CybersecurityWhite House Issues NSM-22 on Critical Infrastructure Security — April 30, 2024
National Security Memorandum-22 replaces PPD-21 and modernizes U.S. critical infrastructure risk management, information sharing, and regulatory coordination.
Verified for technical accuracy — Kodi C.
On the White House issued National Security Memorandum 22 NSM-22 on critical infrastructure security and resilience, updating and replacing Presidential Policy Directive 21 from 2013. The memorandum modernizes the federal approach to protecting critical infrastructure by emphasizing resilience, cross-sector risk management, and improved coordination between government and private sector owners and operators.
Key Changes from PPD-21
NSM-22 reflects the evolution of critical infrastructure threats and interdependencies over the past decade, incorporating lessons learned from cyberattacks, natural disasters, and the COVID-19 pandemic. The memorandum expands focus beyond protection to include resilience and recovery capabilities.
- Resilience emphasis. The memorandum elevates resilience as a core objective alongside protection, recognizing that sophisticated adversaries may penetrate defenses and that organizations must be able to operate through and recover from disruptions.
- Minimum security requirements. NSM-22 directs sector risk management agencies to work with industry to develop minimum cybersecurity requirements for critical infrastructure sectors, moving beyond voluntary frameworks where appropriate.
- Supply chain security. The memorandum addresses supply chain risks more comprehensively than its predecessor, requiring assessment of dependencies and vulnerabilities across critical infrastructure supply chains.
Sector Risk Management Agency Responsibilities
NSM-22 clarifies and expands the responsibilities of Sector Risk Management Agencies SRMAs that serve as federal leads for specific critical infrastructure sectors. These agencies must develop deeper understanding of their sectors and more actively coordinate risk management efforts.
- Sector risk assessments. SRMAs must conduct full assessments of risks to their sectors, including cyber, physical, climate, and supply chain threats, and share findings with sector teams.
- Coordination mechanisms. The memorandum strengthens requirements for SRMAs to establish effective coordination mechanisms with sector owners and operators, including information sharing agreements and joint exercises.
- Performance measurement. SRMAs must develop metrics to assess sector security and resilience, enabling evidence-based prioritization of risk management investments.
Implications for Critical Infrastructure Owners and Operators
Private sector organizations operating critical infrastructure should prepare for improved engagement with their SRMAs and potentially new regulatory requirements. The memorandum direction toward minimum security requirements signals possible mandatory cybersecurity standards for sectors currently operating under voluntary frameworks.
- Engagement preparation. Review current relationships with relevant SRMAs and prepare for deeper coordination on risk assessment, information sharing, and incident response.
- Security baseline assessment. Evaluate current security posture against existing sector frameworks to identify gaps that minimum requirements might address.
- Resilience planning. Develop or improve business continuity and resilience plans that address the memorandum emphasis on maintaining operations during and recovering from significant disruptions.
Cross-Sector Dependencies and Cascade Risks
NSM-22 specifically addresses risks arising from interdependencies between critical infrastructure sectors, such as energy dependencies of communications networks or financial system dependencies on multiple other sectors. If you are affected, assess their dependencies on other critical infrastructure and the potential for cascading failures affecting their operations.
Implementation Timeline and Future Developments
The memorandum directs various federal agencies to complete setup tasks within specified timeframes, with some actions required within 90 days and others over longer periods. Critical infrastructure owners and operators should monitor agency setup activities and participate in stakeholder engagement opportunities to influence practical setup approaches.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook
Use our research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.
-
Network Security Fundamentals Explained Practically
A practitioner-focused guide to network security fundamentals covering firewalls, segmentation, IDS/IPS, DNS security, VPNs, wireless security, zero trust architecture, and traffic…
-
Small Business Cybersecurity Survival Checklist
A budget-conscious cybersecurity checklist built specifically for small businesses. This guide covers foundational security policies, network hardening, employee training, phishing…
Coverage intelligence
- Published
- Coverage pillar
- Cybersecurity
- Source credibility
- 93/100 — high confidence
- Topics
- United States · White House · Critical infrastructure · Policy
- Sources cited
- 3 sources (hitehouse.gov, iso.org)
- Reading time
- 5 min
Cited sources
- White House Fact Sheet — President Biden Signs National Security Memorandum to Secure U.S. Critical Infrastructure
- NSM-22 Memorandum Text
- ISO/IEC 27001:2022 — Information Security Management Systems — International Organization for Standardization
Comments
Community
We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.
No approved comments yet. Add the first perspective.