Critical Infrastructure: Systems, Risks and Continuity

Understand what critical infrastructure is, how it differs from mission-critical systems, and how engineering addresses systems, risks, redundancy, continuity, resilience, commissioning, and governance.

Check it out!

Critical infrastructure is the set of facilities, services, assets, and systems whose interruption, degradation, or destruction can cause significant consequences for society, an organization, or an essential operation. In engineering, the concept requires first identifying the function that cannot fail and, from there, mapping dependencies on power, telecommunications, automation, security, environmental conditions, fire protection, digital systems, people, operations, and maintenance.

In Brazil, the National Policy for Critical Infrastructure Security — PNSIC — has its own definition and institutional scope. It considers critical those facilities, services, assets, and systems whose interruption or destruction causes serious social, environmental, economic, political, international, or State and societal security impacts. In corporate environments, the expression is also used for mission-critical facilities and systems, but this engineering usage does not automatically mean that the asset is formally classified as national critical infrastructure.

What Is Critical Infrastructure

The concept begins with the consequence of unavailability. An asset is technically critical when its loss prevents, degrades, or puts at risk a function that must continue operating within previously defined limits.

This function may be broad, such as power distribution, telecommunications, or water supply, or localized, such as the electrical system supporting an operations center, the SCADA controlling an industrial plant, or the IT infrastructure maintaining an institution’s essential applications.

Brazil’s National Policy for Critical Infrastructure Security operates at the country’s strategic level. An organization’s engineering function, in turn, must translate the same consequence-based logic into technical architecture and requirements for availability, protection, and recovery.

National Critical Infrastructure and Mission-Critical Facilities Are Not Synonyms

It is important to distinguish two scales.

The first is critical infrastructure in the PNSIC sense, linked to the continuity of essential services and to social, economic, environmental, political, or security impacts. Brazil’s Institutional Security Office — GSI — lists communications, energy, transportation, finance, water resources, and defense among the critical infrastructure sectors.

The second is engineering criticality within an organization. A hospital may have power, medical gas, IT, and HVAC systems whose failure compromises healthcare functions. An industrial facility may have a substation, an OT network, and a control system supporting a continuous process. A Data Center relies on power, cooling, and telecommunications whose unavailability compromises digital services.

These systems are mission-critical to the operation, even though the legal or institutional classification of the facility depends on its own criteria.

Criticality Starts with the Function, Not the Equipment

Before selecting equipment or redundancy levels, define the essential function, the consequence of its loss, and the minimum capacity that must remain available. This is the basis for a defensible architecture.

Structure governance with Owner’s Engineering

Purchasing UPS systems, generators, redundant switches, or high-availability servers before defining the functional requirement reverses the engineering logic.

The correct sequence is:

identify the essential function or service;
determine the consequences of unavailability;
establish the maximum tolerable interruption time and minimum operating conditions;
map the processes, assets, and resources that support the function;
identify threats and failure modes;
design barriers, redundancies, and recovery strategies;
test whether the architecture actually delivers the expected performance.

This approach makes it possible to distinguish what requires 2N, N+1, geographic redundancy, degraded operation, or only planned maintenance.

Criticality, Risk, Availability, and Resilience

These concepts are related, but they are not equivalent.

Criticality represents the importance of an asset or function in view of the consequences of its failure. Risk combines uncertainty, probability or frequency, and consequence within the adopted method. Availability measures an item’s ability to remain capable of performing its function when required. Resilience adds the ability to absorb disruptions, adapt, and recover operations.

An infrastructure may have high historical availability and low resilience to rare events. If all redundancies depend on the same shaft, the same electrical room, or the same provider, a common cause can eliminate multiple layers simultaneously.

Operational Continuity Is an Engineering Requirement

Continuity should not be restricted to a corporate plan. For a service to remain available during a failure, the design must materialize physical and logical resources capable of sustaining the operation.

ISO 22301 structures requirements for a business continuity management system. In engineering, this translates into concrete questions:

what minimum capacity must remain available;
for how long;
which resources are indispensable;
which failures can be tolerated;
which manual operations are possible;
how much recovery time is available;
which scenarios require transfer to another facility or system.

The answers guide architecture, redundancy, inventory, spare parts, contracts, procedures, and testing.

