When Europeans and Americans talk about critical infrastructure, they appear to be discussing the same thing. Power grids, railways, telecommunications networks, water systems, data centres, ports, hospitals and other assets essential to society exist on both sides of the Atlantic.
Look beneath the surface, however, and two rather different models emerge. The differences are not simply regulatory. They concern geography, ownership, the types of assets being protected, the relationship between government and industry and, perhaps most importantly, the culture surrounding security and resilience.
Europe is increasingly building a model based on regulated resilience and demonstrable governance. The United States has traditionally approached the same problem through national security, sector-specific regulation and public-private cooperation.
Neither model changes the fundamental problem: critical infrastructure depends on thousands of people being able to access thousands, and sometimes millions, of physical and digital assets. The way organisations govern that access is therefore becoming part of infrastructure resilience itself.
Two definitions of critical infrastructure
The United States formally recognises 16 critical infrastructure sectors. They range from Energy, Communications and Transportation Systems to the Defense Industrial Base, Dams, Critical Manufacturing, Commercial Facilities and Nuclear Reactors, Materials and Waste. The underlying principle is national impact. Infrastructure is considered critical when its incapacitation or destruction could have a debilitating effect on national security, economic security, public health or safety.
Europe approaches the question somewhat differently. Under the Critical Entities Resilience Directive, or CER, the focus is on entities providing essential services and the infrastructure necessary to provide those services. Member States must identify critical entities based partly on the potential disruptive effect of an incident. CER defines critical infrastructure broadly as assets, facilities, equipment, networks or systems necessary for providing essential services.
This produces an important conceptual difference. The American vocabulary tends to start with critical infrastructure and national functions. The European vocabulary increasingly starts with critical entities, essential services and the resilience obligations attached to them. That sounds semantic. Operationally, it is not.
The assets are different too
The physical characteristics of the two continents create very different security environments.
American infrastructure operates at enormous geographical scale. Electricity transmission lines, oil and gas pipelines, rail networks, telecommunications infrastructure, water facilities and transport systems can extend across thousands of kilometres and multiple states. Many sites are remote. Telecommunications towers, substations, pipeline facilities, pumping stations and railway infrastructure may be hours away from the organisation responsible for them.
Europe has enormous infrastructure networks too, but they are generally compressed into a much denser geographical environment. Assets belonging to different operators are frequently physically close to one another and national systems are increasingly interconnected across borders. A European infrastructure operator may therefore be managing thousands of relatively small distributed assets across a dense network, while simultaneously interacting with neighbouring infrastructure operators, municipalities, national governments and European regulatory frameworks.
In both cases the result is complexity. The topology of that complexity is different.
Ownership makes the American model fundamentally different
One of the defining characteristics of US critical infrastructure is private ownership. US government sources consistently note that the majority of American critical infrastructure is owned and operated by the private sector. Consequently, CISA's approach places considerable emphasis on partnership, information sharing and cooperation between government and infrastructure owners and operators.
That creates an interesting governance structure. Washington may consider an asset essential to national security, but the asset itself could belong to an investor-owned utility, telecommunications company, railroad, pipeline operator, technology company or another commercial organisation. Government therefore cannot treat critical infrastructure simply as government infrastructure.
Europe also has extensive private ownership, particularly in energy, telecommunications, digital infrastructure and transport. But European infrastructure frequently sits within a more explicit public-service and regulatory framework. Depending on the country and sector, ownership can involve national governments, municipalities, provinces, state-controlled companies, regulated private utilities and commercial infrastructure operators.
The result is not a simple distinction between "private America" and "public Europe". Both are mixed systems. The more useful distinction is that Europe increasingly places direct statutory resilience obligations on identified entities, while the American system combines regulation with a strong institutional model of cooperation between government and privately owned infrastructure.
Europe is turning resilience into a governance requirement
The European regulatory architecture is becoming increasingly explicit. CER requires Member States to establish resilience strategies, perform risk assessments, identify critical entities and ensure those entities implement appropriate technical, security and organisational measures. Member States were required to identify their critical entities by 17 July 2026.
NIS2 adds another layer by imposing cybersecurity risk-management and reporting requirements across sectors including energy, transport, banking, healthcare, drinking water, wastewater, digital infrastructure, public administration and space, alongside additional critical sectors. The European Commission's July 2026 guidance on CER further emphasises an all-hazards approach covering natural disasters, accidents, physical attacks, hybrid threats, drone attacks and other disruptive events.
This matters because European infrastructure security is no longer primarily a question of whether an organisation believes that a particular security measure is sensible. Increasingly, the organisation must be able to demonstrate that risks have been identified, responsibilities allocated, measures implemented and resilience maintained. That is governance.
America starts more naturally with the threat
The US model has historically developed against a somewhat different background. Terrorism, nation-state threats, natural disasters, cyberattacks and the protection of national security have played a prominent role in American critical-infrastructure policy. Current US policy retains 16 critical infrastructure sectors and gives federal departments and agencies sector-specific risk-management responsibilities, while CISA acts as the national coordinator for critical infrastructure security and resilience. That produces a security ecosystem built strongly around collaboration.
