So the designations that can actually be read are almost never the security ones. They come from sector regulators doing an unrelated job: a nuclear regulator publishing its licensed sites, a central bank naming its systemically important payment systems, a transport ministry gazetting its designated ports, an energy regulator listing system-relevant power stations. That is where every asset added here came from. Two cases are worth singling out. France states that 249 operators and 1,369 points of vital importance are designated and publishes neither. South Africa is the reverse: its 2019 Act and 2023 regulations require a public register, and no such register could be found, so the most useful public list remains the National Key Points disclosure forced by litigation in 2015.
Argentina
Asset list withheld
Resolucion 1523/2019 (Secretaria de Gobierno de Modernizacion, Jefatura de Gabinete de Ministros)Comite de Ciberseguridad / Direccion Nacional de Ciberseguridad, Jefatura de Gabinete de Ministros · 2019
Argentina has a definitional framework but not a designation register. Resolucion 1523/2019, issued under the Comite de Ciberseguridad created by Decreto 577/2017, approves a definition of critical infrastructure and critical information infrastructure, criteria for identifying them and a determination of the sectors involved, b
9 instruments10 official sectors40 assets added0 into the top 100
Australia
Asset list public
Security of Critical Infrastructure Act 2018 (SOCI Act)Department of Home Affairs / Cyber and Infrastructure Security Centre (CISC) · 2018
Australia publishes a detailed critical-infrastructure framework and withholds the register that sits underneath it. The Security of Critical Infrastructure Act 2018, as expanded in 2021 and 2022, names eleven sectors and twenty-two asset classes, but the Register of Critical Infrastructure Assets is protected information and Sy
10 instruments11 official sectors40 assets added0 into the top 100
Brazil
Asset list withheld
Decreto no 9.573 de 22 de novembro de 2018 - Politica Nacional de Seguranca de Infraestruturas Criticas (PNSIC)Gabinete de Seguranca Institucional da Presidencia da Republica (GSI/PR), through the Comite Nacional de Seguranca de Infraestruturas Criticas (CNSIC) · 2018
Brazil publishes a complete and well ordered critical infrastructure framework and no critical infrastructure list at all. Decree 9,573 of 2018 created the national policy, Decree 10,569 of 2020 the strategy and Decree 11,200 of 2022 the plan, all coordinated by the Gabinete de Seguranca Institucional through the CNSIC, and toge
5 instruments13 official sectors47 assets added0 into the top 100
Canada
Asset list withheld
National Strategy for Critical InfrastructurePublic Safety Canada, with federal, provincial and territorial partners and sector networks · 2009
Canada publishes a framework and withholds the register. The National Strategy for Critical Infrastructure names ten sectors and a partnership approach but designates no assets, and the new Critical Cyber Systems Protection Act enacted through Bill C-8 designates classes of operators rather than named sites, with the list of des
8 instruments10 official sectors29 assets added0 into the top 100
Regulations on the Security Protection of Critical Information Infrastructure (State Council Decree No. 745)State Council; Cyberspace Administration of China as national coordinator, Ministry of Public Security for guidance and supervision, and sectoral competent departments as 'protection work departments' · 2021
China publishes a detailed critical-infrastructure framework and almost no critical-infrastructure register. The Cybersecurity Law of 2016 created the category of critical information infrastructure and the Critical Information Infrastructure Security Protection Regulations of 2021, State Council Decree No. 745, fixed the sector
12 instruments9 official sectors46 assets added0 into the top 100
France
Asset list withheld
Code de la defense, articles L.1332-1 to L.1332-7 and R.1332-1 to R.1332-42 (securite des activites d'importance vitale, SAIV)Secretariat general de la defense et de la securite nationale (SGDSN), ministres coordonnateurs, prefets de departement and prefets de zone de defense · 2004
France publishes its critical-infrastructure framework in full and its asset designations not at all. The code de la defense and the arrete of 2 June 2006 set out twelve secteurs d'activites d'importance vitale under nine coordinating ministers, and the SGDSN states that 249 operateurs d'importance vitale and 1369 points d'impor
6 instruments12 official sectors11 assets added0 into the top 100
Germany
Asset list withheld
KRITIS-Dachgesetz (Gesetz zur Staerkung der Resilienz kritischer Anlagen, KRITISDachG)Bundesamt fuer Bevoelkerungsschutz und Katastrophenhilfe (BBK) as national competent authority, under the Bundesministerium des Innern (BMI) · 2026
Germany publishes a great deal about the rules and almost nothing about the plant. The framework is now unusually complete: the recast BSI-Gesetz of December 2025 transposes NIS2, the KRITIS-Dachgesetz in force from 16 March 2026 transposes the CER Directive and gives the BBK a cross-sector physical resilience mandate, and the B
5 instruments12 official sectors30 assets added0 into the top 100
Information Technology Act 2000, section 70 (Protected System)Ministry of Electronics and Information Technology; the appropriate Government by notification in the Official Gazette · 2000
