Chapter 2 — Critical infrastructure and sector security: service and stakeholder context

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["2.1 A service is a chain"]
  N2["2.2 Upstream, downstream, shared"]
  N3["2.3 Stakeholders and their roles"]
  N4["2.4 How sectors differ"]
  N5["2.6 Practical activity"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["2.1 A service is a chain"]
  N2["2.2 Upstream, downstream, shared"]
  N3["2.3 Stakeholders and their roles"]
  N4["2.4 How sectors differ"]
  N5["2.6 Practical activity"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX006"]

[Learning outcomes and connection]
    |
    v
[2.1 A service is a chain]
    |
    v
[2.2 Upstream, downstream, shared]
    |
    v
[2.3 Stakeholders and their roles]
    |
    v
[2.4 How sectors differ]
    |
    v
[2.6 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes and connection

After this chapter you should be able to:

• describe a critical service as a chain of functions and dependencies, upstream and downstream;
• build a stakeholder map that distinguishes who decides, who must be told and who can help;
• recognise how sectors differ — water, energy, healthcare, transport, finance — in what "harm" means and who regulates it;
• identify cascading effects between sectors and the coordination they require.

Chapter 1 defined the service by its consequence. This chapter draws the people and dependencies around it.

2.1 A service is a chain

Drinking water at Kestrel Water passes through a chain: abstraction from the river, treatment at KW-TW, chemical dosing, pumping and storage at KW-01 to KW-12, distribution, metering and billing. Each link depends on things the utility does not fully control: electricity from Kestrel Grid, chemicals delivered by road, telecommunications for telemetry, a monitoring service at KVROC, software and maintenance from suppliers, and people with scarce skills.

CISA's national critical functions describe this view at national level: functions such as "supply water" depend on others such as "provide electricity" and "provide internet-based content, information and communication services" (CISA, National Critical Functions Set). The coordinator's version is local and concrete: a one-page dependency map that a new manager could read in five minutes.

2.2 Upstream, downstream, shared

Three kinds of dependency matter to a coordinator:

• Upstream — what the service needs: power, chemicals, communications, suppliers, staff.
• Downstream — who needs the service and how badly: households, schools, the hospital's sterilisation unit and dialysis, fire hydrants, food businesses.
• Shared — components or people several functions rely on at once: one telecommunications carrier for all telemetry, one supplier engineer who knows every station, one shared monitoring centre.

Shared dependencies are where single events become wide outages. A coordinator's most valuable question in any meeting is often: "What else uses that?"

2.3 Stakeholders and their roles

A stakeholder is anyone who affects, or is affected by, the security of the service. For coordination, classify each by what you need from them:

Lesson table; scroll horizontally to read all columns →

One stakeholder can sit in several classes. The hospital "must be told" when water quality or pressure is at risk and is also "affected"; it may also "help" by telling you which of its systems need water most.

2.4 How sectors differ

The coordination pattern is common, but the meaning of harm and the regulatory landscape differ:

• Water: public health is the dominant consequence; operators often run small sites with few staff; manual operation is frequently possible for a while. CISA and partners have published water-specific advisories after attacks on internet-exposed controllers (CISA AA23-335A).
• Electricity: real-time balance and cascading failure across networks; outages affect every other sector. The 2015 attacks on Ukrainian distribution companies caused outages for customers and were followed by manual restoration (CISA IR-ALERT-H-16-056-01).
• Healthcare: patient safety and clinical continuity; many connected medical devices; clinical staff decide on diversion and downtime procedures.
• Transport and pipelines: safety of movement and fuel supply; business systems can force operational shutdowns even when control systems are untouched. In the 2021 DarkSide ransomware case, CISA and the FBI issued an advisory about attacks on a critical-infrastructure company's IT network (CISA AA21-131A).
• Finance: integrity of transactions and public confidence; strong existing regulation of operational resilience.

The professional lesson: when you coordinate across sectors (water with power, hospital with water), translate your consequence into theirs. "Station KW-02 offline" means nothing to the hospital; "lower pressure on the east side from 14:00 to about 18:00, water safe to drink" does.