Infrastructure operators, federal agencies, state and local authorities, Sector Risk Management Agencies, law enforcement and CISA exchange information and coordinate responses. The terminology itself reveals part of the cultural difference. American discussions frequently revolve around threats, adversaries, risk, defence, preparedness, incident response and recovery.
European discussions more frequently include compliance, governance, proportionality, accountability, risk management and auditability.
Both ultimately seek resilience. They approach it from different directions.
And then there is culture
Regulation explains only part of the difference. There is also a cultural dimension. American infrastructure security tends to operate within a stronger national-security narrative. An electricity substation, railway network, telecommunications facility or water plant is not merely an operational asset. It can be viewed as part of the country's ability to function during attack, disaster or geopolitical conflict. This creates a relatively natural connection between physical security, cybersecurity, intelligence and emergency response.
Europe has historically been more fragmented. Physical security, IT security, OT security, identity management, health and safety, privacy and compliance frequently developed as separate disciplines, sometimes even under completely different departments.
A physical key might therefore be managed by Facilities, while the identity of the person carrying it is governed by IT. Cybersecurity might sit under the CISO, OT security under engineering and regulatory compliance somewhere else again. Technically, the same employee exists in all these environments. Organisationally, that employee can become four different problems. CER and NIS2 are gradually forcing those worlds together.
Europe asks: "Can you prove that access is governed?"
This is perhaps the most interesting difference. European regulation increasingly creates a requirement for organisations to demonstrate that appropriate controls actually exist.
- Who can access a critical asset?
- Why does that person have access?
- Who authorised it?
- Is the access still required?
- Was it revoked when the person's role changed?
- Can the organisation reconstruct what happened after an incident?
Those are governance questions.
In the United States, the conversation may begin slightly differently:
- Who could attack this asset?
- What would happen if it became unavailable?
- What dependencies would fail?
- How quickly could operations recover?
- How do we coordinate when an incident occurs?
These questions are not mutually exclusive. In fact, modern critical-infrastructure protection increasingly requires organisations to answer both sets.
The contractor problem exists everywhere
There is another characteristic shared by American and European infrastructure: an enormous dependency on external workers. Utilities, railways, telecom operators and infrastructure companies depend on contractors for construction, inspection, maintenance, repair and emergency intervention. A technician may legitimately require access to hundreds of distributed assets, but only for a particular role, region, customer, project or period.
Traditional physical access models struggle with this. Keys are issued. Permissions accumulate. Projects finish. Contractors move between employers. Roles change. Access rights remain. The organisation may know precisely what somebody can access in Active Directory while having much less certainty about the physical assets that the same person can open.
That distinction becomes increasingly difficult to defend when physical infrastructure itself is critical.
Identity becomes the common denominator
This leads to an important convergence between the American and European models. Whether resilience is approached through national security or regulatory compliance, eventually the same operational question appears:
Who is allowed to do what, where, when and why?
That is an identity problem. Digital systems solved much of this problem by introducing Identity and Access Management and Identity Governance and Administration. Users receive identities. Roles are assigned. Policies determine access. Approvals are recorded. Permissions can expire. Access can be revoked. Events can be logged and audited.
Physical access has often remained outside that governance model. Electronic keys and cylinders have become increasingly sophisticated, but the governance surrounding them is frequently still separated from enterprise identity. That separation is becoming difficult to maintain.
From key management to Physical Access Governance
This is where the next phase of critical-infrastructure security becomes interesting. Managing electronic keys is not enough. The objective should be to connect the physical access decision directly to the organisation's identity and governance model. If an engineer changes role, physical permissions should change. If a contractor leaves, access should disappear. If somebody requires temporary access to a substation, railway cabinet, telecom site or pumping station, the permission should be granted according to policy and expire automatically. If an auditor asks who could access a critical asset at a particular moment, the organisation should not have to reconcile spreadsheets, key-management systems, IAM databases and service-management tickets manually.
There should be one governance chain: Identity → Policy → Authorisation → Physical Access → Evidence.
Different roads, same destination
The United States and Europe are unlikely to create identical critical-infrastructure regimes. Their geography, ownership structures, legal systems and security cultures are too different. America's model will continue to be heavily influenced by federalism, private ownership, national-security considerations and public-private cooperation. Europe is likely to continue building a more formal regulatory architecture around resilience, governance and demonstrable compliance.
But technology is causing the two models to converge operationally. Energy networks are becoming digital. Telecom infrastructure depends on software. Rail infrastructure combines IT, OT and physical assets. Data centres combine physical facilities with digital services. Water infrastructure increasingly depends on remotely managed control systems.
The distinction between physical security and cybersecurity therefore becomes increasingly artificial. And once that happens, identity becomes the logical control layer connecting them. The strategic question for critical-infrastructure operators on either side of the Atlantic is therefore no longer simply:
"Do we control our keys?"
It is: "Can we continuously prove that only the right identity has access to the right critical asset, for the right reason, at the right time?"
Europe may arrive there through regulation. America may arrive there through resilience and national security. But they are increasingly arriving at the same destination.
Critical infrastructure cannot be resilient if physical access to that infrastructure is not governed.
