The Western Electricity Coordinating Council recorded 181 physical security incidents across the Western Interconnection in 2025, down roughly 20 percent from 220 the year before. Over the same period, CISA's operations center received more than 30,000 cybersecurity incident reports. Numbers that move in opposite directions are a good argument for assessing both categories in one process rather than two.
Critical infrastructure risk assessment is the structured evaluation of assets whose disruption would cause significant harm to public safety, economic activity, or national security. The output ranks risks so that limited budget goes to the assets and scenarios that matter most.
United States policy designates 16 critical infrastructure sectors, including energy, water and wastewater, communications, transportation, healthcare, financial services, chemical, and critical manufacturing. National Security Memorandum 22, issued in April 2024, reaffirmed those sectors, named CISA as National Coordinator for infrastructure security and resilience, and directed work to identify systemically important entities whose failure would produce cascading national effects.
Three variables drive most assessment models: threat, meaning the likelihood that something acts against the asset; vulnerability, meaning the probability that the attempt succeeds; and consequence, meaning what happens if it does. Dropping consequence produces a list of vulnerabilities with no sense of which ones matter.
Allocation is the main role. Every operator has more identified weaknesses than funded remediation, and an assessment establishes which ones get addressed this year.
Assessments also expose dependencies. A substation, a pumping station, and a data center each rely on the others in ways that only become visible when someone maps them. Liferaft's analysis of the intensifying threat environment around data centers and AI companies covers one sector where that interdependence has drawn new attention from both activists and state actors.
Regulatory defensibility is the third role. Operators under NERC CIP, TSA security directives, the EU's NIS2 and CER directives, or sector equivalents need documented evidence that risk was evaluated and decisions were reasoned, which is what auditors and investigators ask for after an incident.
Separate cyber and physical assessments create the most persistent gap. An intruder who gains physical access to a control room bypasses network controls, and a compromised remote access path can open a gate. Scoring them in different processes hides the combined scenario.
Static assessments age badly. A document refreshed every three years reflects a threat picture that has moved, which is why continuous external monitoring supplements rather than replaces the periodic cycle.
Third-party dependency complicates the picture. Operators rely on vendors for maintenance, remote diagnostics, and integration, and few assessments extend to the vendor's own security posture despite the access those vendors hold.
Legacy operational technology limits options. Control systems with decades of service life often cannot be patched, segmented easily, or taken offline for testing, so compensating controls carry more weight.
Information sensitivity cuts both ways. Detailed assessments create documents that would help an attacker, which means handling and distribution controls belong in the assessment process itself.
Start by building an asset inventory ranked by consequence, since most programs discover gaps in the inventory before they find gaps in protection.
Run one combined cyber and physical tabletop against the highest-consequence asset. A single scenario exercised jointly surfaces coordination failures faster than a document review.
Add external monitoring anchored to site names, locations, and project terms, so the threat section of the assessment reflects current activity rather than last cycle's assumptions. Liferaft, a Securitas company, supports that layer with continuous collection across social platforms, forums, alternative networks, and deep and dark web sources, mapped against facility locations and documented in case management for audit and review.
Set the reassessment triggers in writing, assign an owner to each high-priority finding, and schedule the first review before the assessment is filed. Operators evaluating how continuous monitoring fits an existing program can book a discovery call.
All 16 designated sectors carry obligations, though exposure differs. Energy, water and wastewater, and communications sit highest because other sectors depend on them and because they operate thousands of remote, lightly staffed sites. Healthcare and transportation follow, given direct public safety consequences. Financial services and information technology concentrate on cyber and continuity. Chemical facilities fall under separate regulatory regimes tied to hazardous materials. Data centers have become a focus of their own as power demand and public attention around them grow.
In the United States, National Security Memorandum 22 sets federal policy and designates sector risk management agencies, while sector rules carry the enforceable requirements: NERC CIP standards for the bulk electric system, including CIP-014 for physical security of critical transmission facilities, TSA security directives for pipelines and rail, and Coast Guard requirements for maritime facilities. The Cyber Incident Reporting for Critical Infrastructure Act adds federal reporting duties for covered entities. In the European Union, the NIS2 Directive covers cybersecurity and the Critical Entities Resilience Directive covers physical resilience. NIST frameworks, including the Cybersecurity Framework and SP 800-30 for risk assessment, are widely used as the method underneath those obligations.
No single credential covers the whole discipline. Physical security assessors commonly hold the ASIS Physical Security Professional or Certified Protection Professional designations. Practitioners working on control systems often pursue the GIAC Global Industrial Cyber Security Professional certification or certificates aligned to the ISA/IEC 62443 standards. Business continuity professionals hold DRI or BCI credentials. Sector programs add their own training requirements, and many operators combine two or three of these across an assessment team rather than relying on one person.
Regulatory penalties come first in regulated sectors. Violations of NERC CIP standards carry financial penalties assessed per violation per day, and settlements have reached eight figures for utilities with systemic compliance failures. Beyond fines, consequences include mandatory remediation plans and heightened audit scrutiny, higher insurance premiums or coverage restrictions, contractual exposure with customers who depend on the service, and litigation following an incident where a known, documented, unaddressed finding becomes evidence. Operational consequences usually outweigh the regulatory ones, since the finding that goes unaddressed is often the one that produces the outage.