Protecting a nation's critical infrastructure: the first steps

Modern societies are increasingly dependent on a set of critical products and services which comprise the critical infrastructure (CI). Relatively well-known threats as well as the new terrorist threat increase the need for critical infrastructure protection (CIP). Using a methodological approach, the Netherlands determined its CI that consists of thirty-one critical products and services in eleven critical sectors. The critical dependencies in the CI were analysed. The relative importance of a critical product or service was determined based upon its importance for other critical products and services, and upon the potential damage in case of disruption. It was found that the ICT-dependency of many sectors in the Dutch society is larger than expected. CIP also poses many organisational challenges. As private stakeholders control a major part of the CI, a stepped up national protection effort will require public-private partnerships or other governance models. This article discusses the research approach taken including lessons learned.