Critical Infrastructure Cybersecurity in the Orlando Region

The Orlando metropolitan area hosts a concentration of critical infrastructure sectors — including defense electronics, aerospace manufacturing, theme park operations, water utilities, transportation networks, and healthcare systems — that collectively represent one of Florida's most complex cybersecurity risk environments. Federal frameworks administered by the Cybersecurity and Infrastructure Security Agency (CISA) and sector-specific regulators govern how these assets must be protected. This page covers the regulatory structure, sector classifications, operational mechanics, and professional landscape that define critical infrastructure cybersecurity practice in and around Orlando.

• Definition and scope
• Core mechanics or structure
• Causal relationships or drivers
• Classification boundaries
• Tradeoffs and tensions
• Common misconceptions
• Checklist or steps (non-advisory)
• Reference table or matrix
• References

Definition and scope

Critical infrastructure cybersecurity refers to the protective measures, frameworks, regulatory requirements, and professional disciplines applied to the 16 sectors formally designated by the U.S. Department of Homeland Security under Presidential Policy Directive 21 (PPD-21), issued in 2013. These sectors include energy, water and wastewater, transportation, communications, healthcare and public health, emergency services, defense industrial base, and commercial facilities — all of which have significant operational presence in the Orlando region.

Within Orlando and Orange County, critical infrastructure assets span Walt Disney World and Universal Orlando's operational technology (OT) networks (classified under the commercial facilities and communications sectors), Orlando Utilities Commission (OUC) electrical and water systems, Orlando International Airport (MCO) under the transportation systems sector, the AdventHealth and Orlando Health hospital networks under the healthcare and public health sector, and multiple defense simulation and modeling contractors operating under the defense industrial base sector.

The geographic scope of this page covers the City of Orlando, Orange County, and the broader Orlando-Kissimmee-Sanford Metropolitan Statistical Area (MSA) as defined by the U.S. Office of Management and Budget. Regulatory jurisdiction is primarily federal (CISA, sector-specific agencies) and state (Florida Division of Emergency Management, Florida Digital Service). Municipal ordinances issued by the City of Orlando or Orange County Board of County Commissioners may impose additional IT security requirements on contractors and vendors but do not supersede federal sector regulations. Critical infrastructure assets located in Osceola, Seminole, Lake, or Volusia counties adjacent to the MSA are not covered by Orlando-specific regulatory guidance and fall under their respective county emergency management frameworks.

For broader context on how cybersecurity regulation applies across Orlando's economy, the regulatory context for Orlando cybersecurity provides the full statutory and agency landscape.

Core mechanics or structure

Critical infrastructure cybersecurity in the United States operates through a layered architecture of federal frameworks, sector-specific requirements, and voluntary standards. The primary federal framework is the NIST Cybersecurity Framework (CSF), published by the National Institute of Standards and Technology, which organizes protective activities into five functions: Identify, Protect, Detect, Respond, and Recover. The 2.0 revision of the CSF, released by NIST in February 2024, added a sixth function — Govern — reflecting the increasing role of organizational leadership in cybersecurity risk management.

For operational technology (OT) environments — control systems, SCADA networks, and industrial control systems (ICS) common in utilities, manufacturing, and theme park ride control — the applicable technical standards are NIST SP 800-82 (Guide to Operational Technology Security) and IEC 62443, the international standard series for industrial communication networks and cybersecurity. The Orlando region's defense contractors are also subject to the Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program, which imposes up to Level 3 requirements on organizations handling Controlled Unclassified Information (CUI).

Sector-specific agencies — called Sector Risk Management Agencies (SRMAs) under PPD-21 — hold primary responsibility for sector coordination. The Department of Energy (DOE) leads the energy sector; the Department of Transportation (DOT) leads transportation; the Department of Health and Human Services (HHS) leads healthcare. CISA operates as the overarching coordinator across all 16 sectors through its Infrastructure Security Division.

Causal relationships or drivers

Orlando's critical infrastructure cybersecurity risk profile is shaped by four structural drivers that distinguish it from similarly sized metros.

Tourism-sector attack surface. The Orlando metro hosts more than 75 million visitors annually (pre-pandemic figures cited by Visit Orlando), creating one of the largest point-of-sale and hospitality network environments in the country. Theme park operational technology — ride control, access management, crowd analytics — runs on networks that intersect both IT (information technology) and OT domains, expanding the attack surface significantly.

Defense industrial base concentration. The I-4 corridor and Lake Nona area host the U.S. Army's Program Executive Office for Simulation, Training and Instrumentation (PEO STRI), Lockheed Martin, L3Harris Technologies, and CAE USA — all operating under DoD cybersecurity mandates. A breach affecting a defense simulation network in Orlando would trigger federal incident reporting obligations under the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, which requires reporting to the DoD Cyber Crime Center (DC3) within 72 hours.

Utility modernization. Orlando Utilities Commission has invested in smart grid infrastructure, creating new network-connected endpoints across its electrical distribution system. The North American Electric Reliability Corporation's Critical Infrastructure Protection (NERC CIP) standards (CIP-002 through CIP-014) apply to bulk electric system assets operated by OUC, including requirements for electronic security perimeters, physical security of cyber assets, and incident response planning.

Healthcare data aggregation. The Orlando Health and AdventHealth systems operate large electronic health record (EHR) environments subject to the HIPAA Security Rule (45 CFR Part 164), enforced by the HHS Office for Civil Rights. Ransomware targeting hospital networks — a documented attack pattern nationally — can simultaneously constitute a HIPAA breach and a critical infrastructure incident requiring CISA notification. The HHS HC3 publishes sector alerts specifically for healthcare cybersecurity threats.

Classification boundaries

CISA's 16-sector framework establishes the primary classification, but Orlando's operational reality creates cross-sector classification questions that affect which regulatory regime applies.