Critical Infrastructure Is Multidisciplinary

Real failures rarely respect discipline boundaries. A power outage can interrupt telecommunications; loss of telecom can prevent supervision; HVAC failure can bring down IT; a fire can simultaneously remove power and control; unauthorized physical access can compromise digital systems.

Therefore, a multidisciplinary engineering project should treat interfaces as an explicit part of the scope.

The most common disciplines include:

electrical power;
telecommunications and networks;
automation and control;
IT and digital systems;
HVAC and environmental conditions;
physical security;
fire protection;
lightning protection, grounding, and surge protection;
architecture and structure;
process utilities;
operations, maintenance, and asset management.

Dependencies of a critical infrastructure function

Critical Power Architecture

Critical power must be designed as a complete chain of sources, transfer, protection, distribution, autonomy, and monitoring. Duplicating equipment does not automatically eliminate single points of failure.

Design critical power systems

Power is one of the most common dependencies. The architecture must consider sources, transformation, distribution, protection, autonomy, transfer, and failure modes.

Depending on criticality, it may include:

two independent power feeds;
redundant transformers;
generators;
UPS systems and battery banks;
A/B distribution;
segregated busways;
ATS or transfer systems;
coordinated protection;
electrical monitoring;
fuel and logistics for extended autonomy.

The Critical Infrastructure Power solution must be assessed in every mode: normal, emergency, maintenance, and failure. An arrangement that works only in normal operation is not a continuity architecture.

N, N+1, 2N, and A/B Redundancy Require Interpretation

Redundancy notations help describe capacity and paths, but they do not replace failure analysis.

In an N+1 architecture, additional capacity exists to withstand the loss of one component, provided the remaining shared elements are not single points of failure. In 2N, two independent chains can each fully support the load, but independence must also exist in routes, controls, and auxiliary resources.

Duplicating equipment without separating common causes creates apparent redundancy.

A Single Point of Failure Is an Architectural Question

A single point of failure is any component, path, control decision, or resource whose loss eliminates the critical function.

It may exist in obvious places, such as a single UPS, or in less visible interfaces:

a single transfer panel;
a single control cable;
a single management VLAN;
a single fiber shaft;
a single room housing equipment from both chains;
a single authentication system;
a single pump common to redundant chillers;
a single telecom contract with physically shared routes;
a single specialist capable of restoring the configuration.

The architecture review must follow the chain end to end.

Common-Cause Failures Can Defeat All Redundancy

Fire, flooding, human error, failed updates, software failure, a short circuit on a common bus, loss of a technical room, or configuration error are examples of events capable of affecting several redundant components.

Engineering should seek diversity and segregation where justified. This may mean different physical routes, different technologies, separate failure domains, or independent procedures.

Telecommunications Are Continuity Infrastructure

Critical operations depend on internal and external connectivity. The design must assess the LAN, backbone, WAN links, carriers, fiber routes, radio systems, operational communications, and remote access.

Two links contracted from different carriers may share ducts, poles, handholes, or backbone infrastructure. Contractual diversity does not guarantee physical diversity.

The analysis should verify:

site entrances;
external routes;
internal pathways;
edge equipment;
equipment power supply;
redundancy protocols;
synchronization;
out-of-band management;
communications during contingencies.

Automation and Control Sustain Critical Processes

In energy, water and wastewater, industry, oil and gas, transportation, and large buildings, PLCs, RTUs, DCS, SCADA, and supervisory systems may be essential to maintaining safe operation.

Industrial automation must consider availability and security from the architectural stage. Duplicating SCADA servers is not enough if controllers, networks, power supplies, synchronization, or field communications remain single.

Local and degraded modes must also be planned. When central supervision is lost, which functions continue autonomously? Which operations can be performed locally? Which protections are independent of the supervisory layer?

Cybersecurity Is Part of Resilience

Physical and digital infrastructures are increasingly integrated. Unavailability may be caused by hardware failure, operational error, or a cyberattack.

The NIST Cybersecurity Framework 2.0 organizes practices for governance, identification, protection, detection, response, and recovery. For engineering, this means the architecture must incorporate access controls, segmentation, inventory, backups, vulnerability management, event logging, and recovery capability.