2.5 Worked example: the hospital dependency (synthetic)

Kestrel General Hospital is supplied by the east zone, fed by stations KW-02 and KW-07. The coordinator asks four questions and records the answers:

Lesson table; scroll horizontally to read all columns →

The coordinator then marks "6 hours" as assumed, because she has not seen the plan. An assumption on which a decision depends is a task: she asks to see the relevant section. This pattern — record source and confidence for every dependency fact — runs through the book.

2.6 Practical activity

Draw a dependency map for one essential service with at least five upstream, three downstream and one shared dependency. For each, name a contact and whether you have verified the information or assumed it.

Use the hospital table as a model: for each dependency, record the answer, its source and whether you saw the evidence yourself. Any fact marked as assumed should become a task with a person to ask. Date the map and name who will review it, because suppliers, contacts and coping times change. A map with no shared dependency usually means you have not yet asked what else uses the carrier, the monitoring service or the one engineer who knows every station.

2.7 Common errors and limits

• Mapping systems instead of functions — a list of servers is not a dependency map.
• Forgetting people as dependencies (a single expert, a single on-call manager).
• Treating "must be told" stakeholders as optional until an incident.

• Dependency maps go stale; date them and set a review owner.

• Accepting a critical customer's coping time without seeing the plan it comes from, as the coordinator avoided with the hospital's six hours.

• Describing an outage in your own terms to another sector, instead of saying what it means for them, such as lower pressure from 14:00 to about 18:00 with water safe to drink.

Exercises — chapter 2

EX006 — Classify stakeholders. Objective: use the five classes. Inputs: regulator, KVROC, HydroLogic Ltd, a local school, the chief executive, Kestrel Grid's control room. Steps: classify each, allowing more than one class. Expected evidence: table with one reason per row. Rubric: 3 = defensible classes with multiple classes where justified (for example Kestrel Grid as upstream dependency, "can help" and also "must be told" if the utility's load changes); 2 = one class each; 1 = several wrong; 0 = none.

EX007 — Find the shared dependency. Objective: identify single points. Inputs: telemetry for all twelve stations uses one carrier; KVROC monitors three utilities; one HydroLogic engineer services every station. Steps: explain the consequence of losing each and the coordination question you would raise. Expected evidence: three short analyses. Rubric: 3 = recognises loss of view across all stations (carrier), shared impact across utilities and reduced monitoring (KVROC), key-person risk (engineer); raises "what else uses that" and contingency; 2 = two of three; 1 = lists only; 0 = none.

EX008 — Translate the consequence. Objective: communicate across sectors. Inputs: "KW-07 will run on manual from 10:00 for six hours because of a suspected compromise of the supplier link." Steps: rewrite for the hospital estates manager. Expected evidence: message under 80 words. Rubric: 3 = states effect on supply in the hospital's terms (pressure, safety, duration), what the hospital should do, next update time and contact; avoids technical detail and speculation; 2 = missing next update; 1 = forwards the technical sentence; 0 = none.

EX009 — Verify an assumption. Objective: manage confidence. Inputs: the "6 hours" assumption in 2.5. Steps: describe how you would verify it and what you would do if the real figure were 2 hours. Expected evidence: plan and consequence. Rubric: 3 = ask for the specific plan section or a meeting with estates, record date and source; at 2 hours, the 2-hour notification promise becomes inadequate, so revise the agreement and plan alternative supply (tankers) with the hospital; 2 = verification only; 1 = accepts assumption; 0 = none.

EX010 — Sector difference. Objective: recognise sector meaning of harm. Inputs: the same ransomware infection of business IT at (a) a water utility and (b) a fuel pipeline operator. Steps: explain why each might shut down operations even if control systems are clean, citing the relevant public advisory where appropriate. Expected evidence: two paragraphs. Rubric: 3 = explains dependence of operations on business functions (billing, scheduling, monitoring) and caution about spread, cites AA21-131A only at its published level and avoids claims beyond it; 2 = generic; 1 = assumes OT was hit; 0 = none.

Chapter synthesis

A critical service is a chain of functions with upstream, downstream and shared dependencies, and a set of stakeholders who decide, do, must be told, can help or are affected. Sectors differ in what harm means, so a coordinator translates consequences into the receiving sector's terms. Record the source and confidence of every dependency fact; an unverified assumption behind a decision is a task.