The Transportation Security Administration (TSA) issues sector-specific cybersecurity directives for aviation, pipeline, and surface transportation. Orlando International Airport (MCO), operated by the Greater Orlando Aviation Authority, falls under TSA's aviation cybersecurity directives as a commercial service airport with more than 40 million annual passengers (FAA Air Traffic Activity System).

Water systems serving populations over 3,300 are required under the America's Water Infrastructure Act of 2018 (AWIA) to conduct risk and resilience assessments and submit certifications to the EPA. Orange County Utilities and the City of Orlando's water division both meet this population threshold.

Tradeoffs and tensions

Transparency vs. security. Public utilities in Florida operate under the Florida Public Records Law (Chapter 119, Florida Statutes), which creates tension with the need to protect sensitive infrastructure security plans. Florida Statute §119.071(3) provides exemptions for security system plans of governmental agencies, but the boundaries of those exemptions are contested in practice when records requests involve utility network diagrams or incident reports.

OT-IT convergence risk. As industrial control systems are connected to enterprise IT networks — enabling remote monitoring and efficiency gains — the air gaps that historically isolated OT systems from external threats are eliminated. NIST SP 800-82 Rev. 3 explicitly addresses this convergence risk, but implementing its segmentation recommendations in legacy OT environments often requires capital expenditure that operational budgets resist.

Federal mandate vs. local capacity. NERC CIP and TSA directives impose compliance timelines on utilities and airports that may exceed the technical capacity of local staff. Smaller jurisdictions within the Orlando MSA — Kissimmee Utility Authority, for example — face the same federal standards as OUC despite operating with substantially fewer cybersecurity personnel.

Incident disclosure timing. CISA's Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (Public Law 117-169) will require covered entities to report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours once final rules are published. This interacts with Florida's own data breach notification statute (Florida Statute §501.171), which requires notification within 30 days, creating a two-track reporting obligation with different deadlines and different recipient agencies.

The professional landscape serving these needs is documented on the Orlando Security Authority index, which maps service providers across critical infrastructure and adjacent cybersecurity disciplines.

Common misconceptions

Misconception: Only federally owned assets qualify as critical infrastructure.
Correction: The 16-sector framework explicitly includes privately owned assets. Theme parks, private hospital networks, and investor-owned utilities are all subject to critical infrastructure protections if they meet sector criteria, regardless of ownership structure. CISA's Critical Infrastructure Sectors page confirms that the majority of U.S. critical infrastructure is privately owned.

Misconception: NIST CSF compliance equals regulatory compliance.
Correction: The NIST Cybersecurity Framework is voluntary for most sectors and does not itself carry legal enforcement weight. Organizations subject to NERC CIP, HIPAA, or TSA directives must satisfy those regulations independently. Alignment with the CSF may support compliance posture but does not substitute for sector-specific regulatory requirements.

Misconception: Air-gapped OT networks are immune to cyberattack.
Correction: Documented incidents — including the 2021 Oldsmar, Florida water treatment plant incident, where an attacker manipulated chemical levels via remote access software — demonstrate that OT systems believed to be isolated are frequently connected through remote access pathways or shared workstations. The Oldsmar incident involved a Florida water utility and is cited in CISA advisory AA21-042A.

Misconception: Cybersecurity incidents at theme parks are purely commercial, not infrastructure events.
Correction: CISA's commercial facilities sector explicitly includes entertainment complexes. A cyberattack disabling crowd management, access control, or emergency communication systems at a venue hosting 50,000+ daily visitors constitutes an infrastructure security event with public safety implications, not merely a business disruption.

Checklist or steps (non-advisory)

The following sequence reflects the standard phases of a NIST CSF-aligned critical infrastructure cybersecurity program as applied to an Orlando-region asset operator. This is a structural reference, not professional advice.

1. Asset inventory and classification — Document all IT and OT assets, categorize them by sector classification, and identify which federal SRMA has jurisdiction. Reference NIST SP 800-82 for OT asset categorization criteria.
2. Regulatory mapping — Identify all applicable mandates: NERC CIP (energy), TSA directives (transportation/aviation), HIPAA Security Rule (healthcare), AWIA (water), CMMC (defense industrial base), and CIRCIA (cross-sector reporting).
3. Risk and resilience assessment — Conduct a formal risk assessment per the applicable sector standard. For water utilities, AWIA mandates submission of risk and resilience assessments to the EPA on a five-year cycle.
4. Security control implementation — Implement controls mapped to NIST SP 800-53 Rev. 5 or IEC 62443 (for OT), depending on asset type. Document control selection rationale.
5. Supply chain risk review — Assess third-party vendors and managed service providers for cybersecurity posture, consistent with NIST SP 800-161 (Cybersecurity Supply Chain Risk Management Practices).
6. Incident response plan development — Draft and test an incident response plan that addresses both CIRCIA's 72-hour reporting window and Florida Statute §501.171's 30-day breach notification requirement.
7. Coordination with CISA regional office — Engage the CISA Region 4 office (which covers Florida) for sector-specific advisories, vulnerability assessments, and tabletop exercise support.
8. Personnel training and exercise — Conduct tabletop exercises aligned to sector-specific threat scenarios. HHS HC3 and CISA publish scenario libraries for healthcare and cross-sector use respectively.
9. Continuous monitoring and reassessment — Implement continuous monitoring consistent with NIST SP 800-137 and establish a formal reassessment cycle triggered by system changes, incidents, or regulatory updates.

For organizations operating across Orlando's IoT and smart building environments, steps 1 and 5 require expanded scope to include building automation systems and networked physical security devices.

Reference table or matrix

Federal Regulatory Frameworks Applicable to Orlando Critical Infrastructure Sectors