Information security in the public sector and critical infrastructure
You apply rules such as NIS2 and national guides, and handle asset classification, secure procurement and incident reporting duties.
Level 201 · 20 lessons · 18 practice labs
Lessons
Public bodies and critical infrastructure
- Why public bodies and critical infrastructure are prime targets: You can explain with real incidents how outages in public services and critical infrastructure affect society.
- Critical sectors: energy, water, health, transport, finance, telecoms: You know the critical sectors and their dependencies, and can show how a failure in one spreads to others.
- The difference between IT and operational technology (OT): You can explain why security in plant, power and water control systems is handled differently from office IT.
- Quick task: map a city's critical services
Regulation
- NIS2: scope, essential and important entities: You can decide whether an organisation falls under NIS2 and which category it belongs to.
- NIS2 risk management measures and management accountability: You list the minimum measures NIS2 requires and explain what personal accountability for top management means.
- Other examples: US CISA, NIST SP 800-53, UK Cyber Essentials, EU DORA: You compare regulations and control catalogues across countries and sectors and draw out what they share.
- A national guide example: Türkiye’s Information and Communication Security Guide: Using one national guide as an example, you study its asset groups, security levels and audits and compare them with others.
- Quick task: decide NIS2 scope for organisations
Core measures in practice
- Asset classification and criticality levels: You can rank an organisation’s information assets into criticality levels by their confidentiality, integrity and availability impact.
- Network segmentation and isolating critical systems: You can design and justify a zone layout that separates critical systems from the office network and the internet.
- Identity management and privileged account control: You inventory admin accounts and apply rules for separate accounts, multi-factor authentication and session recording.
- Logging, time synchronisation and retention periods: You decide which logs to keep, how clocks are synchronised and how long logs are retained.
- Secure procurement and supply chain requirements: You can write the security requirements and acceptance criteria to add to tender and purchasing documents.
- Security for citizen data and e-government services: You can set authentication, data minimisation and availability requirements for a public online service.
- Quick task: rate asset criticality
Incident reporting and readiness
- Incident reporting duties: 24 hours, 72 hours, final report: You can plan when, to whom and with what details the early warning, notification and final report go after a significant incident.
- Working with national CERTs and sector teams: You know the channels and limits for sharing information with national and sector incident response teams.
- Public sector audits and proof of compliance: You prepare and organise in advance the policies, records and test evidence an auditor will ask for.
- Capstone: draft a compliance roadmap for a municipality: You map a fictional municipality’s assets, obligations and gaps and present a twelve-month compliance roadmap.
Practice labs
- Match the service to its critical sector: Match twelve public services to the energy, water, health, transport, finance or telecoms sector.
- Map a city's critical services: Produce a map for ten Selvikent Belediyesi services showing the systems each depends on and the effect of an outage on citizens.
- Separate IT from OT in the asset list: Split a water treatment plant's asset list into IT and OT and write the priority security objective for each group.
- Is it in scope of NIS2: Decide whether eight organisations with a given sector and size are out of scope, important or essential entities.
- Match the measure to the NIS2 requirement: Map an organisation's fifteen existing measures to the NIS2 risk management headings and list the headings with no match.
- A briefing on management accountability: Write a one-page briefing for the Demirsu Enerji board on its approval, oversight and training duties under NIS2.
- Match the regime to its country: Match NIS2, CISA guidance, NIST SP 800-53, Cyber Essentials, DORA and Türkiye's Information and Communication Security Guide to country and audience.
- Compare two national guides: From the given summaries, prepare a table comparing how two national guides handle asset classification, audit and enforcement.
- A common measure set for a multi-country body: For a transport operator active in two countries, write ten common measures that satisfy both regimes and the country-specific differences.
- Rate asset criticality: Rate fifteen municipal assets as low, medium, high or critical against the given criteria.
- Find the segmentation flaws in the diagram: Find the improper connections between the medical device, office and guest networks in a hospital network diagram.
- Segmentation rules for a critical system: Write, as a table, the permitted connections, the remote access path and the forbidden flows for a pump station control network.
- Check the log retention periods: Compare the log retention settings of ten systems with the given minimum-period table and mark the insufficient ones.
- Review the privileged accounts: In a public body's administrator account list, find shared, ownerless and six-month-inactive accounts.
- Write security requirements into a tender: Write ten security and supply chain requirements to add to a tender for software that will process citizen data.
- Work out the reporting clocks: For four incidents with a known detection time, calculate the 24-hour, 72-hour and final report deadlines.
- Write the early warning notification: Fill in the first notification to the national response team for an outage at an electricity distributor using the facts given.
- A compliance roadmap for a municipality: From Selvikent Belediyesi's gap list, produce a twelve-month compliance roadmap with priority, owner and quarter for each item.
About this course
You apply rules such as NIS2 and national guides, and handle asset classification, secure procurement and incident reporting duties.
What you will learn
- Public bodies and critical infrastructure
- Regulation
- Core measures in practice
- Incident reporting and readiness
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.