Critical Infrastructure Protection Under Adversarial Awareness

Regulatory Framework

The federal scaffolding for critical-infrastructure protection has thickened materially in the last five years. PPD-21 designates sixteen critical-infrastructure sectors and assigns sector risk-management agencies (SRMAs) — DOE for energy, EPA for water, HHS for healthcare, TSA for surface transportation, CISA as national coordinator. CIRCIA (6 U.S.C. § 681 et seq.) imposes mandatory incident-reporting obligations on covered entities within 72 hours of a covered cyber incident and 24 hours of a ransom payment, with CISA promulgating the implementing rule under 6 CFR Part 226. NIST Cybersecurity Framework 2.0, finalized in 2024, adds the Govern function to the original five (Identify, Protect, Detect, Respond, Recover) and is the de facto national standard against which sector regulators benchmark.

Sector-specific regimes layer on top. NERC CIP-002 through CIP-014 govern the bulk electric system, with CIP-014 specifically addressing physical security of critical transmission stations and CIP-015 (effective in stages) introducing internal-network-security-monitoring requirements for Cyber Assets within Electronic Security Perimeters. EPA AWIA § 2013 requires community water systems serving more than 3,300 people to assess risks and resilience including cyber. TSA Security Directive Pipeline-2021-02C imposes mandatory cybersecurity controls and incident reporting on hazardous-liquid and natural-gas pipeline owners and operators. FERC Order 887 directs NERC to develop standards requiring internal network security monitoring within trusted CIP-networked environments. Internationally, the EU NIS2 Directive (Directive (EU) 2022/2555) extends essential-and-important-entity obligations across sectors with significantly elevated penalties.

Threat-intelligence guidance is now explicit about the operational reality. The February 2024 joint CISA/NSA/FBI advisory on Volt Typhoon documented PRC state-sponsored pre-positioning inside U.S. critical-infrastructure IT networks for the express purpose of enabling future OT disruption. EO 14028 mandates zero-trust architecture, software supply-chain integrity (SBOM under NIST SP 800-218 SSDF), and incident-response standardization across federal agencies and their contractors. EO 14110 imposes additional obligations where AI systems materially affect critical-infrastructure operations.

Architectural Requirement

The regulatory text reads as if cross-medium structural defense already exists. NIST CSF 2.0's Detect function presupposes that anomalies and indicators are correlated across IT, OT, and physical assets. NERC CIP-015's internal-network-security-monitoring requirement presupposes that observations carry attribution sufficient to distinguish reconnaissance from operations. CIRCIA's 72-hour reporting clock presupposes that a covered incident can be characterized — not merely detected — within an operational tempo that human analysts cannot sustain on multi-vector campaigns. The Volt Typhoon advisory's pre-positioning concept presupposes detection mechanisms that recognize cross-medium reconnaissance whose individual signals are individually benign.

A compliant architecture must therefore deliver four structural properties. First, observation-credentialing across IT, OT, and physical media that preserves chain-of-custody from sensor to correlation. Second, signature-credentialing that admits CISA, ISAC, sector-coordinator, and defense-authority signatures as governance-credentialed inputs to correlation logic. Third, cross-medium correlation that operates at machine tempo against credentialed signatures rather than at analyst tempo against private heuristics. Fourth, graduated-response authorization whose triggering conditions are themselves credentialed and whose outcomes are auditable against the regulatory record. These properties are not independently sufficient; the architecture must compose them into a single primitive that operates above existing tooling rather than replacing it.

Why Procedural Compliance Fails

The prevailing operational model is a Security Operations Center fed by medium-specific monitoring stacks: IT-side EDR/XDR/firewall/IDS feeds into a SIEM; OT-side passive monitors (Claroty, Dragos, Nozomi, Forescout) feed into the same SIEM through dedicated connectors; physical-security systems (badge access, camera analytics, perimeter sensors) feed through PSIM platforms; threat-intelligence feeds layer indicators of compromise on top. Cross-medium correlation is the analyst's manual responsibility, executed against playbooks that codify last quarter's incidents.

The model fails structurally against the threat reality. Volt Typhoon-class campaigns exploit the analyst-tempo gap deliberately: each individual within-medium signal is engineered to fall below the within-medium tool's anomaly threshold, with the campaign's actual signal residing only in the cross-medium pattern that no within-medium tool can see. Colonial Pipeline (2021) demonstrated the cascade — IT-network billing-system intrusion drove voluntary OT shutdown — at a tempo (hours) that overwhelmed manual cross-medium reconstruction. Industroyer/CrashOverride (2016) and the Oldsmar Florida water-treatment intrusion (2021) demonstrated direct OT manipulation whose IT-side precursors had been visible but uncorrelated.

Procedural compliance also fails on the regulatory side. CIRCIA's 72-hour clock is unforgiving: an operator that detects an IT-side anomaly at hour zero, observes OT-side aberrations at hour twelve, and recognizes physical-effect pre-positioning at hour forty-eight has burned its reporting window on manual reconstruction rather than on response and remediation. NERC CIP-015's internal-monitoring requirement, EPA AWIA's resilience-assessment obligation, and TSA SD2021-02's reporting requirements all impose evidentiary burdens that the procedural model satisfies only through after-action documentation produced under time pressure. The model produces compliance artifacts; it does not produce structural defense.

