = sum(w * s for w, (s, e) in zip(W, ans))
    verified = sum(w * s * CREDIT[e] for w, (s, e) in zip(W, ans))
    print(f"{op:16s} {claimed/maxw:6.0%}   {verified/maxw:6.0%}   {maxw-verified:5.1f}")
    for (name, w), (s, e) in zip(PRACTICES.items(), ans):
        unverified = w * (2 - s * CREDIT[e])
        if w == 3 and unverified >= 3:
            gaps.append((unverified, op, name, s, e))
print("\nHigh-consequence practices with >= 3 unverified weighted points:")
for u, op, name, s, e in sorted(gaps, reverse=True):
    print(f"  {u:4.1f}  {op:16s} {name}  (claimed {s}, evidence {e})")

Expected output:

operator         claimed  verified  gap(weighted points)
Merrow Water        84%      39%    23.0
Merrow Health       74%      53%    18.0
Merrow Energy       92%      75%     9.5
Port of Merrow      58%       1%    37.5

High-consequence practices with >= 3 unverified weighted points:
   6.0  Port of Merrow   vendor access brokered and recorded  (claimed 0, evidence S)
   6.0  Port of Merrow   offline backups restored in test  (claimed 2, evidence S)
   6.0  Port of Merrow   MFA on remote access  (claimed 2, evidence S)
   6.0  Port of Merrow   IT/OT segmentation  (claimed 1, evidence S)
   6.0  Merrow Water     vendor access brokered and recorded  (claimed 1, evidence S)
   6.0  Merrow Water     offline backups restored in test  (claimed 2, evidence S)
   4.5  Merrow Health    vendor access brokered and recorded  (claimed 1, evidence D)
   4.5  Merrow Health    IT/OT segmentation  (claimed 1, evidence D)
   4.5  Merrow Energy    offline backups restored in test  (claimed 1, evidence D)
   3.0  Merrow Water     IT/OT segmentation  (claimed 2, evidence D)
   3.0  Merrow Energy    vendor access brokered and recorded  (claimed 2, evidence D)

Interpretation. Claimed coverage ranges from 58% to 92%; verified coverage from 1% to 75%. Merrow Water's own position — 84% claimed, 39% verified — is uncomfortable for its specialist: the two highest-weight gaps are statements that offline backups are restorable and that vendor access is brokered. Port of Merrow's 1% does not mean the port has no security; it means nothing has been shown. The prioritized list is a verification plan before it is a remediation plan: every one of the eleven items rests on a statement or a document, so the first action for each is to test the claim — cheap compared with buying controls, and sometimes enough to close the gap. Merrow Energy, with mostly verified evidence, is the region's best source of practical method — an asset for the forum, not just a score.

2.9 Critiquing a common practice

Specialists are expected to challenge practices that persist by habit. Take the annual "OT penetration test" written into many contracts. It often produces a list of findings on a sample of systems in a short window, using techniques that must be throttled to avoid process disruption, and it is commonly scoped to avoid the most consequential assets. Alternatives with better evidence value include: a consequence-driven review that starts from the worst credible physical outcome and works back to the digital paths that could cause it (Idaho National Laboratory, CCE); continuous reconciliation of remote-access and change records; and testing on a representative rig rather than live plant (Chapter 6). The critique is not "never test"; it is "choose the evidence method that answers the question the board is actually asking".

2.10 Common errors and limits

• Treating a framework mapping as evidence of implementation.
• Reporting claimed coverage alone, or averaging claimed and verified into one number.
• Copying another sector's practice without checking time-to-harm and safety constraints.
• Treating the shortest baseline as the whole programme, or the longest catalogue as a to-do list.
• Assuming a regulator in one sector will accept evidence designed for another.
• Weighting practices by how many standards mention them rather than by consequence.

The limit of any baseline is that it describes defences that are common because attacks were common. It says little about rare, targeted or novel paths, which is why Chapters 4 and 5 add consequence-driven analysis.