In OT environments, security cannot compromise determinism, functional safety, or availability. The solution must suit the process lifecycle and constraints.

Physical Security Protects Continuity

Perimeters, access control, CCTV, intrusion detection, zones, barriers, and procedures reduce the risks of sabotage, theft, unauthorized access, and unauthorized intervention.

The protection level should follow criticality. A remote substation, a Data Center, a control room, and an ordinary warehouse do not require the same security design.

In highly sensitive technology environments, a secure room can add a layer of physical and environmental protection, but it remains dependent on the external systems that sustain its operation.

Fire Is a Common-Cause Event

Fire can simultaneously remove power, telecommunications, automation, structural capacity, and access. The design must address prevention, detection, compartmentation, suppression, egress routes, emergency control, and recovery.

Indirect effects must also be assessed: smoke, firefighting water, shutdowns, unavailability of adjacent areas, and restricted access after the event.

The protection strategy must be coordinated with continuity. Shutting down the entire facility may be safe for people and still create a significant operational loss; the design needs to define which loads must be removed and which must continue under safe conditions.

Lightning Protection, Surges, and Electromagnetic Compatibility

Lightning and surges can interrupt critical systems without causing obvious structural damage. External protection, equipotential bonding, SPDs, grounding, and interface coordination should be treated as an integrated system.

The content on critical systems under NBR 5419:2026 examines the relationship between internal-system failures and continuity of services in greater depth.

In environments with automation, telecommunications, and sensitive electronics, engineering must also consider signal paths and external metallic networks.

HVAC and Environmental Conditions

Data Centers, control rooms, laboratories, and certain industrial facilities depend on temperature, humidity, air quality, pressure, or other environmental conditions.

An HVAC failure may not stop the process immediately, but it starts a countdown to loss of function. Therefore, thermal inertia and the available response time must be known.

Cooling redundancy must consider electrical sources, pumps, towers, valves, controls, and water. Two end units may depend on the same auxiliary system.

Water and Process Utilities

Potable water, process water, compressed air, gases, steam, fuel, and other utilities can be critical resources. Each sector has its own dependencies.

In water and wastewater, for example, pumps, power, automation, chemicals, and telecommunications form a chain. In hospitals, power, medical gases, water, HVAC, and IT support healthcare functions. In industry, utilities may be a prerequisite for keeping the process in a safe state.

The architecture must map these relationships and autonomy limits.

People Are Also Part of the Infrastructure

A facility may have technical redundancy and still depend on a single person to operate, diagnose, or restore the system.

Continuity engineering should provide for:

clear procedures;
training;
minimum competencies per shift;
secure access to documentation;
escalation contacts;
manufacturer support;
vacation and absence coverage;
contingency simulations.

Excessive dependence on tacit knowledge is an organizational single point of failure.

Documentation Is Operational Infrastructure

Diagrams, cable lists, configurations, addressing, cause-and-effect matrices, logic documents, procedures, and As-Built records make it possible to understand the facility’s actual state.

Without reliable documentation, every intervention increases uncertainty. During a failure, diagnosis takes longer and decisions must be made with incomplete information.

Critical infrastructure documentation should be treated as a controlled asset, with revisions, history, and access available during contingencies.

Configuration Management Reduces Change Risk

Many outages do not originate in spontaneous failures, but in changes. New equipment, firmware updates, protection-setting adjustments, load increases, network changes, or maintenance may remove redundancy without the organization realizing it.

Configuration management should maintain the relationship between physical state, logical state, and documentation. Before any relevant change, impact, dependencies, the test plan, and rollback capability must be analyzed.

Maintenance Must Preserve Availability

Preventive maintenance can cause unavailability if the architecture cannot support component removal. Concurrent maintainability should be defined as a requirement when the function must continue even during planned intervention.

This requires assessing:

remaining capacity;
safe isolation;
accessibility;
transfer sequences;
human-error risk;
contingency resources;
return to normal state.

Operational reliability depends on both design and maintenance quality.

Reliability and Availability Must Be Measured

Indicators such as MTBF, MTTR, and availability help explain performance, but they should not be used in isolation.

The article on MTBF, MTTR, and availability shows how failure frequency and recovery time affect asset performance.

