critical information infrastructure
Information systems whose compromise endangers national security.
How the laws define this
Every statutory framework recognizes critical information infrastructure as information systems, networks, or digital assets whose disruption, compromise, or destruction would cause serious harm to national security, public safety, or economic stability, thereby requiring prioritized protective measures. Jurisdictions diverge on whether scope is established through explicit sector listings or broader impact criteria. The Cyber Security Act, 2023, the Cybersecurity Law of the People's Republic of China, and “Kiberxavfsizlik to‘g‘risida”gi O‘zbekiston Respublikasi Qonuni explicitly enumerate target sectors such as finance, healthcare, energy, or state management, with China’s statute further mandating operational obligations like personnel vetting and data localization. Conversely, instruments such as the Cybersecurity Act, 2020 (Act 1038) and the National Cyber Security Policy 2021 rely on general impact thresholds without listing specific sectors in their text. Furthermore, “Kiberxavfsizlik to‘g‘risida”gi O‘zbekiston Respublikasi Qonuni uniquely highlights data centers alongside systems and networks.
Synthesised from the 8 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| China | Cybersecurity Law of the People's Republic of China | In Force (Amended) | Specifies key sectors like public communications, energy, transport, water conservancy, finance, public services and e-government, and imposes enhanced protection, assessment, personnel vetting and data localization requirements. |
| Ghana | Cybersecurity Act, 2020 (Act 1038) | In Force | Limits to computer systems or networks vital to the Republic with debilitating impact on national security, economy, or public health, without listing specific sectors. |
| Uzbekistan | Law of the Republic of Uzbekistan "On Cybersecurity" | In Force | Narrowly limits to information systems, networks, and data centers used in state management, defense, healthcare, and finance. |
| Kazakhstan | Concept of Digital Transformation, ICT Industry Development and Cybersecurity for 2023–2029 | In Force | Includes information systems and networks threatening public order or economic stability beyond just national security, as part of a non-binding policy for prioritized protection and oversight. |
| Pakistan | National Cyber Security Policy 2021 | In Force | Explicitly includes designated government and private-sector systems supporting essential services and national functions, under a non-binding policy. |
| Bangladesh | Digital Security Act, 2018 | Repealed | Applies to repealed Digital Security Act of 2018, providing for formal designation, protection measures, and penalties for damage or interference. |
| Slovakia | National Cybersecurity Strategy 2021–2025 | Superseded | From superseded strategy, emphasizes essential systems for vital national functions and public safety with priority protection and resilience measures. |
| Bangladesh | Cyber Security Act, 2023 | Repealed | Applies to repealed Cyber Security Act of 2023, referencing specified sectors like energy, communications, finance, health and utilities, with agency designation and resilience obligations. |
What it triggers
- In China, designated CIIs are subject to enhanced protection, assessment, personnel vetting and data localization requirements.source
- In Ghana, the Cyber Security Authority mandates cybersecurity standards for critical information infrastructure owners and service providers.source
- Pakistan's National Cyber Security Policy 2021 sets out baseline cybersecurity standards for public and private entities operating critical information infrastructure.source
- Under Bangladesh's Cyber Security Act, 2023, which is repealed, the Agency could designate CII and impose resilience obligations on operators.source
Definitions (8)
Information systems and networks whose compromise, failure or unauthorized use could threaten national security, public order or economic stability; these systems are identified for prioritized protection and regulatory oversight.
Information systems, networks and related assets that are essential for maintaining vital national functions and public safety; their disruption would have serious consequences for national security, public order or economic stability, and therefore they receive priority protection and resilience measures under the Strategy.
Defined as computer systems, networks, or information systems whose incapacitation, destruction or unauthorized interference would have a serious impact on national security, the economy, public health, or public safety; the Act provides for formal designation, protection measures, and penalties for damage or interference with such infrastructure.
CII denotes systems, networks, services and assets in specified sectors (such as energy, communications, finance, health and utilities) whose disruption, incapacitation or destruction would severely affect national functions, public safety or economic stability. The Act identifies CII by reference to sectoral criteria and empowers the Agency to designate and impose resilience obligations on operators of such infrastructure.
Information infrastructure in key sectors (e.g., public communications, energy, transport, water conservancy, finance, public services and e-government) whose incapacitation or destruction would seriously harm national security, the national economy, public interests or societal welfare; designated CIIs are subject to enhanced protection, assessment, personnel vetting and data localization requirements.
Systems and assets that support essential services and national functions whose disruption or compromise would have a significant impact on national security, public health, safety, or economic stability. CII includes designated government and private-sector systems identified for prioritized protection under the policy.
Computer systems or networks so vital to the Republic that their incapacity or destruction would have a debilitating impact on national security, the economy, or public health.
Information systems, networks, and data centers used in state management, defense, healthcare, and finance whose disruption would cause serious national harm.
Not to be confused with
CNII refers specifically to government-identified infrastructure essential to national continuity, while critical information infrastructure more broadly covers systems whose compromise endangers national security across various definitions.
NCII denotes systems or assets whose disruption would have significant national impact, similar to CII but potentially narrower in scope depending on the jurisdiction.
Questions and answers
What sectors are covered under China's definition of critical information infrastructure?
China specifies key sectors including public communications, energy, transport, water conservancy, finance, public services and e-government.
Does critical information infrastructure include private sector systems?
Yes, Pakistan explicitly includes designated private-sector systems alongside government ones.
What obligations apply to CII operators in Ghana?
Ghana mandates cybersecurity standards for CII owners and service providers enforced by the Cyber Security Authority.
Related Terms
critical information infrastructure (CII)
Systems whose disruption would critically harm national functions....
CNII (Critical National Information Infrastructure)
Government-identified infrastructure essential to national continuity....
National Critical Information Infrastructure (NCII)
Systems/assets whose disruption would have significant national impact....
Critical Infrastructure Facility
Vital assets whose incapacitation would severely impact national security, economy, public health, or safety....
Critical Infrastructure
Assets necessary for vital societal functions....