Critical Infrastructure Protection (CIP): Mandates and Frameworks

Critical infrastructure protection laws in the United States are a mix of sector-specific mandates, a new cross-sector cyber incident reporting requirement, and voluntary frameworks that fill the gaps. The federal government has designated 16 sectors as critical infrastructure, and the rules that apply to any given organization depend almost entirely on which sector it operates in. The electric grid faces the most prescriptive requirements; pipelines, rail, aviation, and larger water systems have their own mandates; and everyone else navigates a combination of voluntary standards and the coming reporting rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).

The 16 Designated Sectors

The list was set under Presidential Policy Directive 21 in 2013 and reaffirmed by National Security Memorandum 22 in April 2024.1Cybersecurity and Infrastructure Security Agency. A Plan to Protect Critical Infrastructure from 21st Century Threats The Cybersecurity and Infrastructure Security Agency (CISA) describes a disruption to any of them as carrying “potentially debilitating national security, economic, and public health or safety consequences.”2Cybersecurity and Infrastructure Security Agency. Critical Infrastructure Security and Resilience

  • Chemical
  • Commercial Facilities
  • Communications
  • Critical Manufacturing
  • Dams
  • Defense Industrial Base
  • Emergency Services
  • Energy
  • Financial Services
  • Food and Agriculture
  • Government Facilities
  • Healthcare and Public Health
  • Information Technology
  • Nuclear Reactors, Materials, and Waste
  • Transportation Systems
  • Water and Wastewater Systems

Who Regulates Whom

CISA, part of the Department of Homeland Security, is the national coordinator for critical infrastructure security and resilience.3Homeland Security. Critical Infrastructure Outreach Each of the 16 sectors also has a designated Sector Risk Management Agency (SRMA), the term NSM-22 uses in place of the older “Sector-Specific Agency.”1Cybersecurity and Infrastructure Security Agency. A Plan to Protect Critical Infrastructure from 21st Century Threats The Department of Energy handles the energy sector, the Department of Defense covers the defense industrial base, and the Department of the Treasury oversees financial services.4The White House. Presidential Policy Directive – Critical Infrastructure Security and Resilience DHS is the SRMA for the largest number of sectors, including communications, information technology, and commercial facilities.

NSM-22 directs each SRMA to identify and prioritize risks within its sector and produce a sector-specific risk management plan.1Cybersecurity and Infrastructure Security Agency. A Plan to Protect Critical Infrastructure from 21st Century Threats That is a step away from the older, more voluntary partnership model.

NERC CIP: The Mandatory Regime for the Bulk Electric System

The energy sector has the most prescriptive mandatory security requirements of any sector. The North American Electric Reliability Corporation (NERC) writes and enforces Critical Infrastructure Protection standards that apply to entities operating the Bulk Electric System. The Federal Energy Regulatory Commission (FERC) approves them, which makes them legally binding.5Federal Register. Order No. 919 – Virtualization Reliability Standards

The standards cover categorizing cyber assets by their potential impact on the grid, physical and electronic access controls, personnel training, and incident response planning.6North American Electric Reliability Corporation. CIP – Critical Infrastructure Protection Civil penalties can reach approximately $1.6 million per violation per day for 2026, an inflation-adjusted figure that started at a $1 million cap set by Congress.7North American Electric Reliability Corporation. Penalty Inflation Adjustment Notice – December 2025 FERC continues to approve revisions as technology changes. In 2026 it approved 11 updated CIP standards addressing virtualization technologies through Order No. 919.5Federal Register. Order No. 919 – Virtualization Reliability Standards

Pipeline, Rail, and Aviation Security Directives

After the 2021 Colonial Pipeline ransomware attack, the Transportation Security Administration (TSA) began issuing binding security directives on pipeline owners and operators. Covered operators must develop a TSA-approved Cybersecurity Implementation Plan, keep a Cybersecurity Incident Response Plan that is tested through exercises at least annually, and submit annual Cybersecurity Assessment Plans to TSA for review.8Transportation Security Administration. Security Directive Pipeline-2021-02F TSA has since extended similar requirements to rail and aviation.