India regulates critical infrastructure mainly through the information layer rather than the physical one. Section 70 of the IT Act 2000 lets the Government declare any computer resource a protected system, section 70A created the NCIIPC in 2014 as the nodal agency across six critical sectors, and section 70B gives CERT-In statu
9 instruments6 official sectors18 assets added0 into the top 100
Indonesia
Asset list public
Keputusan Presiden Nomor 63 Tahun 2004 tentang Pengamanan Obyek Vital NasionalPresident of the Republic of Indonesia; security execution by the Indonesian National Police (Polri, Direktorat Pengamanan Objek Vital) with the designating authority delegated to each sector ministry · 2004
Indonesia runs two parallel critical-infrastructure regimes and publishes them very differently. Keppres 63/2004 governs physical protection of Obyek Vital Nasional and delegates designation to sector ministries, and the energy ministry in particular publishes its designations as named-facility annexes: Kepmen ESDM 385.K/BN.05/M
6 instruments9 official sectors17 assets added1 into the top 100
National Organisation for Passive Defence (Sazman-e Padafand-e Gheyr-e Amel), established by decree of the Supreme LeaderNational Organisation for Passive Defence, under the General Staff of the Armed Forces; chaired in practice by the Supreme Council of Passive Defence · 2003
Iran has a mature critical infrastructure protection doctrine and almost no public disclosure of what it protects. The National Organisation for Passive Defence, created by decree in 2003 and placed on a parliamentary footing in 2023, classifies facilities as vital, sensitive, important or protectable, and successive development
5 instruments12 official sectors50 assets added40 into the top 100
Decreto-legge 21 settembre 2019 n. 105, converted by Legge 18 novembre 2019 n. 133, establishing the Perimetro di Sicurezza Nazionale CiberneticaPresidenza del Consiglio dei Ministri, now operated through the Agenzia per la Cybersicurezza Nazionale (ACN) · 2019
Italy publishes its critical infrastructure framework in detail and withholds its asset list almost completely. The Perimetro di Sicurezza Nazionale Cibernetica established by DL 105/2019 names designated operators across ten sectors, but the roster and the ICT asset inventories filed under it carry an explicit confidentiality p
11 instruments16 official sectors34 assets added0 into the top 100
The Cybersecurity Policy for Critical Infrastructure Protection (4th edition, adopted 17 June 2022, revised 8 March 2024)Cybersecurity Strategic Headquarters / National center of Incident readiness and Strategy for Cybersecurity (NISC, reorganised as the National Cybersecurity Office in 2025) · 2022
Japan publishes its critical infrastructure framework in two layers. NISC's Cybersecurity Policy for Critical Infrastructure Protection names 15 CI sectors and describes the classes of operator and information system that fall in scope, but names no facilities. The Economic Security Promotion Act of 2022 goes further than most s
7 instruments15 official sectors40 assets added0 into the top 100
Korea (Republic)
Asset list withheld
Act on the Protection of Information and Communications InfrastructureInformation and Communications Infrastructure Protection Committee under the Prime Minister; heads of central administrative agencies designate within their own jurisdiction; Ministry of Science and ICT and the National Intelligence Service set guidelines and may recommend designation · 2001
Korea runs two parallel critical infrastructure regimes and publishes the rules of both while withholding the registers. The Act on the Protection of Information and Communications Infrastructure of 2001 designates critical information and communications infrastructure facility by facility, with the Prime Minister's Information
3 instruments12 official sectors23 assets added0 into the top 100
Constitucion Politica de los Estados Unidos Mexicanos, Articulo 28 (areas estrategicas)Congreso de la Union; areas administered by Pemex, CFE, Banco de Mexico, CENACE and Telecomm · 1917
Mexico has no single critical infrastructure statute, no designating council and no national register. What it has instead is a constitutional list of strategic areas reserved to the State, a national security law that treats attacks on strategic infrastructure as a threat without defining what that infrastructure is, and a set
9 instruments12 official sectors15 assets added0 into the top 100
Russia
Asset list withheld
Federal Law No. 187-FZ of 26 July 2017 On the Security of the Critical Information Infrastructure of the Russian FederationFederal Service for Technical and Export Control (FSTEC of Russia), with the FSB through the National Coordination Centre for Computer Incidents (NKTsKI) and the GosSOPKA system · 2017
Russia publishes a dense and highly developed critical infrastructure framework but almost no asset-level designation under it. Federal Law No. 187-FZ of 2017 defines fourteen spheres of critical information infrastructure and requires owners to categorise their own objects into three levels of significance under Government Decr
12 instruments14 official sectors47 assets added0 into the top 100
Saudi Arabia
Asset list withheld
Royal Order No. 6801 establishing the National Cybersecurity AuthorityNational Cybersecurity Authority (NCA), reporting to the King · 2017
