Critical Infrastructure
While there is not a commonly accepted definition of critical infrastructure (CI), all definitions emphasize the contributing role of a CI to the society or the debilitating effect in the case of disruption. Another common characteristic of CI is that they are complex in their structure, which makes the issue of dependencies and common cause failure an important topic to society.
Contents
- 1 Definitions
- 1.1 European Definitions
- 1.2 Other International Definitions
- 1.3 National Definitions
- 1.3.1 Australia
- 1.3.2 Austria
- 1.3.3 Belgium
- 1.3.4 Brazil
- 1.3.5 Canada
- 1.3.6 Colombia
- 1.3.7 Czech Republic
- 1.3.8 Finland
- 1.3.9 France
- 1.3.10 Germany
- 1.3.11 Jamaica
- 1.3.12 Japan
- 1.3.13 Kenya
- 1.3.14 Latvia
- 1.3.15 Luxembourg
- 1.3.16 Malta
- 1.3.17 Montenegro
- 1.3.18 Netherlands
- 1.3.19 New Zealand
- 1.3.20 Norway
- 1.3.21 Poland
- 1.3.22 Portugal
- 1.3.23 Qatar
- 1.3.24 Republic of Slovenia
- 1.3.25 Republic of Trinidad & Tobago
- 1.3.26 Russian Federation
- 1.3.27 Spain
- 1.3.28 Sweden
- 1.3.29 Switzerland
- 1.3.30 Uganda
- 1.3.31 United Kingdom (UK)
- 1.3.32 United States
- 1.4 Standard Definition
- 1.5 Other Definitions
- 2 See also
- 3 History
- 4 Notes
Definitions
European Definitions
Council Directive 2008/114/EC
Other International Definitions
ITU-T
NATO
CCD-CoE (Tallinn manual)
CEP / EAPC
UNISDR
UNISDR refers to "Critical facilities" as
Critical facilities are considered as elements of the infrastructure that support essential services in a society.
National Definitions
Australia
In this context, significant means an event or incident that puts at risk public safety and confidence, threatens our economic security, harms Australia’s international competitiveness, or impedes the continuity of government and its services.
Austria
Kritische Infrastrukturen sind jene Infrastrukturen oder Teile davon, die eine wesentliche Bedeutung für die Aufrechterhaltung wichtiger gesellschaftlicher Funktionen haben. Ihre Störung oder Zerstörung hat schwerwiegende Auswirkungen auf die Gesundheit, Sicherheit oder das wirtschaftliche und soziale Wohl der Bevölkerung oder die Funktionsweise von staatlichen Einrichtungen. [8]
Oftmals wird Kritische Infrastruktur auch mit der Abkürzung des aus dem Englischen entlehnten Substantiv CI (Critical Infrastructure) ausgedrückt. Im internationalen wie nationalen Sprachgebrauch hat sich auch CIP (Critical Infrastructure Protection) um den Schutz kritischer Infrastruktur auszudrücken, durchgesetzt. Konform dazu wird somit auch der Schutz der kritischen Informations Infrastruktur als CIIP (Critical Information Infrastructure Protection) bezeichnet.
Belgium
Infrastructure critique: installation, système ou partie de celuici, d’intérêt fédéral, qui est indispensable au maintien des fonctions vitales de la société, de la santé, de la sûreté, de la sécurité et du bien-être économique ou social des citoyens, et dont l’interruption du fonctionnement ou la destruction aurait une incidence significative du fait de la défaillance de ces fonctions. [10]
A critical infrastructure is an installation, system or part thereof, of federal interest, which is essential for the maintenance of vital societal functions, health, safety, security, economic or societal well-being of people, and which, if disrupted or destroyed, would have a significant impact. [11]
Brazil
Critical infrastructure are the installations, services or assets that if destroyed, disrupted or incapacitated will have a debilitating impact on security, the national economy, national public health and safety. [13]
Canada
Ensemble des processus, des systèmes, des installations, des technologies, des réseaux, des biens et des services nécessaires pour assurer la santé, la sûreté, la sécurité ou le bien-être économique des Canadiens ainsi que le fonctionnement efficace du gouvernement. [14]
Critical infrastructure can be stand-alone or interconnected and interdependent within and across provinces, territories and national borders. Disruptions of critical infrastructure could result in catastrophic loss of life, adverse economic effects, and significant harm to public confidence.
Colombia
Critical Infrastructure is the set of computers, computer systems, telecommunication networks, data and information, the destruction or interference may weaken or impact the safety of the economy, public health, or combination thereof, of a nation (this defines the CII).