Exercises — chapter 2

EX006 — Map one practice across frameworks. Objective: connect a practice to obligations and guidance without confusing them. Inputs: "vendor access brokered and recorded" for Merrow Water. Constraints: use only sources cited in §2.2–2.3; do not quote paywalled standard text. Steps: (1) identify the CSF 2.0 function(s) and the CAF objective it supports; (2) state whether it appears as a CISA cross-sector goal; (3) explain how IEC 62443's zones-and-conduits idea frames it; (4) state, without legal advice, whether it is a legal obligation for a water utility in your jurisdiction and how you would verify that. Expected evidence: a short mapping table and paragraph. Rubric: 3 = mappings correct at the level of function and objective, obligations kept separate from guidance, a verification route to legal advice stated; 2 = one mapping wrong; 1 = treats guidance as law; 0 = none.

EX007 — Change the evidence policy. Objective: test how a scoring policy changes the picture. Inputs: Lab 2. Constraints: change the credit for a statement from 0.0 to 0.25 and change nothing else. Steps: (1) rerun and report verified coverage for each operator; (2) say which conclusions in §2.8 survive; (3) argue for one credit policy for the forum's report. Expected evidence: outputs and 200-word argument. Rubric: 3 = numbers correct, recognition that rank order and the priority of testing statements survive, a policy argued from the use of the report; 2 = numbers right, argument weak; 1 = not run; 0 = none.

EX008 — Verification plan. Objective: turn the top gaps into tests. Inputs: the three highest-weight Merrow Water items in Lab 2's list. Constraints: tests must be safe for operating plant; name evidence that would count as V. Steps: for each item give method (test, inspection, reconciliation), owner, safe conditions, pass criterion and expected cost in staff-days. Expected evidence: table. Rubric: 3 = methods genuinely test reality (for example a timed restore of a named system to an isolated host; reconciliation of broker logs against firewall sessions over 30 days), safe conditions explicit, pass criteria measurable; 2 = one method only documentary; 1 = "review policy"; 0 = none.

EX009 — Multi-regime operator. Objective: plan evidence for overlapping regimes. Inputs: a synthetic multi-utility in the EU that supplies water and operates a small electricity distribution network, and has a payments subsidiary. Constraints: identify regimes from §2.3 that may apply, without deciding legal scope. Steps: (1) list candidate regimes and why each might apply; (2) design one internal control set with mappings; (3) identify the incident-reporting clocks that must be reconciled; (4) state what you would ask counsel. Expected evidence: one-page plan. Rubric: 3 = candidate regimes plausible, one control set with mappings, reporting clocks identified as a design problem, legal questions specific; 2 = mappings vague; 1 = presents legal conclusions as fact; 0 = none.

EX010 — Critique a practice. Objective: argue for a better evidence method. Inputs: Merrow Health's contract requires an "annual external penetration test of the clinical network". Constraints: 300 words; respect patient safety. Steps: (1) state the question the board wants answered; (2) say what the annual test does and does not answer; (3) propose an alternative evidence portfolio; (4) state its limits. Expected evidence: memo. Rubric: 3 = question explicit, limits of point-in-time testing identified (sample, window, throttling, excluded devices), alternatives matched to the question, honest limits; 2 = critique without alternative; 1 = rejects testing outright; 0 = none.

Chapter synthesis

Current practice is the overlap of obligation, guidance and demonstrated peer practice, and each carries different weight. Know the outcome frameworks, the prioritized baselines, the control catalogues and the industrial standards, and know which regimes oblige your organization and what evidence each expects. Do not copy practice across sectors without checking time-to-harm, physics, regulation and workforce. Grade evidence as verified, documented or statement, report the gap honestly, weight practices by consequence, and turn the largest gaps into verification before remediation. Challenge habitual practices by asking which question their evidence answers.

Continue studying — chapter 02 of 12

← Chapter 01 · Course chapter index · Chapter 03 →

Continue to the next authored lesson.