Water and Wastewater Systems

Community water systems serving more than 3,300 people must complete Risk and Resilience Assessments (RRAs) and Emergency Response Plans (ERPs) under the Safe Drinking Water Act, as amended by America’s Water Infrastructure Act (AWIA). Both documents must explicitly address the security of the system’s electronic and automated systems, and both must be recertified to the EPA every five years. For systems serving between 3,301 and 49,999 people, the RRA recertification deadline is June 30, 2026, and the ERP is due by December 31, 2026.9U.S. Environmental Protection Agency. AWIA Section 2013/SDWA Section 1433 – Risk and Resilience Assessments

CIRCIA: Cyber Incident Reporting Across All 16 Sectors

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) is the first mandate that reaches across every sector. It directs CISA to require covered entities to report significant cyber incidents within 72 hours and any ransom payments within 24 hours.10Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

The final rule defining exactly which organizations qualify as “covered entities,” along with the specific reporting procedures, was expected to be published in May 2026. Until it takes effect, no organization is legally required to report under CIRCIA.10Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) The expected scope covers hospitals, financial institutions above certain thresholds, IT service providers supporting federal systems or election infrastructure, energy and utility providers, communications companies, and state and local government entities serving larger populations. Organizations meeting Small Business Administration size standards are expected to be exempt.

If you expect to fall within scope, the workflow to classify and report an incident within 72 hours is the thing to build now. Assembling that process during an active breach is where most organizations stumble.

Voluntary Frameworks Where No Mandate Applies

Plenty of critical infrastructure operators sit outside any of the mandates above. Two voluntary frameworks guide their programs.

NIST Cybersecurity Framework 2.0

The NIST Cybersecurity Framework is the most widely adopted voluntary framework for managing cybersecurity risk. Version 2.0, released in 2024, added a sixth core function called Govern to the original five (Identify, Protect, Detect, Respond, and Recover). Govern covers organizational leadership accountability, cybersecurity strategy, supply chain risk management, and policy oversight.11National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0 The CSF does not prescribe specific technical controls; it provides a taxonomy of outcomes organizations use to assess and prioritize their efforts based on their own risk profile. For detailed technical guidance, NIST also publishes the Special Publication 800 series covering access management, encryption, incident response, and related topics.12National Institute of Standards and Technology. NIST Special Publication 800-series General Information

CISA Cross-Sector Cybersecurity Performance Goals

CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs), now aligned with NIST CSF 2.0, are a prioritized baseline designed for small and medium-sized organizations that need a starting point.13Cybersecurity and Infrastructure Security Agency. Cross-Sector Cybersecurity Performance Goals The CPGs focus on a smaller set of high-impact actions and consider aggregate national risk, not just risk to the individual organization.

SAFETY Act Liability Protections

The DHS SAFETY Act (Support Anti-Terrorism by Fostering Effective Technologies Act) offers liability protections to organizations that deploy qualifying anti-terrorism technologies. It has two levels: Designation and Certification.14Department of Homeland Security SAFETY Act. Benefits To Your Company

A technology with Designation gets several protections. The seller’s liability is capped at the amount of insurance DHS requires them to carry, lawsuits can only be brought in federal court, punitive damages and prejudgment interest are barred, and any recovery is reduced by amounts from other compensation sources.15eCFR. 6 CFR Part 25 – Regulations to Support Anti-Terrorism by Fostering Effective Technologies Certification adds the ability to assert the Government Contractor Defense, which offers broader legal shielding.14Department of Homeland Security SAFETY Act. Benefits To Your Company

A detail worth knowing: the SAFETY Act creates a single cause of action that can only be brought against the seller of the approved technology. Buyers, downstream users, the seller’s suppliers, and its contractors are all shielded from suit.15eCFR. 6 CFR Part 25 – Regulations to Support Anti-Terrorism by Fostering Effective Technologies For operators choosing among security products, a SAFETY Act-designated technology can meaningfully lower legal exposure.

Where to Start

Identify your sector on the list of 16 and confirm your SRMA. If you operate the Bulk Electric System, NERC CIP applies and the penalty exposure is real. If you run a covered pipeline, rail, or aviation operation, TSA’s directives set your baseline. If you run a community water system above 3,300 people, your next AWIA recertification deadlines are already on the calendar. Every operator, regardless of sector, should be watching for the CIRCIA final rule and preparing an internal process that can generate a compliant report within 72 hours. Organizations without a sector mandate can build a defensible program on NIST CSF 2.0, with the CISA CPGs as a prioritized starting set.