Critical National Infrastructure: Definitions and Lead Government Departments

Introduction

The UK government's definition of CNI is: 'Those critical elements of infrastructure (namely assets, facilities, systems, networks or processes and the essential workers that operate and facilitate them), the loss or compromise of which could result in:

a) Major detrimental impact on the availability, integrity or delivery of essential services - including those services whose integrity, if compromised, could result in significant loss of life or casualties - taking into account significant economic or social impacts; and/or

b) Significant impact on national security, national defence, or the functioning of the state.'

The UK Government Resilience Action Plan states that resilience of the UK’s CNI is of central importance to ensuring that the essential services the public rely on continue to operate. Given the fundamental and connected nature of these services, failure has the potential to cause cascading and catastrophic consequences. This could be, for example, power outages impacting other essential functions, like transport or water provision, or a failure in the telecoms or data infrastructure sectors impacting the energy sector - across all four nations.

There are 13 sectors in which CNI operate. Each sector is overseen by a relevant Lead Government Department (LGD) (Annex A) that is responsible for sectoral policy, guidance and engagement with industry.

Most sectors are broad and encompass hundreds or thousands of assets. The criticalities process allows government to categorise these assets, identifying those which are most essential and the loss of which would have the biggest impact. Those which meet certain criteria are designated as critical national infrastructure. LGDs, working with industry, are responsible for categorising the criticality of assets via the criticalities process and recording the resulting data.

Getting this process and data accurate is critical to ensure we are protecting the most critical assets to the UK appropriately.

The 13 CNI sectors

Chemicals

The chemical sector is a diverse manufacturing sector of which the primary activity is the conversion of raw materials into essential products for other sectors and consumers.

The sector routinely stores, uses and manufactures hazardous chemicals such as fertilizers, pesticides, and explosive pre-cursors in accordance with extensive regulatory requirements.

Civil Nuclear

The civil nuclear sector is involved in the generation of electricity through nuclear reaction. It involves the construction, operation, and decommissioning of nuclear power plants.

Nuclear powered electricity generation is expected to increase significantly in the UK as we move away from fossil fuel-generated electricity. As the sector grows, including the building of Small Modular Reactors (SMRs), the civil nuclear sector will become an increasingly important CNI sector requiring robust protective security.

Communications

The communications sector consists of four sub sectors:

• Telecommunications – wired, wireless and satellite communications infrastructure such as that which supports internet connectivity and mobile phone network coverage.
• Data centres – used to store and process much of the data generated in the UK, ranging from that belonging to individuals to data and processing which underpins other CNI sectors.
• Broadcast – the infrastructure underpinning television and radio transmission, including that used for emergency broadcasts.
• Postal services – includes postal, courier and delivery services.

Defence

The defence sector comprises the Ministry of Defence - Department of State, National Armaments Director Group, Military Strategic Headquarters and Defence Nuclear Enterprise; the three Services – Royal Navy, Army and Royal Air Force; Cyber and Specialist Operations Command; 24 agencies and public bodies and an extensive and complex supply chain across both the public and private sectors.

Emergency Services

The emergency services sector in the UK is comprised of four sub-sectors; police, fire and rescue, ambulance and coastguard. CNI with the sector is limited to large and/or strategically significant or specialised assets.

Energy (Electricity, Gas, Oil)

The energy sector consists of electricity, oil and gas subsectors and covers the generation, storage and transmission of energy both on and off-shore. Energy provision is essential at an industrial/commercial and domestic level, making it a key interdependency across all other CNI sectors. The need to boost the UK’s energy independence brings with it a requirement to increase the security and resilience of our domestic infrastructure.

Finance

The finance sector comprises the systemic 'backbone' of financial services (payment systems, clearing and settlement systems, exchanges and messaging systems) and financial institutions. It provides the infrastructure which underpins the processes on which government, businesses and individuals rely for their financial transactions.

Food

Whilst the provision of food is essential, the food sector has no individual assets which are designated at CNI. The sector has a significant level of resilience in the event of a crisis owing to global sourcing of food, supply chain alternatives, and commercial competition providing incentives for operators throughout the sector to step in if difficulties arise.

Government

Government provides a range of essential services through its nationwide infrastructure. The sector encompasses every aspect of government (excluding defence) including: the four Parliaments, government departments, elected officials and the democratic processes - such as elections - by which they are elected.

Health

The health sector is diverse and complex, ranging from individual GP practices to large hospitals. CNI with the sector is limited to large and/or strategically significant or specialised assets.

Space

The space sector is typically made up of two key components: ground infrastructure and orbital infrastructure. The ground infrastructure includes the systems, people and supporting functions which enable the delivery of space services. The orbital infrastructure consists of the satellites which either deliver services in their own right or provide the data for others to deliver services.

Transport

The transport sector consists of four sub-sectors; road, rail, aviation and maritime. Whilst the sectors are broad, CNI within these sectors is limited to significant assets such as major ports, airports and train stations, and strategically important management systems/assets such as air traffic control.

Water

The water sector encompasses drinking water and wastewater treatment plants and the associated supply and waste networks. The sector is responsible for the provision of drinking water to the general public, commencing with the extraction of raw water, through to treatment, storage and distribution to the consumers.

The sector is also responsible for the whole process of the safe and environmentally sound disposal of sewage. This commences at the collection of sewage from properties through the foul drainage system, on to the sewage treatment works and then to disposal.

The Criticalities Process 

There are 5 steps to the criticalities process:

Step 1: Map essential functions - Understanding what is important

Step 2: Determine systems - Mapping the systems that provide the function

Step 3: Assess sector impacts - Understanding the impact of system compromise

Step 4: Identify supporting systems, organisations and relationships - Mapping the systems in more detail

Step 5: Assess cross-sector impacts - Understanding the impact on other sectors

This process gives risk owners in government (i.e. each sector’s LGD) a common approach to collect and structure data on the CNI they are responsible for. The process supports the systematic identification of the essential functions, the systems that provide them (and their interdependencies), and the organisations that operate those systems. This information is tied to the impacts that a system’s failure would have (both within and across sectors).