So businesses that support or partner with companies and federal agencies from the listed as part of the critical infrastructure sector could be designated as well. "I think that you could see a variety of other industries getting sucked into the definition of critical infrastructure," Serwin said.
It's unclear yet what risk criteria the federal agencies will use to identify entities, he said. "But you could see a scenario where any business of a certain size" could be considered critical.
Obama's order does not require private sector owners and operators of critical infrastructure to adopt any of the new security standards and best practices. But they will be pressured to adopt them anyway from a due diligence standpoint, Serwin maintained.
"There are huge brand issues with cybersecurity and privacy," Serwin said. "If you are in a designated critical infrastructure category, you don't want to be the company that didn't follow the recommendations."
A wide range of companies from the health care, IT, financial services and other sectors need to determine whether they could be designated as part of the critical infrastructure sector under the executive order, said David Ransom, a partner at law firm McDermott Will & Emery.
The DHS secretary appears to have been given wide latitude to designate critical infrastructure under the order, Ransom said. The language leaves open the possibility that a wide range of private sector entities from a spectrum of industries could get classified as critical infrastructure.
"What their view is going to be remains to be seen," he said.
The executive order's open-ended definition of critical infrastructure gives the DHS and sector specific federal agencies the ability "to cast a wide net in the process of identifying which companies and their associated assets and systems might be included within their statutory capacity," said John South, chief security officer at Heartland Payment Systems.
The key question though is whether broadening the list of companies will make much of a difference in heading off cybersecurity threats, South said.
Efforts to define critical infrastructure entities goes back as far as 1998 at least, he noted. Considerable progress has already been made in identifying information sharing capabilities of the sort described in the executive order, South added.
"Nothing in this directive clarifies what timely information sharing is and how this differs from where we are currently," he said. "If there is no substantive product that provides actionable, timely intelligence - regardless of how wide the net of critical infrastructure is cast - we haven't advanced very much."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at 
@jaivijayan, or subscribe to Jaikumar's RSS feed 
. His e-mail address is jvijayan@computerworld.com.
Read more about Security in Computerworld's Security Topic Center.
Free Insider GuideCopyright © 1994 - 2013 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
