CHAPTER 3: PROVIDERS OF CRITICAL INFRASTRUCTURE SERVICES

‘Critical infrastructure is diverse and complex not only because of the variety of sectors it covers, from communications, emergency services, information technology to nuclear reactors and transportation systems; it is complex also due to the special nature of its ownership.’⁶ – Dean Thompson

Once the list of critical infrastructure services has been prepared, they have all been described and their service levels determined, the next step is to identify the providers. Critical infrastructure service providers are not only public-sector organisations. In many countries, essential elements of critical infrastructure are owned and operated by private companies. Depending on the service, market, regulations and many other factors, a service may be provided by one or several service providers. Some countries may only have one provider of a certain service if the service provider is a monopoly, or only one service provider may have the right to provide a certain service in a certain region. The number of monopolies has decreased in the past 20 or 30 years. Many countries have opened their markets in the communication and energy sectors, which in the past were often controlled by monopolies.

In the case of a monopoly when there is only one service provider on the market, this service provider must be considered the critical infrastructure service provider.

What happens when there is more than one service provider on the market? Many other factors should be considered, such as the number of clients to whom the service is provided, market share, production volume and capacity, number of clients in a certain geographic region, etc.

Which service providers will be considered critical infrastructure service providers and which ones will not? Depending on the sector, services and possible criteria for defining critical infrastructure services, as well as reaching the relevant agreements, identifying these service providers may take a lot of time.

For example, if there are many voice telephony service providers, which of them should be considered critical infrastructure service providers? There may also be situations where some providers only operate in a certain geographic region and don’t provide their service nationwide. Some of these service providers may have the biggest market share in a specific region and not provide their services in another. This means that geography must be considered when defining the criteria for a critical infrastructure service provider.

Possible criteria for qualifying an organisation as a critical infrastructure services provider:

• Number of clients nationwide.

• Number of clients in a certain region.

• Number of people living in a certain administrative district.

• Market share of the service provider according to turnover.

• Production volume, capacity, etc.

• Number of service points in the country or a certain administrative district.

• Client or clients to whom the service is provided (e.g. a communications operator that provides services to other critical infrastructure service providers).

• A service provider of transnational importance (e.g. a critical infrastructure service provider in the EU – an operator that provides a service to a significant number of clients abroad).

• An operator that provides international connections, etc.

The list of critical infrastructure providers should be reviewed and updated at least annually or after essential changes.

Lesson 3: Define the providers of critical infrastructure services.