What is critical infrastructure? How the Five Eyes countries define and protect it

Critical infrastructure is the physical and digital systems a country can't function without. Power grids, water treatment plants, telecommunications networks, hospitals, financial systems, transport- if it goes down and people are immediately affected, it's probably critical infrastructure.

That sounds simple enough, but there is no single global definition. Every country draws the line differently, and those differences matter if you operate across borders or need to understand which regulations apply to your assets.

In 2023, researchers at the German Council on Foreign Relations examined how 193 UN member states and Taiwan classified critical infrastructure. Energy, ICT and transport appeared in over 90% of national definitions. Food and water were much further down the list. And while nearly all countries in Europe and North America had published formal sector definitions, much of Asia, Latin America and Oceania had not.

How the Five Eyes countries define critical infrastructure

The Five Eyes nations- Australia, Canada, New Zealand, the United Kingdom and the United States- are among the most mature in how they classify and regulate critical infrastructure. In 2024, the group published Adapting to Evolving Threats, a joint report on how each country approaches critical infrastructure security and resilience through the Critical 5 (C5) forum.

Since that report, every member state has moved. Here is where each one stands in 2026.

Australia: 11 sectors under the SOCI Act

Australia's primary legislation is the Security of Critical Infrastructure Act 2018 (SOCI Act), amended several times since its introduction. The Act covers 11 sectors: communications, data storage and processing, financial services and markets, water and sewerage, energy, healthcare and medical, higher education and research, food and grocery, transport, space technology, and defence industry.

Operators of critical infrastructure assets must register those assets with the government, report cyber incidents within 12 or 72 hours depending on severity, and maintain a Critical Infrastructure Risk Management Program (CIRMP) with annual board sign-off.

The SOCI Act is currently under independent review. The final report, published in early 2026, recommended expanding the regime's scope and strengthening enforcement powers; changes the government is expected to legislate as "SOCI 2.0" in the coming months. Australia's 2023 Critical Infrastructure Resilience Strategy continues to guide the broader policy direction out to 2028. For organisations in the energy sector, the Australian Energy Sector Cyber Security Framework (AESCSF) adds an additional layer of maturity assessment on top of SOCI obligations.

United States: 16 sectors under CISA

The US has the most granular sector classification of any Five Eyes country, with 16 critical infrastructure sectors managed through the Cybersecurity and Infrastructure Security Agency (CISA). Many of these sectors align with the NIST Cybersecurity Framework, which has become a de facto global standard for critical infrastructure risk management.

The framework traces back to Homeland Security Presidential Directive 7 after 9/11 and was most recently updated by National Security Memorandum NSM-22 in April 2024, which established minimum security and resilience requirements and formalised the role of Sector Risk Management Agencies. CISA has faced significant budget and workforce reductions under the current administration's FY2026 and FY2027 proposals, though the 16-sector classification itself remains unchanged.

United Kingdom: 13 CNI sectors

The UK identifies 13 Critical National Infrastructure (CNI) sectors: chemicals, civil nuclear, communications, defence, emergency services, energy, finance, food, government, health, space, transport, and water. Space and Defence were added in 2015.

The big recent change is the Cyber Security and Resilience Bill, which passed the House of Commons in June 2026 and is now before the Lords. It expands the scope of the existing NIS Regulations, brings managed service providers into scope, introduces new incident reporting obligations, and gives regulators stronger enforcement powers. The UK government has also committed to establishing CNI resilience standards by 2030.

Canada: 10 sectors, new cybersecurity law

Canada's critical infrastructure spans 10 sectors: energy and utilities, finance, food, transportation, government, ICT, health, water, safety, and manufacturing. The big shift came in 2026 when Bill C-8 received Royal Assent, enacting the Critical Cyber Systems Protection Act. This was a reintroduction of the earlier Bill C-26, which died when Parliament was prorogued in January 2025. The new law creates mandatory cybersecurity obligations for federally regulated critical infrastructure operators, including incident reporting and compliance directives.

New Zealand: expanding the framework

New Zealand has historically defined critical infrastructure more loosely than its Five Eyes partners, with a "lifeline utilities" framework covering energy, water, transport and telecommunications under the Civil Defence Emergency Management Act. The government is now moving toward a broader approach.

The Cyber Security Strategy 2026–2030 was published earlier this year, and a public consultation on a mandatory cyber security regime for critical infrastructure ran in early 2026. The Public Works (Critical Infrastructure) Amendment Bill is also progressing through Parliament. The direction is clear: New Zealand is headed toward a regulated model closer to what Australia and Canada now have.

How the Five Eyes critical infrastructure sectors compare

The table below maps each country's designated sectors side by side. Some differences are structural (the US separates dams and nuclear into standalone sectors; others fold them into energy or water) and some reflect genuine policy choices about what counts as critical.

Energy, water, transport and communications are universal across all five countries. Beyond that, the picture fragments quickly. The US and Canada both separate information technology from communications as a standalone sector; everyone else treats them as one. Australia is the only country that designates higher education and data storage as critical infrastructure.

The US is the only one with standalone sectors for dams and commercial facilities. Canada labels its emergency services equivalent as the "Safety" sector, which also covers hazardous materials and search and rescue. New Zealand, still operating under its lifeline utilities model, formally covers only four sectors, though that will almost certainly expand as its new legislation takes shape.

What has changed since the original Five Eyes report?

A lot has moved in the 18 months since the C5 published Adapting to Evolving Threats. Canada went from having no cybersecurity legislation to passing Bill C-8 into law. The UK's Cyber Security and Resilience Bill cleared the Commons and is now before the Lords.

Australia's SOCI Act review recommended sweeping expansions that are expected to become "SOCI 2.0." New Zealand published a national cyber strategy and opened consultation on a mandatory regime. Even the US, which already had the most detailed framework, updated its policy posture through NSM-22, though CISA is simultaneously dealing with proposed budget and staffing cuts.

The overall trend is the same everywhere: more sectors being brought into scope, more obligations becoming mandatory, and less appetite for self-regulation.

How Overcyte helps critical infrastructure operators

If you're an operator trying to navigate these overlapping frameworks, Overcyte is built for exactly this problem. The platform supports continuous compliance across the SOCI Act, AESCSF, NIST CSF, Essential Eight, and UK NIS, so you can assess, track and report against the frameworks that apply to your organisation without running parallel processes for each one.

Book a demo to see how it works for your sector.