CrisisLead CEO, Christopher Stitt helps prepare the next generation of national security professionals through teaching Homeland Security courses at George Mason University. Recently, he was asked how teaching this helps him provide services to mid-market companies. Well, a big part of Homeland Security is the protection of critical infrastructure, to which mid-market companies are a major contributor, even if they do not realize it.

Mid-market companies, often overlooked in favor of their larger counterparts, play an indispensable role in maintaining the stability and growth of critical infrastructure in the United States. While definitions of what constitutes a mid-market company vary, the consensus stands that these companies generate between $10 million to $1 billion in annual revenue.

According to JP Morgan Chase, there are more than 300,000 U.S. companies in this range, accounting for 33 percent of annual revenue and 30 percent of private sector employment in the United States.[i]

What Sectors account for the largest percentage of the U.S. Mid-Market?

According to both JP Morgan Chase, the middle market is concentrated primarily in five industries: Retail, Construction, Healthcare, Professional Services, and Wholesale. According to JP Morgan Chase, these industries contribute a staggering 60% of the revenue generated by mid-market companies.

BlackRock, in a September 2024 report, found that the four largest sectors are information technology, healthcare, and business and financial services.[ii]  In a chart in their report, Blackrock rounds out their top 12 to also include: industrials, consumer discretionary, telecommunications, materials, real estate, consumer staples, utilities, and “other.”

What counts as “Critical Infrastructure?”

Critical infrastructure, as defined by the Cybersecurity and Infrastructure Security Agency (CISA), encompasses assets, systems, and networks, whether physical or virtual, that are so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.[iii] CISA identifies sixteen sectors of critical infrastructure:

• Chemical Sector
• Commercial Facilities Sector
• Communications Sector
• Critical Manufacturing Sector
• Dams Sector
• Defense Industrial Base Sector
• Emergency Services Sector
• Energy Sector
• Financial Services Sector
• Food and Agriculture Sector
• Government Facilities Sector
• Healthcare and Public Health Sector
• Information Technology Sector
• Nuclear Reactors, Materials, and Waste Sector
• Transportation Systems Sector
• Water and Wastewater Systems Sector

So how do Mid-Market Industries fit with critical infrastructure?

So, let’s examine the sectors highlighted by JP Morgan and BlackRock and how they fit into CISA’s list of Critical Infrastructure:

• Retail: Falls under the Commercial Facilities Sector, which includes a wide variety of sites that draw large crowds for shopping, business, entertainment, or lodging. These facilities are integral to the daily lives of millions and support economic stability through commerce and employment.
• Construction: While not a specific sector of its own, construction is a crucial component supporting various sectors like Government Facilities, Transportation Systems, and the Energy Sector, providing the infrastructure required for their operation and maintenance.
• Healthcare: Directly aligns with the Healthcare and Public Health Sector, which protects all sectors of the economy from hazards such as terrorism, infectious disease outbreaks, and natural disasters. This sector ensures that healthcare services and public health resources are available to provide for the nation’s well-being.
• Professional Services: This is a broad category that provides essential services across multiple critical infrastructure sectors, including Financial Services, Information Technology, and Emergency Services. These services ensure the efficient operation, security, and resilience of critical infrastructures.
• Wholesale: While also not a sector on its own, wholesale activities are vital for the Food and Agriculture Sector. Wholesalers ensure the distribution of food products, agricultural inputs, and related goods, maintaining the supply chain’s integrity and the availability of essential goods.
• Information Technology: Identified by BlackRock as one of the largest sectors, it aligns with the Information Technology Sector, these virtual and distributed functions produce and provide hardware, software, and information technology systems and services, and—in collaboration with the Communications Sector—the Internet. Information technology is also crucial for the operation of other critical infrastructures.
• Business and Financial Services: This sector includes Financial Services, which is essential for the nation’s economic security and stability. As CISA highlights, this sector includes “thousands of depository institutions, providers of investment products, insurance companies, other credit and financing organizations, and the providers of the critical financial utilities and services that support these functions.”
• Industrials: This sector supports various critical infrastructures through critical manufacturing, which includes the manufacturing of primary metals, machinery, electrical equipment, appliances, components, and transportation equipment.  Alternatively, companies in the industrial sector may support the critical chemical infrastructure by producing basic, specialty, or agricultural chemicals, or consumer products.
• Consumer Discretionary: Includes businesses that provide goods and services that are non-essential but desired by consumers. While this may not expressly fall under “critical infrastructure” the manufacturers, wholesalers, and retailers, are vital to the overall economy.
• Telecommunications: Falls under the Communications Sector and includes satellite, wireless, and wireline communication infrastructures and service providers. These are vital for the operation of other critical infrastructures including energy, information technology, financial services, emergency services, and transportation systems.
• Materials: This sector includes companies involved in the extraction and processing of raw materials. In the critical infrastructure rubric, this falls under the “Critical manufacturing” sector as described in “industrials” above.
• Real Estate: Involves the development, management, and investment in properties. Many of these properties fall under the “Commercial Facilities Sector” in critical infrastructure, including entertainment and media, gaming (e.g., casinos) lodging, outdoor events, public assembly, commercial real estate, retail locations and sports leagues.
• Consumer Staples: Includes businesses that provide essential goods and services required for daily living. Many of these companies fall under the food and agriculture or critical manufacturing critical infrastructure sectors.
• Utilities: Electricity, oil, and natural gas fall under the Energy Sector. Water and Wastewater have their own sector. All of these are crucial for daily life and the sustainment of the other critical infrastructure sectors.

Why Does this Matter?

Mid-market companies, with their significant contributions to these key sectors, form a key pillar that sustains and advances critical infrastructure. Their agility, innovation, and localized knowledge position them uniquely to adapt to and support the nation’s ever-evolving needs.

Yet many company owners may not recognize how their companies contribute to critical infrastructure, the roles they play, and the resources available.

What’s Next?

Want to learn more about how CrisisLead can help your company navigate risk and prepare for what’s next? Contact Us! We offer coaching, consulting, training and more to help your business.

In my next article, I’ll take a closer look at some of the resources CISA provides to support the security of critical infrastructure.

---

[i] JP Morgan Chase (n.d.). Next Street: The Middle Matters. Available at https://www.jpmorgan.com/content/dam/jpmorgan/documents/cb/insights/banking/commercial-banking/next-street-the-middle-matters-report.pdf. Accessed 27 January 2025

[ii] Griffin III, J and Pond, M. (18 September 2024). Understanding the potential of middle market companies. https://www.blackrock.com/us/financial-professionals/insights/understanding-middle-market-companies#:~:text=As%20reflected%20in%20Exhibit%202,and%20business%20and%20financial%20services. Accessed 27 January 2025.

[iii] Cybersecurity and Infrastructure Security Agency. (n.d.) Critical Infrastructure Sectors. Available at: https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors.  Accessed 27 January 2025