Contents
The Western Electricity Coordinating Council recorded 181 physical security incidents across the Western Interconnection in 2025, down roughly 20 percent from 220 the year before. Over the same period, CISA's operations center received more than 30,000 cybersecurity incident reports. Numbers that move in opposite directions are a good argument for assessing both categories in one process rather than two.
What Is Critical Infrastructure Risk Assessment?
Critical infrastructure risk assessment is the structured evaluation of assets whose disruption would cause significant harm to public safety, economic activity, or national security. The output ranks risks so that limited budget goes to the assets and scenarios that matter most.
United States policy designates 16 critical infrastructure sectors, including energy, water and wastewater, communications, transportation, healthcare, financial services, chemical, and critical manufacturing. National Security Memorandum 22, issued in April 2024, reaffirmed those sectors, named CISA as National Coordinator for infrastructure security and resilience, and directed work to identify systemically important entities whose failure would produce cascading national effects.
Three variables drive most assessment models: threat, meaning the likelihood that something acts against the asset; vulnerability, meaning the probability that the attempt succeeds; and consequence, meaning what happens if it does. Dropping consequence produces a list of vulnerabilities with no sense of which ones matter.
What Is the Main Role of an Infrastructure Risk Assessment?
Allocation is the main role. Every operator has more identified weaknesses than funded remediation, and an assessment establishes which ones get addressed this year.
Assessments also expose dependencies. A substation, a pumping station, and a data center each rely on the others in ways that only become visible when someone maps them. Liferaft's analysis of the intensifying threat environment around data centers and AI companies covers one sector where that interdependence has drawn new attention from both activists and state actors.
Regulatory defensibility is the third role. Operators under NERC CIP, TSA security directives, the EU's NIS2 and CER directives, or sector equivalents need documented evidence that risk was evaluated and decisions were reasoned, which is what auditors and investigators ask for after an incident.
How To Properly Assess Critical Infrastructure
Define Scope and Criticality
List assets and rank them by the consequence of losing each one, measured in people affected, duration of outage, downstream dependencies, and recovery time. Criticality ranking sets the depth of assessment each asset receives.
Identify Threats and Hazards
Cover the full set: sabotage and physical attack, insider threat, cyber intrusion against IT and operational technology, drones, theft of copper and equipment, natural hazards, and supply chain failure. Threat identification works better with current intelligence than with a static list, since targeting patterns shift. Monitoring open sources for site names, project names, and activist or extremist discussion of a facility gives early indication, which is what threat monitoring and alerting is built to deliver at scale.
Assess Vulnerabilities
Examine perimeter and detection capability, response time from the nearest armed or contracted response, network segmentation between corporate IT and control systems, remote access paths, and single points of failure in equipment with long replacement lead times. Published information counts here as well. Permit filings, vendor case studies, job postings, and contractor documents routinely reveal layout and system details, and exposed credentials tied to operator domains surface in breach data that deep and dark web search can surface.
Estimate Consequence and Interdependencies
Model what a loss produces beyond the fence: customers without service, facilities that lose their own inputs, and the time to restore under realistic conditions rather than ideal ones. Cascading effects usually dominate the risk calculation for infrastructure assets.
Prioritize and Treat Risk
Score each scenario, then choose treatment: mitigation through hardening, detection, or redundancy; transfer through insurance or contract; or documented acceptance with a review date. Documented acceptance belongs in the record as explicitly as spending does.
Monitor and Reassess
Set triggers for reassessment, including a new threat pattern in the sector, a significant site change, a near miss, or a regulatory update. Mapping activity against facility locations in a situational awareness view keeps the external picture current between formal cycles, and reviewing incidents through risk trends and analysis across quarters shows which sites and signal types recur.
Commonly Found Issues and Challenges When Assessing Infrastructure Risk
Separate cyber and physical assessments create the most persistent gap. An intruder who gains physical access to a control room bypasses network controls, and a compromised remote access path can open a gate. Scoring them in different processes hides the combined scenario.
Static assessments age badly. A document refreshed every three years reflects a threat picture that has moved, which is why continuous external monitoring supplements rather than replaces the periodic cycle.
Third-party dependency complicates the picture. Operators rely on vendors for maintenance, remote diagnostics, and integration, and few assessments extend to the vendor's own security posture despite the access those vendors hold.
Legacy operational technology limits options. Control systems with decades of service life often cannot be patched, segmented easily, or taken offline for testing, so compensating controls carry more weight.
Information sensitivity cuts both ways. Detailed assessments create documents that would help an attacker, which means handling and distribution controls belong in the assessment process itself.
First Steps For Improving Critical Infrastructure Assessment
Start by building an asset inventory ranked by consequence, since most programs discover gaps in the inventory before they find gaps in protection.
Run one combined cyber and physical tabletop against the highest-consequence asset. A single scenario exercised jointly surfaces coordination failures faster than a document review.
Add external monitoring anchored to site names, locations, and project terms, so the threat section of the assessment reflects current activity rather than last cycle's assumptions. Liferaft, a Securitas company, supports that layer with continuous collection across social platforms, forums, alternative networks, and deep and dark web sources, mapped against facility locations and documented in case management for audit and review.
Set the reassessment triggers in writing, assign an owner to each high-priority finding, and schedule the first review before the assessment is filed. Operators evaluating how continuous monitoring fits an existing program can book a discovery call.
FAQs
What specific sectors should prioritize Critical Infrastructure Risk Assessment?
All 16 designated sectors carry obligations, though exposure differs. Energy, water and wastewater, and communications sit highest because other sectors depend on them and because they operate thousands of remote, lightly staffed sites. Healthcare and transportation follow, given direct public safety consequences. Financial services and information technology concentrate on cyber and continuity. Chemical facilities fall under separate regulatory regimes tied to hazardous materials. Data centers have become a focus of their own as power demand and public attention around them grow.
What laws and regulations govern Critical Infrastructure Risk Assessment?
In the United States, National Security Memorandum 22 sets federal policy and designates sector risk management agencies, while sector rules carry the enforceable requirements: NERC CIP standards for the bulk electric system, including CIP-014 for physical security of critical transmission facilities, TSA security directives for pipelines and rail, and Coast Guard requirements for maritime facilities. The Cyber Incident Reporting for Critical Infrastructure Act adds federal reporting duties for covered entities. In the European Union, the NIS2 Directive covers cybersecurity and the Critical Entities Resilience Directive covers physical resilience. NIST frameworks, including the Cybersecurity Framework and SP 800-30 for risk assessment, are widely used as the method underneath those obligations.
Is there a certification for professionals in Critical Infrastructure Risk Assessment?
No single credential covers the whole discipline. Physical security assessors commonly hold the ASIS Physical Security Professional or Certified Protection Professional designations. Practitioners working on control systems often pursue the GIAC Global Industrial Cyber Security Professional certification or certificates aligned to the ISA/IEC 62443 standards. Business continuity professionals hold DRI or BCI credentials. Sector programs add their own training requirements, and many operators combine two or three of these across an assessment team rather than relying on one person.
What are the consequences of failing a Critical Infrastructure Risk Assessment?
Regulatory penalties come first in regulated sectors. Violations of NERC CIP standards carry financial penalties assessed per violation per day, and settlements have reached eight figures for utilities with systemic compliance failures. Beyond fines, consequences include mandatory remediation plans and heightened audit scrutiny, higher insurance premiums or coverage restrictions, contractual exposure with customers who depend on the service, and litigation following an incident where a known, documented, unaddressed finding becomes evidence. Operational consequences usually outweigh the regulatory ones, since the finding that goes unaddressed is often the one that produces the outage.