Czech Republic
Critical Infrastructure: Systems and services whose unfunctionality or wrong functionality would result in a serious impact on state security, its economy, public administration and in the end on provision of the basic daily needs of population. [17]
Finland
Critical infrastructure comprise basic structures and services and related functions which are essential to maintain the vital operations of society. -unofficial translation- [19]
France
The French original version is:
The French government doesn’t use the notion of “criticality” but the notion of “vitality” with the meaning of essential service or infrastructure.
Germany
Kritische Infrastrukturen (KRITIS) sind Organisationen oder Einrichtungen mit wichtiger Bedeutung für das staatliche Gemeinwesen, bei deren Ausfall oder Beeinträchtigung nachhaltig wirkende Versorgungsengpässe, erhebliche Störungen der öffentlichen Sicherheit oder andere dramatische Folgen eintreten würden. [22]
A recent law about IT-security defines CI as:
(unofficial translation) Critical infrastructures (within the meaning of this law) are installations or facilities or parts thereof (1) in the Energy, ICT, Transport, Health, Water, Agriculture and Financial sectors and (2) that are key to the functioning of the society while their failure or degration result in serious service disruption or danger to the public security.
Jamaica
This may include water and sewage networks, agriculture, health systems, emergency services, information technology and telecommunications, banking and finance, energy (electrical and wind generated), transportation (air, road, port), postal and shipping entities.
Japan
Kenya
Latvia
The critical infrastructure of information technology is protected in order to ensure the performance of basic functions essential to the state and society.
Luxembourg
Malta
Montenegro
Critical infrastructure relates to property, systems, services, or part thereof, which would be an interruption of service or destruction, threaten key social functions: health, peace, security, economic and social well-being or the normal functioning of the state (equals the EU definition).
Netherlands
Critical infrastructures (Dutch: Vitale Infrastructuur) refers to products, services and the accompanying processes that, in the event of disruption or failure, could cause major social disturbance. [32]
"This could be in the form of tremendous casualties and severe economic damage, or in terms of an extremely lengthy recovery period and a lack of any readily available viable alternatives, while we depend on these products and services. Because the consequences of this critical infrastructure – or parts thereof – could be so dire for large segments of the Dutch population, extra attention must be given to its protection. Accordingly, this protection is designed to prevent disruption and concerns the protection against technical-organisational failings, overloading, and extreme natural phenomena or intentional or unintentional human action."(In Dutch: "Dat kan zijn omdat er sprake is van veel slachtoffers en grote economische schade, dan wel wanneer herstel zeer lang gaat duren en er geen reële alternatieven voorhanden zijn, terwijl deze producten en diensten niet gemist kunnen worden."
Since April 2015, The Netherlands recognises [33] two categories in criticality of critical infrastructure:
Category A: at least impact on one of the following four impact categories:
- economic impact: > 50.000 million euro costs and damages, or 5.0% decrease in real income
- physical impact: > 10.000 deaths, severely injured or chronically ill
- social-psychological impact: > 1 million persons are emotionally affected or experience serious societal survivability problems (fear, anger, disturbance)
- cascade impact: this disruption causes failure of minimal two other (critical) sectors
Category B: at least impact on one of the following three impact categories:
- economic impact: > 5.000 million euro costs and damages, or 1.0% decrease in real income
- physical impact: > 1.000 deaths, severely injured or chronically ill
- social-psychological impact: > 100.000 persons are emotionally affected or experience serious societal survivability problems
General Security and Intelligence Service (AIVD)
New Zealand
For instance, electricity generation, gas production, telecommunications, water supply etc.
Norway
Critical infrastructure is the construction and systems essential to maintain society's critical features which covers society's basic needs and population's sense of security. [36]
Society’s functional ability is highly dependent on a number of physical and technical infrastructures. In the event of a failure in these infrastructures, society will be unable to maintain the supply of goods and services on which the population depends (cf. critical societal functions). These infrastructures can be described as critical to society. [37]
Poland
Portugal
Qatar
Republic of Slovenia
(equals the EU definition)
Republic of Trinidad & Tobago
Note: this actually is a definition of CII.