For critical infrastructure, other relevant indicators include:

number of unavailability events;
duration of interruptions;
transfer failures;
incidents during maintenance;
critical alarms;
actual autonomy;
time to detect;
time to respond;
success of contingency tests.

RTO, RPO, and Minimum Service Capacity

In IT, RTO and RPO are important references, but physical engineering must connect them to real dependencies.

RTO indicates how much time is available to restore a given function. RPO is associated with the acceptable amount of data loss. Infrastructure must also define the minimum acceptable capacity during a contingency.

An operation may not need 100% capacity during an emergency. If 40% is sufficient to maintain essential services, the contingency architecture may differ from the normal architecture.

Criticality Analysis Must Produce Priorities

Not every asset can receive the same level of investment. Classification should combine consequences for safety, production, the environment, revenue, reputation, compliance, and continuity.

A criticality matrix can organize assets into classes, but the method must be coherent with the organization. The result should guide:

maintenance strategy;
spare parts;
redundancy;
inspections;
monitoring;
inventory;
response time;
CAPEX priority.

Risk Analysis Must Consider Failure Scenarios

ISO 31000 provides principles for risk management, but engineering must detail concrete events.

Useful scenarios include:

utility power loss;
generator failure;
UPS failure;
fire in a technical room;
fiber break;
carrier outage;
PLC or controller failure;
supervisory server loss;
flooding;
unauthorized access;
maintenance error;
software failure common to redundant equipment;
loss of staff or inability to access the site.

Each scenario should identify the effect, barriers, detection, response, and recovery.

Critical infrastructure risk and resilience analysis flow

FMEA, FMECA, and Failure Analysis

Methods such as FMEA and FMECA help break down failure modes, effects, criticality, and controls. They are useful for identifying vulnerabilities in complex chains.

However, the analysis should not end in a spreadsheet. Relevant failure modes must change design, maintenance, testing, or operating decisions.

If an FMEA identifies a common valve that takes down two redundant lines and the design remains unchanged, the analysis has not fulfilled its purpose.

Engineering Studies That Support the Architecture

Critical infrastructure may require specialized studies depending on the discipline:

load flow;
short-circuit and selectivity studies;
incident energy;
battery autonomy;
generator response;
power quality;
thermal analysis;
telecommunications coverage and capacity;
fire risk analysis;
lightning-protection risk analysis;
network and system capacity;
reliability and RAM studies;
OT cyber-risk analysis.

These studies transform assumptions into engineering evidence.

Brownfield Projects Increase Complexity

Modernizing existing critical infrastructure is different from designing a new system. The facility must remain in operation while components are replaced, routes are changed, and legacy interfaces remain active.

The Brownfield approach requires field surveys, configuration control, tie-in planning, outage windows, and rigorous documentation.

The main risk is not only the final solution, but the transition between the current and future states.

Cutover and Rollback Must Be Engineered

Transferring a critical load, migrating a network, replacing a main switchboard, or changing a supervisory system requires a formal cutover sequence.

The plan should define:

preconditions;
responsible parties;
initial state;
intervention steps;
verification points;
abort criteria;
rollback;
post-change testing;
documentation updates.

Rollback is not an improvisation after something fails. It must be technically feasible and prepared before the intervention.

Procurement Must Assess Compatibility and Lifecycle

Equipment for critical infrastructure cannot be selected only by price or nominal specification.

The technical assessment should consider:

performance;
interfaces;
capacity;
spare-parts availability;
support;
lifecycle;
licensing;
updates;
security;
interoperability;
integrator experience;
replacement lead time;
documentation;
testing and warranties.

Technical Bid Evaluation helps separate technical equivalence from commercial comparison.

Vendor Lock-In Can Become an Operational Risk

Vendor dependence may be acceptable when controlled, but it must be understood. Proprietary protocols, licenses, exclusive parts, closed tools, and support contracts can limit recovery capability.

Lifecycle analysis should ask what happens if the supplier discontinues the product, increases lead times, or stops serving the region.

Interoperability and documentation reduce risk, especially in systems with long service lives.

Commissioning Must Prove Resilience

Resilience must be demonstrated through testing. FAT, SAT, commissioning, and integrated scenarios transform design assumptions into performance evidence before acceptance.

