USA

The United States has had an extensive critical infrastructure protection program since 1996. Its 2001 Patriot Act defined critical infrastructure as those "systems and assets, whether physical or virtual, so vital to the United States that the incapacitation or destruction of such systems and assets would have a debilitating impact on national security, economic security, national public health or safety, or any combination of those matters."

In 2014, the NIST Cybersecurity Framework was published, and it quickly became a popular set of guidelines, despite the significant costs involved in full compliance.[10]​.

The National Infrastructure Protection Plan (NIPP) defines the critical infrastructure sector in the United States. Presidential Policy Directive 21 (PPD-21),[11]​ issued in February 2013, titled Security and Resilience of Critical Infrastructure, mandated an update to the NIPP. This plan revision established the following 16 critical infrastructure sectors:.

The 2013 version of the NIPP has faced criticism for lacking viable risk measures.[12]​ [13]​.

At the state level, several US states have passed critical infrastructure bills, promoted by the American Legislative Exchange Council (ALEC), to criminalize protests against the fossil fuel industry.[14] In May 2017, Oklahoma passed a law that created felony penalties for trespassing on land considered critical infrastructure, including oil and gas pipelines, or conspiring to do so; ALEC introduced a version of the bill as a model law and encouraged other states to adopt it.[15]​ In June 2020, West Virginia passed the Critical Infrastructure Protection Act, which created severe penalties for protests against oil and gas facilities.[16]​.

United Kingdom

In the UK, the National Protective Security Authority (NPSA) provides information, personnel and physical security advice to businesses and organizations that make up the national infrastructure, helping to reduce their vulnerability to terrorism and other threats.

The NPSA may draw on resources from other government departments and agencies, including MI5, the National Cyber ​​Security Center and other government departments responsible for national infrastructure sectors.

Singapore

In Singapore, critical infrastructure is required by the Protected Areas and Places Act 2013.[17]​ In addition, Parliament passed the Infrastructure Protection Act in 2017, which provides for the protection of certain areas, places and other facilities in Singapore from security risks.[18]​.

European Union

The European Program for the Protection of Critical Infrastructures refers to the doctrine or specific programs created following the directive EU COM(2006) 786 of the European Commission that designates European critical infrastructures that, in the event of a failure, incident or attack, could impact both the country where they are hosted and at least one other European Member State. Member States are obliged to adopt this directive into their national laws.

The Program has proposed a list of European critical infrastructures based on contributions from its Member States. Each designated European Critical Infrastructure must have an Operator Security Plan that covers the identification of important assets, a risk analysis based on the main threat and vulnerability scenarios of each asset, and the identification, selection and prioritization of countermeasures and procedures.

USA

The United States has had an extensive critical infrastructure protection program since 1996. Its 2001 Patriot Act defined critical infrastructure as those "systems and assets, whether physical or virtual, so vital to the United States that the incapacitation or destruction of such systems and assets would have a debilitating impact on national security, economic security, national public health or safety, or any combination of those matters."

In 2014, the NIST Cybersecurity Framework was published, and it quickly became a popular set of guidelines, despite the significant costs involved in full compliance.[10]​.

The National Infrastructure Protection Plan (NIPP) defines the critical infrastructure sector in the United States. Presidential Policy Directive 21 (PPD-21),[11]​ issued in February 2013, titled Security and Resilience of Critical Infrastructure, mandated an update to the NIPP. This plan revision established the following 16 critical infrastructure sectors:.

The 2013 version of the NIPP has faced criticism for lacking viable risk measures.[12]​ [13]​.

At the state level, several US states have passed critical infrastructure bills, promoted by the American Legislative Exchange Council (ALEC), to criminalize protests against the fossil fuel industry.[14] In May 2017, Oklahoma passed a law that created felony penalties for trespassing on land considered critical infrastructure, including oil and gas pipelines, or conspiring to do so; ALEC introduced a version of the bill as a model law and encouraged other states to adopt it.[15]​ In June 2020, West Virginia passed the Critical Infrastructure Protection Act, which created severe penalties for protests against oil and gas facilities.[16]​.

United Kingdom

In the UK, the National Protective Security Authority (NPSA) provides information, personnel and physical security advice to businesses and organizations that make up the national infrastructure, helping to reduce their vulnerability to terrorism and other threats.

The NPSA may draw on resources from other government departments and agencies, including MI5, the National Cyber ​​Security Center and other government departments responsible for national infrastructure sectors.

Singapore

In Singapore, critical infrastructure is required by the Protected Areas and Places Act 2013.[17]​ In addition, Parliament passed the Infrastructure Protection Act in 2017, which provides for the protection of certain areas, places and other facilities in Singapore from security risks.[18]​.

European Union

The European Program for the Protection of Critical Infrastructures refers to the doctrine or specific programs created following the directive EU COM(2006) 786 of the European Commission that designates European critical infrastructures that, in the event of a failure, incident or attack, could impact both the country where they are hosted and at least one other European Member State. Member States are obliged to adopt this directive into their national laws.

The Program has proposed a list of European critical infrastructures based on contributions from its Member States. Each designated European Critical Infrastructure must have an Operator Security Plan that covers the identification of important assets, a risk analysis based on the main threat and vulnerability scenarios of each asset, and the identification, selection and prioritization of countermeasures and procedures.