At their Geneva summit meeting, U.S. President Joe Biden handed Putin a list of 16 critical infrastructure sectors that must be "off limits" from cyber attacks.

"I talked about the proposition that certain critical infrastructure should be off-limits to attack, period, by cyber or any other means," the president stated. "I gave them a list, and I don't have it in front of me, if I am not mistaken, of 16 entities — 16 defined as critical infrastructure, from the energy sector to our water systems." — Yahoo News

Biden-Putin summit: US demands a stop to Russian cyber attacks on critical infrastructure — The Telegraph

Biden Vows Retaliation On Any Future Russian Hacks On Critical Infrastructure — Forbes

Is it known what sectors (or specific entities) are in this list?

I found Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection, but it looks rather dated (December 2003), contains a fewer number of entities, and mostly covers a "regular" terrorism like bombing etc while touching cyberspace rather tangentially.

Looking for a better source.

  • 1
    Kinda blows my mind that the demand isn't "Stop all cyber attacks".
    – Ryan_L
    Jun 17, 2021 at 21:49
  • @Ryan_L That kind of agreements are always reciprocal, so I guess the demand wasn't "stop all cyber-attacks" because the USA didn't want its hands tied there.
    – Rekesoft
    Jun 21, 2021 at 10:54

1 Answer 1


According to the US Cybersecurity & Infrastructure Security Agency:

There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure. This directive supersedes Homeland Security Presidential Directive 7.

On that page, they are listed as:

  • Chemical Sector
  • Commercial Facilities Sector
  • Communications Sector
  • Critical Manufacturing Sector
  • Dams Sector
  • Defense Industrial Base Sector
  • Emergency Services Sector
  • Energy Sector
  • Financial Services Sector
  • Food and Agriculture Sector
  • Government Facilities Sector
  • Healthcare and Public Health Sector
  • Information Technology Sector
  • Nuclear Reactors, Materials, and Waste Sector
  • Transportation Sector
  • Water and Wastewater Systems Sector

This WP article agrees it is this list. This IT Security Guru article says we don't know for sure it's this list, but says it most likely is. This Verdict.co.uk article states:

Tom Kellermann, a member of the US Secret Service’s Cybersecurity Investigations Board, told ZDNet that Biden was referring to 16 critical infrastructure sectors as defined by the Cybersecurity and Infrastructure Security Agency (CISA).

Politico.com says "seemingly a reference to the list composed by the Homeland Security Department’s cyber wing."

Most of the articles I read discussing the meeting between Putin and Biden were unsure of the list, but as I showed, ZDNet at least quoted a government official by name that the CISA list is the one.

  • 2
    Interesting that Population (people) and Academic are not included....
    – CGCampbell
    Jun 17, 2021 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .