On a risk-based assessment these are typically central, clearly bounded nodes:
- substations and switchgear (energy)
- waterworks and pumping stations (water)
- data centres and exchanges (telecommunications)
- hospitals and laboratories (health)
- traffic control centres and signalling (transport)
These facilities have defined site boundaries and controllable access points, so physical security measures can be implemented effectively. How much protection is actually needed follows from your individual risk analysis.