Companian Document to the GFCE-Merdidian Good practice guide on Critical Information Infrastructure Protection for governmental policy makers

The 2016 GPG [GM2016] outlined that Critical Information Infrastructure Protection (CIIP) is a complex but important topic1 for nations. By nature, CIIP is a national security topic in the sense that failure, disruption or destruction of critical information infrastructures (CII) may cause serious impact to society, the economy, and the well-being of citizens. Societies at large and, more specifically, critical infrastructures (CI) critically depend on the proper functioning of CII. Depending on the nation’s advancement in utilising digital technologies, a national CII comprises the critical services supplied by: 1. the ICT sector (e.g. mobile telephony and internet services), 2. specific information, communication, and operational technology-based systems and networks in each of the national CI, and 3. critical services beyond the established framework of these CI. To ease the access to this Companion Document, the notion ICT sector is used rather than explaining each of the possible national variants such as ‘IT and telecommunication sector’ including variants with two distinct sectors falling under different ministerial responsibilities. Chapter 2 defines and explains CII, and its increasing complexity, in more detail