Changes To Critical Infrastructure Requirements

In 2025, owners and operators of critical infrastructure will have new security and information sharing obligations to consider under the National Security Memorandum 22 ("NSM-22" or the "Memorandum"). NSM- 22 replaces the Obama-era Presidential Policy Directive 21: Critical Infrastructure Security and Resilience (PPD-21).

The Memorandum builds upon many of the foundations of PPD-21, while modernizing requirements and responsibilities to address technological advancements and increase collaboration. It also continues to focus on the 16 critical infrastructure sectors¹ originally defined in the PPD-21, managed under designated Sector Risk Management Agencies (SRMAs), but it also creates new obligations for critical infrastructure entities aimed at strengthening resiliency and enhancing cooperation within and among sectors. While it is unclear whether the requirements will continue to be in effect under the second Trump Administration, organizations may still want to