Saudi Arabia publishes its critical-infrastructure framework in the cyber and industrial-security domains but publishes nothing at asset level. The National Cybersecurity Authority, created by Royal Order 6801 of 2017, issues the Critical Systems Cybersecurity Controls of 2019, which define a critical system by national-impact c
8 instruments18 official sectors22 assets added0 into the top 100
South Africa
Asset list withheld
Critical Infrastructure Protection Act 8 of 2019Minister of Police, on recommendation of the Critical Infrastructure Council; National Commissioner of the South African Police Service keeps the register · 2019
South Africa publishes its critical infrastructure framework in full and withholds the list of what it has designated. The Critical Infrastructure Protection Act 8 of 2019 replaced the apartheid era National Key Points Act 1980, moved the power to declare from the Minister of Defence to the Minister of Police acting on a Critica
6 instruments10 official sectors27 assets added0 into the top 100
Turkiye
Asset list withheld
Cyber Security Law No. 7545 (Siber Guvenlik Kanunu)Cyber Security Presidency (Siber Guvenlik Baskanligi) and the Cyber Security Board chaired by the President · 2025
Turkiye publishes a clear sector level framework and no asset level register. Cyber Security Law No. 7545 of 2025 created the Cyber Security Presidency and a Cyber Security Board chaired by the President, and on 5 May 2026 that Board determined fifteen critical infrastructure sectors, replacing the six sector framework that had
5 instruments15 official sectors29 assets added0 into the top 100
United Kingdom
Asset list withheld
Critical National Infrastructure policy framework (13 sectors) administered by the National Protective Security Authority and the Cabinet OfficeNational Protective Security Authority (successor to CPNI), with Lead Government Departments per sector · 2023
The United Kingdom publishes a clear sector framework and almost nothing at asset level. Critical National Infrastructure is a policy designation rather than a statutory one, run by the National Protective Security Authority with Lead Government Departments, covering thirteen sectors plus data infrastructure added by written min
8 instruments14 official sectors28 assets added0 into the top 100
United States
Asset list withheld
USA PATRIOT Act 2001, section 1016 (Critical Infrastructures Protection Act)US Congress · 2001
The United States publishes its critical infrastructure framework in full and its asset register almost not at all. NSM-22 of April 2024, which replaced PPD-21, sets out the 16 sectors, names CISA as National Coordinator and assigns a Sector Risk Management Agency to each sector, and it is all public; but the designations that a
12 instruments16 official sectors61 assets added0 into the top 100
Each nation was asked to map its official sectors onto this taxonomy and report what had no home. They worked independently and without sight of each other. The value is in the agreement: when thirteen separate national frameworks point at the same missing capability, that is not an opinion about taxonomy design, it is a defect. Every finding below has now been answered. Nine produced new capabilities in version 1.1; one was dropped on inspection, because the subject was already named in the schema.
Version 1.1 added twelve capabilities and renamed one. The ten capability groups are unchanged, none was added or removed, and all twenty-three minted factbase.org codes are preserved, so nothing that already had an identity lost it. Ten of the twelve additions are promotions rather than new subjects: the schema already named the thing inside a parent capability's description, and version 1.1 lifted that clause into its own entry and struck it from the parent, so nothing is described twice. Banks, Insurers & Systemic Institutions is the one addition that is genuinely new subject matter, which the financial group had no home for.
The move was a rules pass over the register, not a review pass. 1,279 records changed capability, every one of them logged in ginc_reclassification_ledger.csv with where it came from and where it went. The twelve new capabilities hold 969 scored assets between them, and the two that most change the shape of the register are the ones nobody would have predicted from the framework research: System Control & Dispatch, which is 69 assets at a mean of 20.3 with 35 of them in a national top 100, and Air Navigation & Traffic Management, 27 assets at a mean of 21.1. Control rooms score like chokepoints because that is what they are.
The one finding not carried across is the structural one, and it is the deepest. Ten nations designate an operator or a system rather than a site: a licensed entity, a payment system, a protected computer resource. This taxonomy is asset-oriented and cannot express that object at all. Version 1.1 did not attempt it, because it is not a missing bucket to be added but a second kind of unit that would need its own treatment.
The 654 added assets are marked in the register as layer D, official designation, and each carries the source that named it. They were scored on the same rubric as everything else: designation is evidence that an asset matters, not a score. Most sit in the 8 to 15 band, because a designated regional airport or provincial dam is a real asset and a regional one, and 41 of them were strong enough to enter a national top 100.
