What Would Common-Sense Certification Look Like for Critical Infrastructure?
Critical infrastructure owners need a practical certification record that connects threat, vulnerability, consequence and design decisions.
A short, auditable set of questions applied consistently: what must keep running, what could stop it, where the weak links are, and what protection each is designed to deliver. Certification should reduce ambiguity for owners and insurers rather than add paperwork.
The phrase “critical infrastructure” can become abstract. The built environment is not abstract. It is walls, rooms, doors, roads, tanks, transformers, control systems, drainage, communications, people and decisions made years before an incident.
Certification turns judgment into a record
Common-sense certification does not mean every facility receives the same protective treatment. It means the owner can produce a record showing that the relevant risks were evaluated and addressed in proportion to consequence.
NSM-22 reinforced the national importance of critical infrastructure security and resilience. For facility owners, that policy direction should translate into practical questions: what assets are essential, what can fail, what must remain operational, and what evidence proves the risk was managed?
What should be certifiable
- Defined threat and hazard basis.
- Facility security level or equivalent risk category.
- Protective envelope assumptions.
- Emergency access and continuity assumptions.
- Documented residual risk acceptance.
Certanet’s position is deliberately practical: if a facility’s security claims cannot be documented, tested, reviewed or explained, they are not mature enough for high-consequence infrastructure.
Recommended citation
Certanet, “What Would Common-Sense Certification Look Like for Critical Infrastructure?” 2026.