I would point out that the United States, as a clear example, has an non-exhaustive list. It's exhaustive in that it's very long, but it's non-exhaustive in that they can add more to it if they want to. I would argue that they don't have a clearly defined definition for “national security”. What they have done is list their sensitive industries or sectors that they're going to be concerned about. If another sector comes up, as Mr. Halucha said, the threats change and they'll add that to the list.
On May 21st, 2013. See this statement in context.