Structure commissioning for critical systems

Commissioning is not merely turning equipment on. In critical infrastructure, it must demonstrate that systems and interfaces respond correctly to operating, failure, maintenance, and emergency scenarios.

Critical systems commissioning should test sequences, transfers, alarms, redundancies, and recovery.

The central question is: does the system do what the design said it would do when something stops working?

Engineering lifecycle for critical infrastructure

FAT and SAT Reduce Risk Before Operation

FAT verifies equipment and functions in a controlled environment before delivery. SAT confirms behavior after installation. Both require procedures, inputs, expected results, evidence, and deviation handling.

Not every test can be performed at the factory. Real integrations, routes, networks, power, environmental conditions, and field interfaces require on-site validation.

Integrated Testing Reveals Interface Failures

The greatest risks emerge at discipline boundaries. A power-loss scenario may require generator start, load transfer, cooling continuity, network preservation, alarms, communications, and team response.

Testing each system independently does not demonstrate the integrated response.

Integrated Systems Testing scenarios should be selected based on criticality and relevant failure modes, always with proper safety and planning.

Assisted Operation Closes the Transition

After energization and commissioning, the operations team still needs to absorb the new configuration. Assisted operation makes it possible to observe real behavior, adjust alarms, correct documentation, train teams, and close outstanding items.

The period is especially useful in complex modernization projects where the facility enters service in stages.

Data Book and Handover Are Part of Performance

An infrastructure is not fully delivered simply because it works. The client must receive the information required to operate, maintain, test, and recover the system.

The handover should consolidate:

As-Built documentation;
design narratives and reports;
diagrams;
equipment lists;
configurations;
backups;
certificates;
test reports;
closed punch items;
manuals;
maintenance plans;
training records;
warranties;
support contacts.

Incomplete documentation increases MTTR and the risk of error in future interventions.

Asset Management Sustains the Lifecycle

After delivery, criticality should guide maintenance, inspection, renewal, and inventory strategies.

Asset management connects value, risk, and performance throughout the lifecycle.

Obsolescence must be monitored. Critical infrastructure can gradually lose resilience due to lack of parts, outdated firmware, degraded batteries, or obsolete documentation.

Critical Infrastructure in Data Centers

Data Centers are a clear example of interdependence among disciplines. Servers and storage depend on power, cooling, telecommunications, security, fire protection, automation, the environment, and operations.

The article Data Center: What It Is, How It Works, and Which Systems Make Up the Infrastructure details this architecture.

The continuity requirement must be applied to the whole system, not only to the servers.

Critical Infrastructure in Hospitals

Hospitals combine essential power, medical gases, water, HVAC, IT, telecommunications, security, vertical transportation, and clinical equipment.

Criticality varies by area. Operating rooms, ICUs, laboratories, diagnostic imaging, and administrative areas have different consequences when failures occur.

Engineering must coordinate these dependencies with specific healthcare and regulatory requirements.

Critical Infrastructure in Industry

Continuous processes may suffer production, safety, or environmental losses when power, automation, instrumentation, utilities, and telecommunications fail.

The strategy includes a safe process state, control redundancy, power for essential loads, network segregation, and local operating capability.

A plant does not necessarily need to maintain 100% production during an emergency; in many cases, the priority is to bring the process to a safe condition and preserve critical equipment.

Critical Infrastructure in Power Systems and Substations

Substations depend on protection, control, auxiliary services, telecommunications, synchronization, and supervision. DC systems, batteries, and chargers are essential for relays and circuit breakers to operate even during loss of the main power supply.

Teleprotection and operational communications connect geographically distributed facilities. Loss of these systems can limit selectivity and operating capability.

Critical Infrastructure in Water and Wastewater

Intake, treatment, pumping, and distribution depend on power, automation, telecommunications, and the availability of electromechanical equipment.

Reservoirs can provide temporary autonomy, but that autonomy must be known. Without measurement, the organization does not know how much time it has to restore a pumping station.

Critical Infrastructure in Transportation

Airports, highways, railways, ports, and control centers depend on power, signaling, communications, security, automation, and IT systems.

Criticality must consider user safety, logistics continuity, and network effects. A single point of failure in a control center can affect assets distributed across a large area.

Critical Infrastructure in Government and Public Services

Digital public services, data centers, security systems, communications, and institutional facilities may support essential State functions.

