U.S. Fire Administration

The Critical Infrastructure

Protection Process Job Aid

Emergency Management and ResponseInformation Sharing and Analysis Center

FA-313

2nd Edition: August 2007

Table of Contents

I. Introduction 1

A.	 Job Aid Purpose	 1

B.	 Background	 1

C.	 EMR-ISAC Goals		 2

D.	 EMR-ISAC Major Tasks	 2

E.	 EMR-ISAC Information Dissemination	 3

F.	 Glossary	 3

II. CIP Overview 7

A.	 Premise	 7

B.	 Objectives	 8

C.	 Additional Considerations	 8

D.	 CIP Process Review	 9

III. CIP Process Methodology 11

A.	 Identifying Critical Infrastructures	 11

B.	 Determining the Threat	 12

C.	 Analyzing the Vulnerabilities	 14

D.	 Assessing Risk	 15

E.	 Applying Protective or Resiliency Measures	 17

IV. CIP Process Question Navigator 19

V. Infrastructure Protection Decision Matrix 21

VI. Establishing A CIP Program 23

A.	 Justification	 23

B.	 Program Manager	 23

C.	 Program Developmentand Management	 24

D.	 Contact Information	 25



I. Introduction

A. Job Aid Purpose

This Job Aid isa guideto assist leaders of the Emergency

Services Sector (ESS) with the process ofcritical infrastructure protection (CIP).

The document intends only to providea model process

or templatefor thesystematic protection ofcritical infrastructures.

It is nota CIP training manual oracompleteroad map

of procedures to bestrictly followed.

The CIP process described in this documentcan beeasily adapted to assist theinfrastructure protection objectives ofany community, service, department,agency, or

organization.

B. Background

Homeland Security Presidential Directive – 7 (December 2003)

established therequirement to protect nationalcritical infrastructuresagainstacts that would diminish theresponsibility of

federal, state,and local government to perform essential missions

to ensurethe health and safety of the general public. HSPD-7

identified the Emergency Servicesasa nationalcritical infrastructuresector that must be protected from all hazards. The

Emergency Managementand Response—Information Sharing and Analysis Center (EMR-ISAC)activities support the

critical infrastructure protection and resilience of Emergency

Services Sector departmentsand agencies nationwide. The fire

service,emergency medical services, law enforcement,emergency

management,and 9-1-1 Call Centersarethe majorcomponents

of the Emergency Services Sector. Thesecomponents include

search and rescue, hazardous materials (HAZMAT) teams,

special weaponsand tactics teams (SWAT), bomb squads,and

otheremergency support functions.

•

•

•

•


C. EMR-ISAC Goals

Promoteawareness of thethreats to and vulnerabilities

of Emergency Services Sector (ESS)critical infrastructures viasector-wideinformation sharing.

Encourage ESS prevention, protection,and resilience

actions forall hazards, including man-madeand natural

disasters.

Enhancesurvivability,continuity,and “response-ability”

in all-hazardsenvironments.

D. EMR-ISAC Major Tasks

Collectcritical infrastructure protection and resilience

information having potential relevancefor Emergency

Services Sector (ESS) departmentsand agencies.

Analyzeallcollected information to ascertain its importanceand applicability to ESS organizations.

Synthesizeand disseminateemergentand consequential

infrastructure protection and resilienceinformation

for theleaders, owners,and operators of theemergency

services.

Expedite distribution of Department of Homeland

Security (DHS)all-sourcethreat information to the

validated ESS senior leaders.

Develop instructional materials for CIP implementation

and training needs.

Provide professionalassistanceto ESS CIP practitioners

via phone,e-mail, facsimile,and a web site.

•

•

•

•

•

•

•

•

•


E. EMR-ISAC Information Dissemination

CIP (FOUO) Notices. Contain vital,actionable

information published by the Department of Homeland Security (DHS)as needed regarding threatsand

vulnerabilities potentially affecting emergency plansand

operations. (Forwarded For Official Use Only by those

in vetted ESS leadership positions.)

CIP INFOGRAMs. Contain four shortarticles issued

weekly about protecting thecritical infrastructures of

emergency respondersand theircommunities.

CIP Bulletins. Contain timely homeland security information distributed as needed involving theinfrastructure protection of theemergency services.

CIP Video. DVD reviews the practice of CIP and the

role of the EMR-ISAC.

CIP Job Aid. Briefly explains how to practice CIP in a

time-efficientand resource-restrained manner.

Homeland Security Advisory System Guide. Provides recommendations for probable ESS actions before

and during each level of thesystem.

