Critical Infrastructure
What is Critical Infrastructure?
Systems, assets, and networks (whether physical or virtual) so vital to a nation that their incapacitation or destruction would have a debilitating impact on security, economic stability, public health, or safety.
Terms that appear alongside critical infrastructure
Each of these is named in at least one of the same controls as critical infrastructure. The number is how many controls name both.
- cybersecurity 34 shared controls
- gdpr 15 shared controls
- incident reporting 15 shared controls
- incident response 15 shared controls
- nist 14 shared controls
- audit 12 shared controls
- cisa 12 shared controls
- compliance 11 shared controls
Frameworks that govern critical infrastructure
What the standards actually require on critical infrastructure
Requirements naming critical infrastructure across 6 standards, quoted from the control text.
The responsible entity for one or more critical infrastructure assets to which Part 2A applies (assets specified in the rules or a s 51 declaration, after any rules grace period) must adopt and maintain a written critical infrastructure risk management program...
security-of-critical-infrastructure-act-2018-soci::s30AC · Adopt and maintain a critical infrastructure risk management program →No baseline requirement; at the Enhanced Profile and above the plan must require that the organisation's critical infrastructure role, and risk particular to its sector, are recorded in the risk management strategy and that this role is incorporated into the r...
api-1164::ID.BE-2 · ID.BE-2 Critical infrastructure and industry sector roles in the risk strategy (Enhanced and above) →Public institutions and critical infrastructures must procure the cybersecurity products, systems and services they use from cybersecurity experts, manufacturers or companies that the Presidency has authorised and certified.
turkey-cybersecurity-law-law-no-7545::7.1.c · Article 7(1)(c): public institutions and critical infrastructures buy cybersecurity products and services only from Presidency-authorised providers →Risk identification considers risks that could come from, or affect, other critical infrastructure and interdependent organisations, such as loss of utility services.
australian-energy-sector-cyber-security-framework-aescsf::RISK-2m · RISK-2m: Risks from and to critical infrastructure and interdependencies considered →The organization's place in critical infrastructure and its industry sector is identified and communicated. IDENTIFY (ID) Function, Business Environment (ID.BE) Category. Outcome in the Framework Core of Version 1.0; unchanged in Version 1.1.
nist-cybersecurity-framework-1-0::ID.BE-2 · ID.BE-2: The organization's place in critical infrastructure and its industry sector is identified and communicated →The organization's place in critical infrastructure and its industry sector is identified and communicated. IDENTIFY (ID) Function, Business Environment (ID.BE) Category. Outcome in the Framework Core of Version 1.1;
nist-cybersecurity-framework-1-1::ID.BE-2 · ID.BE-2: The organization's place in critical infrastructure and its industry sector is identified and communicated →Questions people ask about critical infrastructure
What is Critical Infrastructure?
Why is Critical Infrastructure important for compliance?
Which compliance frameworks address Critical Infrastructure?
Where can I learn more about Critical Infrastructure?
See how Critical Infrastructure applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.