In this context, continuity and security requirements need to be connected to public governance, procurement, data protection, and contingency plans.

Critical Infrastructure in Telecommunications

POPs, NOCs, mobile sites, optical networks, data centers, and power systems form a distributed infrastructure. Local autonomy, redundant routes, inventory, and remote operating capability are essential factors.

A power failure lasting only a few hours can turn into a communications outage if batteries, generators, or fuel are not sized for the actual scenario.

How to Diagnose Existing Critical Infrastructure

The assessment should combine documentation, fieldwork, interviews, historical data, and testing.

A useful sequence is:

define essential functions;
map assets and dependencies;
review diagrams and As-Built documentation;
inspect facilities;
collect failures and incidents;
analyze single points and common causes;
verify capacity and autonomy;
assess maintenance and obsolescence;
review procedures and competencies;
classify risks;
propose an action plan and CAPEX.

The output should not be merely a defect list, but a risk map for decision-making.

How to Prioritize Investments

Not every vulnerability requires immediate correction. Prioritization should consider risk, cost, time, operating windows, and the benefit of reducing exposure.

Actions can be classified as:

immediate safety corrections;
elimination of single points of failure;
restoration of degraded redundancies;
increased autonomy;
modernization of obsolete assets;
improved monitoring;
documentation and training;
long-term structural projects.

The plan should show dependencies among initiatives. Installing a second UPS before creating independent distribution may not reduce the expected risk.

CAPEX Must Be Linked to Reduced Risk

In critical infrastructure, a budget without technical rationale tends to become an equipment list.

Each relevant investment should answer:

which risk it addresses;
which failure scenario it reduces;
which availability or autonomy it improves;
which dependency it eliminates;
which new risks it introduces;
how the benefit will be verified.

This traceability improves decision-making and investment justification.

Owner’s Engineering Helps Maintain a Systemic View

Critical infrastructure projects often involve multiple manufacturers, designers, integrators, and contractors. Each supplier tends to optimize its own subsystem.

Owner’s Engineering represents the client’s requirements, coordinates interfaces, reviews solutions, supports procurement, follows implementation, and protects acceptance criteria.

This function is especially relevant when the architecture must remain coherent across multiple contracts.

Engineering Consulting Should Act Before Procurement

The greatest benefit occurs when requirements, risks, and alternatives are structured before a supplier is selected.

Consulting can support:

diagnostics;
criticality analysis;
feasibility studies;
conceptual architecture;
requirements;
basic engineering design;
specifications;
RFP and TBE;
risk analysis;
modernization plans;
commissioning;
implementation governance.

Contracting execution before finalizing the architecture transfers critical decisions to the supplier market.

How to Contract Services for Critical Infrastructure

The scope should define performance and evidence, not only equipment.

It is advisable to establish:

critical functions and areas;
availability assumptions;
interfaces;
existing documentation;
standards and regulatory requirements;
redundancy criteria;
maintenance conditions;
testing;
final documentation;
training;
warranties;
acceptance.

The contract must define who is responsible for integrating subsystems and resolving gaps between packages.

Recurring Errors in Critical Infrastructure

Some errors recur across different sectors:

calling any important asset “critical” without criteria;
duplicating equipment while retaining common causes;
defining architecture before mapping function and risk;
ignoring maintenance modes;
not knowing actual autonomy;
depending on outdated documentation;
testing equipment in isolation;
failing to plan cutover and rollback;
accepting energization as delivery;
treating cybersecurity and physical security separately;
ignoring obsolescence;
failing to measure performance after implementation.

Governance Indicators

Mature governance tracks risks and performance over time.

Possible indicators include:

availability by function;
MTTR;
critical incidents;
transfer failures;
degraded-redundancy events;
available autonomy;
maintenance backlog;
obsolete assets;
contingency tests performed;
test success rate;
up-to-date As-Built documents;
open critical vulnerabilities;
alarm response time.

An indicator should drive decisions, not generate a dashboard without action.

Periodic Architecture Review

Criticality changes with growth, new systems, regulatory changes, and digital transformation. An architecture that was adequate five years ago may have become insufficient.