Russian Federation
критически важный объект инфраструктуры Российской Федерации (далее - критически важный объект) - объект, нарушение (или прекращение) функционирования которого приводит к потере управления, разрушению инфраструктуры, необратимому негативному изменению (или разрушению) экономики страны, субъекта Российской Федерации либо административно- территориальной единицы или существенному ухудшению безопасности жизнедеятельности населения, проживающего на этих территориях, на длительный срок. [44]
Spain
Sweden
Samhällsviktig verksamhet (essential services): Med samhällsviktig verksamhet avses en verksamhet som uppfyller minst ett av följande villkor: (1) Ett bortfall av, eller en svår störning i verksamheten som ensamt eller tillsammans med motsvarande händelser i andra verksamheter på kort tid kan leda till att en allvarlig kris inträffar i samhället (2) Verksamheten är nödvändig eller mycket väsentlig för att en redan inträffad kris i samhället ska kunna hanteras så att skadeverkningarna blir så små som möjligt. [47]
Switzerland
Uganda
United Kingdom (UK)
The United Kingdom (UK) defines national infrastructure as:
In the approach of the UK, infrastructure is categorised according to its value or “criticality” and the impact of its loss. This categorisation is done using the Government “Criticality Scale”, which assigns categories for different degrees of severity of impact.
Not everything within a national infrastructure sector is “critical”. Within the sectors there are certain “critical” elements of infrastructure, the loss or compromise of which would have a major detrimental impact on the availability or integrity of essential services, leading to severe economic or social consequences or to loss of life. These “critical” assets make up the nation's critical national infrastructure (CNI) and are referred to individually as “infrastructure assets”. Infrastructure assets may be physical (e.g. sites, installations, pieces of equipment) or logical (e.g. information networks, systems).
United States
Standard Definition
ISO/IEC TR 27019:2013
The standard notes that a failure or malfunction of such organizations and facilities would result in sustained supply shortfalls, make a significant impact on public security and have other wide ranging impacts.
Other Definitions
International Risk Governance Council (IRCG)
The standard notes that a failure or malfunction of such organizations and facilities would result in sustained supply shortfalls, make a significant impact on public security and have other wide ranging impacts.
Ontario (Canada)
Infrastructure essentielle: réseaux interdépendants, interactifs et interconnectés d’institutions, de services, de systèmes et de processus qui répondent aux besoins vitaux des êtres humains, soutiennent l’économie, protègent la sécurité publique, assurent la continuité des services gouvernementaux et maintiennent la confiance du public envers le gouvernement. [54]
See also
History
European Council COM(2006)787
Notes
- Jump up ↑ Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.
- Jump up ↑ ITU Study Group Q.22/1 Report on Best Practices for a National Approach to Cybersecurity: A Management Framework for Organizing National Cybersecurity Efforts, ITU-D Secretariat, Geneva (2008).
- Jump up ↑ Tallinn Manual on the International Law Applicable to Cyber Warfare (2013)
- Jump up ↑ NATO EAPC(SCEPC) lexicon and CRITICAL TELECOMMUNICATION INFRASTRUCTURE PROTECTION - document - EAPC(CCPC)D(2002)8-REV1 (26 January 2004)
- Jump up ↑ 2009 UNISDR Terminology on Disaster Risk Reduction, United Nations International Strategy for Disaster Reduction (UNISDR), Geneva, Switzerland, May 2009.
- Jump up ↑ Critical Infrastructure Resilience Strategy, 2010
- Jump up ↑ Austrian Cyber Security Strategy, Federal Chancellery of the Republic of Austria, Vienna (2013)
- Jump up ↑ Österreichische Strategie für Cyber Sicherheit (2013)
- Jump up ↑ N. 2011 — 1799 C − 2011/00399 1 JULI 2011. — Wet betreffende de beveiliging en de bescherming van de kritieke infrastructure
- Jump up ↑ N. 2011 — 1799 [ − 2011/00399 1er JUILLET 2011. — Loi relative à la sécurité et la protection des infrastructures critiques
- Jump up ↑ Service Public Fédéral Intérieur/Federale Overheidsdienst Binnenlandse Zaken F./N. 2011-1799; C-2011/00399 (2011)
- Jump up ↑ GUIA DE REFERÊNCIA PARA A SEGURANÇA DAS INFRAESTRUTURAS CRÍTICAS DA INFORMAÇÃO Versão 01 (Nov. 2010)/ Portaria Nº 45, de 8 de setembro de 2009. Gabinete de Segurança Institucional da Presidência da República.