What the AQ Primitive Provides

The disruption-modeling primitive consumes the within-medium tools' outputs as governance-credentialed observations. The IT, OT, and physical-security stacks continue to produce their within-medium signal; what changes is that each output is admitted to a cross-medium correlation layer with its credentialing chain intact — the sensor's attestation, the vendor's signature, the operator's deployment-context binding. CISA-published, ISAC-distributed, and sector-coordinator-issued multi-vector signatures (Volt Typhoon TTPs, Industroyer variants, ransomware-staging patterns) are admitted as governance-credentialed inputs whose authority is structural rather than configurational.

Cross-medium correlation operates at machine tempo against these credentialed inputs. A candidate multi-vector attribution produces a credentialed observation that records the participating within-medium signals, the matched cross-medium signature, the credentialing chain for both observations and signature, and the confidence basis. Graduated response — operational constraint, segment isolation, peer alerting, authority escalation — is gated by credentialed authorization rules whose triggering conditions are themselves auditable. The primitive is composable with the existing SOC stack: it sits above the SIEM rather than replacing it, and its outputs feed back into the SIEM as enriched events.

Cross-operator structure follows automatically. ISACs and CISA receive credentialed multi-vector observations from operators they credential, producing cross-operator pattern visibility that no single operator can construct. The mesh-of-credentials architecture is symmetric: a sector coordinator can issue a credentialed signature that propagates instantly across operators; an operator can produce a credentialed observation that contributes to sector-wide pattern detection; the regulatory record of incident handling is itself structurally generated rather than retrospectively assembled.

Compliance Mapping

CIRCIA's 72-hour and 24-hour reporting clocks are made achievable because incident characterization is structurally produced at machine tempo rather than reconstructed manually. The reporting artifact — covered-incident description, impact characterization, indicator package — is a derived view of the credentialed-observation record. NIST CSF 2.0's Govern, Identify, Detect, Respond, and Recover functions map to credentialed-policy issuance, asset-and-context attestation, credentialed-cross-medium correlation, credentialed-response authorization, and credentialed-recovery validation respectively. NERC CIP-002 (BES Cyber Asset categorization) and CIP-014 (physical-security risk assessment) outputs become credentialed observations admitted to the correlation layer; CIP-015 internal-network-security-monitoring requirements are satisfied because monitoring outputs are credentialed by construction.

EPA AWIA resilience-assessment obligations and TSA SD2021-02 pipeline cybersecurity obligations are satisfied through the same primitive applied to sector-specific observation channels. FERC Order 887's monitoring directive aligns naturally. NIS2 Directive obligations on essential and important entities map onto the same credentialed-observation grammar, supporting cross-Atlantic interoperation. EO 14028's zero-trust mandate is supported because credentialing replaces perimeter trust; EO 14028's SBOM/SSDF supply-chain obligations are supported because credentialed observations extend to software-component provenance under NIST SP 800-218. EO 14110's AI-related critical-infrastructure obligations are supported because AI-system outputs admitted to correlation arrive credentialed with their training-and-evaluation provenance. The Volt Typhoon advisory's pre-positioning detection problem is structurally addressed because cross-medium reconnaissance patterns are exactly what the primitive correlates.

Adoption Pathway

Adoption is incremental and additive. An operator's first integration brings existing SIEM outputs into the credentialed-observation layer through a thin adapter that preserves the SIEM's view of the world while augmenting it with credentialing metadata. The second integration admits ISAC and CISA signatures as governance-credentialed inputs, replacing private indicator-of-compromise feeds with credentialed equivalents at no operational cost. The third integration produces credentialed cross-medium correlations whose outputs feed back into the SIEM and into CIRCIA reporting workflows. Each step delivers measurable compliance value before the next is undertaken, allowing the operator to pace adoption against budget cycles, regulatory examination cycles, and the normal procurement cadence that critical-infrastructure operators must respect.

Federal scaffolding accelerates the path. CISA's State and Local Cybersecurity Grant Program, the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program (DOE), the EPA's Drinking Water and Clean Water State Revolving Funds, and the Department of Transportation's various cyber-resilience programs underwrite operator-side integration. Sector ISACs (E-ISAC, WaterISAC, H-ISAC, FS-ISAC, Auto-ISAC, Aviation-ISAC, ONG-ISAC, MS-ISAC) provide the credentialing-authority backbone. NIST National Cybersecurity Center of Excellence reference architectures and CISA Cross-Sector Cybersecurity Performance Goals establish the implementation patterns. The Joint Cyber Defense Collaborative provides operational coordination that the credentialed-observation mesh accelerates rather than competes with.

Commercial alignment is favorable. Cyber-insurance carriers increasingly underwrite premium adjustments against structural-defense maturity rather than against checkbox compliance, and credentialed multi-vector observability is exactly the structural property they price. SIEM and OT-monitoring vendors recognize that cross-medium correlation is a layer above their core capability and have indicated willingness to integrate as credentialed observers. Boards of directors at registered public companies face SEC cybersecurity disclosure obligations under the 2023 final rule (Item 1.05 of Form 8-K and Regulation S-K Item 106) whose materiality determinations are vastly more defensible when supported by structurally-credentialed incident characterization, and audit committees benefit from internal-control evidence whose authentication is cryptographic rather than testimonial. The disruption-modeling primitive is positioned at the layer that the regulatory framework has already specified and that the threat reality has already required — operators that adopt it close the structural gap their compliance posture has been documenting.