National Critical Functions

National Critical Functions (NCFs) are functions of government and the private sector so vital to the United States that their disruption, corruption, or dysfunction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

CISA, through the National Risk Management Center (NRMC), brings the private sector, government agencies, and other key stakeholders together to identify, analyze, prioritize, and manage the most significant risks—cyber, physical, supply chain and more—to these important functions.

NCFs Overview

In April 2019, CISA published its initial set of NCFs, which has since been complemented by definitions for each function. The effort to identify these critical functions was conducted in collaboration with government and industry partners associated with all 16 critical infrastructure sectors, State, Local, Tribal, and Territorial (SLTT) partners, and other stakeholders.

The set of NCFs are organized into four areas—connect, distribute, manage, and supply—which identify the:

Connections by technologies that enable critical communications and capabilities to send and receive data (e.g., internet connectivity),
Distribution methods that allow the movement of goods, people, and utilities inside and outside the United States (e.g., electricity distribution or cargo transportation),
Management processes that ensure our national security and public health and safety (e.g., management of hazardous material or national emergencies), and
Supplies of materials, goods and services that secure our economy (e.g., clean water, housing, and research and development).

The NCFs allows for a more robust prioritization of critical infrastructure and a more systematic approach to corresponding risk management activity. They represent an evolution to the critical infrastructure risk management framework established in the National Infrastructure Protection Plan. While the previous approach focused almost entirely on entity level risk management as opposed to critical outcomes, the NCF approach enables a richer understanding of how entities come together to produce critical functions, and what assets, systems, networks, and technologies underpin those functions.

By viewing risk through a functional lens, we can ultimately add resilience and harden systems across the critical infrastructure ecosystem in a more targeted, prioritized, and strategic manner. This allows for more holistically capturing cross-cutting risks and associated dependencies that may have cascading impacts within and across sectors.

NCFs in Action

Policy

NCFs have been meaningfully leveraged in federal policy doctrine for cybersecurity and critical infrastructure risk management. Specifically, NCFs are featured in the National Cyber Strategy, the DHS Cybersecurity Strategy, and the National Strategy to Secure 5G. Similarly, the Executive Order on Coordinating National Resilience to Electromagnetic Pulses leverages the definition of NCFs to call on the critical infrastructure community to better understand the effects of electromagnetic pulses (EMP) through assessment and prioritization of NCFs.

Operational Risk Management Support

The NCFs have been utilized to support disaster-specific response and restoration operations. Most prominently, the NCFs have helped prioritize risk management needs for COVID-19 response, as well as security needs around heightened geopolitical tensions, and preparedness for impending hurricanes.

For COVID-19, the NRMC used the NCF structure to create a register of risks to critical infrastructure organized around potential degradation from drivers such as commodity concerns, workforce concerns, demand shocks, and change in the cyber risk posture. This will serve as a template for broader efforts by the NRMC to work via stakeholder engagement mechanisms, including the Critical Infrastructure Partnership Advisory Council (CIPAC) structure, to ultimately create a more expansive NCF Risk Register.

Analytic Enhancement through NCF Risk Architecture Development

The provisioning of each NCF involves a complicated series of processes composed of sub-functions and dependencies. The NCF Risk Architecture will build out that understanding. In doing so, it is possible to learn the key assets, networks and systems that support those processes, as well as the underlying software, hardware, and other technologies that enable that process. It is also possible to identify the entities – whether businesses or government – that are key providers of elements of the process and function. This architecture relies on process and engineering maps, as well as understanding of business and governance of the function to enable risk analysis against a range of scenarios.

The figure below illustrates how an NCF can be decomposed to illuminate a more granular understanding of its provisioning:

Below is a sample decomposition for the NCF of Conduct Elections:

Looking Ahead

The NCF framework established a new “language” to talk about critical infrastructure risk management. The value of the NCFs is both their ability to convey the complexities and dependence on critical infrastructure and their effectiveness as a framework to develop data and stakeholders. The NRMC will continue developing this information in coordination with critical infrastructure stakeholders, endeavoring to deepen the understanding of who and what is required for the successful, sustained, and resilient operation of individual NCFs. This process will also inform an NCF Risk Register that shows risks to NCFs and risk management approaches that best address specific threats and vulnerabilities. This is a complex and ongoing undertaking and will rely heavily on the expertise of the critical infrastructure community.

Policy, doctrine, and process enhancements will continue and additional analysis will support structured risk management initiatives, such as CISA’s ongoing efforts for Election Security and ICT Supply Chain Risk Management.

NCF Resources

If you have a question or comment, please email us at NCF@hq.dhs.gov.