A review should be triggered by events such as:

load growth;
process changes;
physical expansion;
incidents;
repeated failures;
addition of new sources;
obsolescence;
telecommunications changes;
new OT/IT integrations;
changes in continuity requirements.

Final Considerations

Critical infrastructure is not a collection of premium equipment. It is an architecture oriented toward the continuity of essential functions in the face of failures, maintenance, external events, and changes throughout the lifecycle.

Engineering begins with the consequence of unavailability, identifies dependencies, analyzes risks, and converts those requirements into power, telecommunications, automation, security, fire protection, environmental systems, digital systems, documentation, and operations. Redundancy has value only when it effectively reduces failure domains; commissioning has value only when it tests relevant scenarios; documentation has value only when it represents the actual state.

At the national level, PNSIC, ENSIC, and PLANSIC structure the security and resilience of Brazil’s critical infrastructure. At the project and organizational level, the same engineering discipline makes it possible to protect mission-critical operations without confusing technical criticality with institutional classification. The final objective is demonstrable: keep the essential function available, safe, or recoverable within the limits defined by the organization and society.

Technical references

[1] BRAZIL. Decree No. 9,573, November 22, 2018. Approves the National Policy for Critical Infrastructure Security — PNSIC. Available at: https://www.gov.br/gsi/pt-br/assuntos/seguranca-de-infraestruturas-criticas

[2] BRAZIL. Decree No. 10,569, December 9, 2020. Approves the National Strategy for Critical Infrastructure Security — ENSIC. Available at: https://www.gov.br/gsi/pt-br/colegiados-do-gsi/comite-nacional-de-seguranca-de-infraestruturas-criticas/base-legal

[3] BRAZIL. Decree No. 11,200, September 15, 2022. Approves the National Critical Infrastructure Security Plan — PLANSIC. Available at: https://www.gov.br/gsi/pt-br/colegiados-do-gsi/comite-nacional-de-seguranca-de-infraestruturas-criticas/base-legal

[4] INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO 31000:2018 — Risk management — Guidelines. Available at: https://www.iso.org/standard/65694.html

[5] INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. ISO 22301:2019 — Security and resilience — Business continuity management systems — Requirements. Available at: https://www.iso.org/standard/75106.html

[6] NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY. NIST SP 1299 — NIST Cybersecurity Framework 2.0: Resource and Overview Guide. 2024. Available at: https://csrc.nist.gov/pubs/sp/1299/final

Frequently asked questions

What is critical infrastructure?

It is a facility, service, asset, or system whose interruption or destruction produces serious consequences. In Brazil, PNSIC defines critical infrastructure by the serious social, environmental, economic, political, international, or State and societal security impact.

Is every Data Center national critical infrastructure?

No. A Data Center may be technically mission-critical to an organization, but classification as critical infrastructure under the national policy depends on the institutional context and the consequences defined by PNSIC.

What is the difference between critical infrastructure and mission-critical systems?

Critical infrastructure is a term used in public policy and engineering for high-consequence assets and services. Mission-critical describes functions and systems whose unavailability compromises an essential mission or operation. The concepts overlap, but they are not legally equivalent.

Which systems make up critical infrastructure?

Depending on the sector, they may include power, telecommunications, automation, IT, physical security, fire protection, HVAC, utilities, control systems, documentation, people, and operating processes.

Does redundancy guarantee high availability?

No. Redundant equipment can share single points of failure, routes, rooms, controls, or common causes. Availability depends on the complete architecture and on operating, maintenance, and failure modes.

How should existing critical infrastructure be assessed?

The assessment should map essential functions, assets, and dependencies; analyze documentation and field conditions; review historical failures; identify single points and common causes; verify capacity, autonomy, maintenance, obsolescence, and procedures; and produce a risk-prioritized action plan.

Why is commissioning important in critical infrastructure?

Because it verifies that equipment, systems, and interfaces respond correctly to operating, failure, and emergency scenarios. Integrated testing reveals vulnerabilities that do not appear when each subsystem is tested in isolation.

When should Owner's Engineering be contracted for critical infrastructure?

When the project involves multiple disciplines, suppliers, and interfaces and the client needs to preserve requirements, architecture, technical criteria, and acceptance throughout design, procurement, implementation, and commissioning.

Complementary technical materials