Most private and public sector organizations need electric power, communications, water, food and transportation to operate normally. These and other essential assets are included in the term "critical infrastructure" and are necessary for your organization to function. The loss of one or more of these critical infrastructure assets could make it difficult or impossible for your organization to operate normally.
While most critical infrastructure resources are privately owned and operated, the federal government, as well as the states and local government agencies, have instituted numerous programs to protect these resources and established lines of communication for better coordination of protective measures. One of the most recent of these is Presidential Policy Directive 21 (PPD-21), Critical Infrastructure Protection and Resilience, which advocates greater integration and cooperation among public and private infrastructure organizations and better communications and information exchange among those providers. This is important for private-sector organizations, as it will help ensure they have lines of communication into infrastructure providers in the event of a national or regional emergency that threatens critical infrastructures.
It's important to be able to identify which critical infrastructure resources are essential to your organization, how to ensure that you are fully informed about the critical infrastructure assets your organization needs, and how to ensure that alternative resources are available to you in an emergency.
Critical infrastructure sectors include the following:
- Electric power generation, transmission and distribution
- Gas production, transport and distribution
- Oil and oil products production, transport and distribution
- Chemical production, transport and distribution
- Telecommunications, including wired and wireless services
- Water sources (drinking water, waste water/sewage, surface water control)
- Agriculture, food production and distribution
- Heating (e.g., natural gas, fuel oil)
- Public health (e.g., hospitals, ambulances)
- Transportation systems (e.g., railways, highways, airports, bridges, waterways)
- Financial services (e.g., banks, credit unions, clearinghouses)
- Security and emergency services (e.g., police, military, firefighters)
- Nuclear reactors and associated systems
- National defense firms
- Information technology (e.g., cybersecurity)
Action #1 -- Identify the critical infrastructure assets that your organization depends on for normal operation. Most will probably be obvious: electric power, telecommunications, information technology, food and water, financial services and transportation. But take another look at the list above; you may identify some additional critical infrastructure elements that you hadn't previously considered.
Action #2 -- Next, if you have business continuity and disaster recovery (BC/DR) plans, examine them to see how you can incorporate critical infrastructure resources. Let's examine a few examples:
- Electric power: Contact your primary power company and learn what they are doing to ensure that power is not interrupted; also find out who to contact when the power goes out (other than the number on electric bills); also investigate backup power supply options, such as uninterruptible power systems (UPS), diesel/natural gas generators and power protection equipment (e.g., surge suppressors, line conditioners); and examine alternate sources such as solar power.
- Telecommunications: Contact your primary network service provider (and any other carriers you use) and learn what they are doing to ensure that service is not interrupted and what they offer for alternate routing of services; consider using more than one service provider, especially for Internet access.
- Water: Investigate options for alternate water sources, such as bottled water, and maintain a supply of bottled water on site for emergencies.
- Transportation: Analyze primary and alternate highways and look for alternate routes from your office to various locations; identify various transportation firms in the area, such as bus lines and limousine services.
- Financial resources: Work with more than one bank for the firm's banking services; consider using more than one investment banking firm.
- Healthcare facilities: Identify local hospitals, same-day surgery centers, laboratories and other healthcare facilities.
- Information technology: Identify primary and alternate suppliers of equipment and software; enhance information security provisions to prevent unauthorized access into your IT infrastructure.
Action #3 -- After you've identified the critical infrastructure elements that impact your organization, examine legislation, regulations and other standards and policies issued by government agencies and private organizations to identify resources you can contact to ensure you have the latest guidance on how to protect the critical infrastructure assets and resources you need.
Action #4 -- Contact local government and law enforcement agencies to learn what services they offer and resources they are using to protect critical infrastructure in their jurisdictions. You may be able to incorporate contact information for these organizations in your BC/DR plans.
While protection of critical infrastructure resources may not be your organization's specific responsibility, ensuring that those resources are available to your organization is your responsibility. Learn as much as you can about these important national, state and local assets and which ones are important to your organization; identify strategies to ensure they remain available; and build critical infrastructure asset protection into your BC/DR plans.
Service capabilities to influence mobile network infrastructure
Amazon Web Services infrastructure resources
Network infrastructure resources