- Jump up ↑ [http://www.gsma.com/latinamerica/mobile-telecommunications-networks-for-the-2014- world-cup/ Emilio Tissato Nakamura, Jadir Antonio da Silva, José Manuel Martin Rios et al., ‘Mobile Telecommunications Networks for the 2014 World Cup’, GSM Association (2011)]
- Jump up ↑ [http://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/mrgnc-mngmnt-frmwrk/index-eng.aspx An Emergency Management Framework for Canada (Second Edition)
- Jump up ↑ Conpes 3510 (Resolución CRC 2258 de 2009)
- Jump up ↑ http://www.govcert.cz/download/nodeid-561 Výkladový slovník kybernetické bezpečnosti (2013)
- Jump up ↑ Act No. 181 of 23 July 2014 On Cyber Security and Change of Related Acts (Act on Cyber Security)
- Jump up ↑ Finlands' Cyber Security Strategy
- Jump up ↑ Vocabulary of Comprehensive Security. Helsinki (TSK 47) (2014)
- Jump up ↑ INSTRUCTION GENERALE INTERMINISTERIELLE RELATIVE A LA SECURITE DES ACTIVITES D’IMPORTANCE VITALE N°6600/SGDSN/PSE/PSN du 7 janvier 2014, PREMIER MINISTRE, SECRETARIAT GENERAL DE LA DEFENSE ET DE LA SECURITE NATIONALE, Direction Protection et Sécurité de l’Etat N° NOR: PRMD1400503J
- Jump up ↑ National Strategy for Critical Infrastructure Protection(CIP Strategy), BMI 17 June 2009.
- Jump up ↑ Nationale Strategie zum Schutz Kritischer Infrastrukturen (KRITIS-Strategie)), BMI 17 June 2009.
- Jump up ↑ Entwurf eines Gesetzes zur Erhöhung der Sicherheit informationstechnischer Systeme (IT-Sicherheitsgesetz), Deutsche Bundcestag Drucksache 18/4096 (June, 2015))
- Jump up ↑ Jamaica's National Cyber Security Strategy
- Jump up ↑ The Information Security Policy Council, The Second Action Plan on Information Security Measures for Critical Infrastructures, Japan (2009)
- Jump up ↑ Kenya's National Cyber Security Strategy
- Jump up ↑ CYBER SECURITY STRATEGY OF LATVIA 2014–2018
- Jump up ↑ Règlement grand-ducal du 12 mars 2012 portant application de la directive 2008/114/CE du Conseil du 8 décembre 2008
- Jump up ↑ CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) ORDER, SUBSIDIARY LEGISLATION 460.24, 8th November, 2011.
- Jump up ↑ Strategija o bezbjednosti 2013-2017 (2012)
- Jump up ↑ De Nationaal Coördinator Terrorismebestrijding (2004)
- Jump up ↑ Bijlage bij Kamerstuk 26643 nr. 75 Rapportage Bescherming Vitale Infrastructuur
- Jump up ↑ https://www.nctv.nl/actueel/nieuws/kabinet-versterkt-crisisbeheersing.aspx?cp=126&cs=59950 Voortgangsbrief nationale veiligheid 9 april 2015
- Jump up ↑ General Security and Intelligence Service
- Jump up ↑ New Zealand’s Cyber Security Strategy (2011)
- Jump up ↑ VEILEDNING Sikkerhet i kritisk infrastruktur og kritiske samfunnsfunksjoner – modell for overordnet risikostyring
- Jump up ↑ Cyber Security Strategy for Norway (2012)
- Jump up ↑ Polish Government Centre for Security (2013)
- Jump up ↑ Decreto-Lei n.º 62/2011 de 9 de Maio (2011)
- Jump up ↑ QATAR National Cyber Security Strategy (May 2014)
- Jump up ↑ الاستراتيجية الوطنية للأمن السيبراني QATAR NCSS - Arabic version (May 2014)
- Jump up ↑ [1]
- Jump up ↑ Government of the Republic of Trinidad & Tobago, National Cyber Security Strategy (December 2012)
- Jump up ↑ NATIONAL SECURITY OF RUSSIA - Information security (February 3, 2012, № 803)
- Jump up ↑ CNPIC
- Jump up ↑ Action Plan for the Protection of Vital Societal Functions & Critical Infrastructure, Swedish Civil Contingencies Agency (MSB) (2014)
- Jump up ↑ Handlingsplan för skydd av samhällsviktig verksamhet, Swedish Civil Contingencies Agency (MSB) (2014)
- Jump up ↑ National strategy for the protection of Switzerland against cyber risks (2012)
- Jump up ↑ National Information Security Policy (2011)
- Jump up ↑ Centre for the Protection of National Infrastructure (CPNI)
- Jump up ↑ §1016(e) of the United States Patriot Act of 2001 (42 U.S.C. §5195c(e))
- Jump up ↑ ISO/IEC TR 27019:2013 Information technology -- Security techniques -- Information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy utility industry.
- Jump up ↑ IRCG webpage on CI
- ↑ Jump up to: 54.0 54.1 Province of Ontario’s Emergency Management Glossary of Terms
- Jump up ↑ EC COM(2006) 787 final, Directive of the Council on the identification and designation of European Critical Infrastructure and the assessment of the need to improve their protection, EC, Brussels 12.12.2006.