F. Glossary

The definitions in this glossary are derived from language

enacted in Federal lawsand used in national plans, including

the National Infrastructure Protection Plan, National Incident

Management System,and National Response Plan.

All Hazards. An approach for prevention, protection,

preparedness, response,and recovery thataddressesafull

range of threatsand hazards, including domesticterroristattacks, naturaland man-made disasters,accidental

disruptions,and otheremergencies.

•

•

•

•

•

•

•


Critical Infrastructure. People,assets, systems,and

networks, whether physical or virtual, so vital to the

United States that their incapacity or destruction will

havea debilitating impact on security, the nation’s

economy, public health or safety, oracombination of

those matters.

Critical Infrastructure Protection (CIP). CIP consists of the proactiveactivities to protect theindispensable people, physicalassets,and communication/cyber

systems from any degradation or destruction caused by

all hazards.

Emergency Services Sector. A system of preparedness,

response,and recovery elements that forms the nation’s

first line of defensefor preventing and mitigating therisk

from man-madeand natural disasters.

Emergency Support Function. A grouping of governmentand certain privatesectorcapabilities into an organizational structureto providethesupport, resources,

and programs needed to savelives, protect property,and

restoreessential servicesand critical infrastructurefollowing domesticincidents.

Hazard. Something that is potentially dangerous or

harmful, often therootcause ofan unwanted outcome.

Mitigation. Activities designed to reduce oreliminate

risks to persons or property or to lessen theactual or

potentialeffects orconsequences ofan incident.

Preparedness. Therange of deliberate,critical tasksand

activities necessary to build, sustain,and improvethe operationalcapability to prevent, protectagainst, respond

to,and recover from incidents.

Prevention. Actions taken to avoid an incident or interveneto stop an incident from occurring.

•

•

•

•

•

•

•

•


Protection. Actions to mitigatethe overall risk to critical infrastructure people,assets, systems, networks,and

functions,and their interconnecting links, from exposure, injury, destruction, incapacitation, orexploitation.

Risk. The measure of potential harm from an all-hazards threat.

Resiliency. Thecapability of people,assets,and systems

to maintain functions during a disaster,and to expeditiously recoverand reconstituteessential servicesafteran

all-hazardsevent.

Threat. Theintention and capability ofan adversary

(i.e., peopleand nature) to undertakeactions that would

be detrimental to critical infrastructures.

Vulnerability. A weakness or flaw in an infrastructure

that renders it susceptibleto exploitation, disruption,

damage, or incapacitation by all hazards.

•

•

•

•

•



II. CIP Overview

A. Premise

Attacks on the personnel, physicalassets,and communication/cyber systems of Emergency Services Sector (ESS)

departmentsand agencies will weaken performance of

mission essential tasks or prevent operationsentirely.

People(e.g., terrorists,

criminals, delinquents,

employees, hackers,etc.),

nature(e.g., hurricanes,

tornadoes,earthquakes,

floods, wildfires,etc.);

and hazardous materials

(HAZMAT)accidents

involving chemical,

biological, radiological, or

nuclear substancesarethe

primary sources ofattacks

on critical infrastructures.

•

•

•

•

•

Attacks	on	ESS	personnel,	

physical	assets,	and	communication/cyber	systems	

are	serious	threats	to	the	

survivability,	continuity,	

and	response-ability	of	

sector	personnel	and	their	

operations.

It	is	impossible	to	prevent	

all	attacks	(e.g.,	terrorism,	

natural	disasters)	against	

critical	infrastructures.

There	will	never	be	enough	resources	(i.e.,	dollars,	personnel,	time,	and	materials)	to	achieve	complete	protection	of	ESS	critical	infrastructures.


Therecan be no tolerancefor wasteand misguided

spending in the business ofcritical infrastructure protection (CIP).

B. Objectives

To prevent or mitigateattacks on ESS critical infrastructures by people(e.g., terrorists, hackers,etc.), by nature

(e.g., hurricanes, tornadoes,etc.),and by HAZMAT

accidents.

To protect the people, physicalassets,and communication/cyber systems thatareindispensably necessary for

survivability,continuity of operations, response-ability,

and mission success.

To providean analytical process to guidethesystematic

protection of ESS critical infrastructures by theapplication ofareliable decision sequencethatassists sector

leaders to determineexactly what needs protection and

when security measures must occur.

To provideatime-efficientand resource-restrained practiceto ensurethe protection of only thoseinfrastructures

thatarecritical for survivability,continuity of operations, response-ability,and mission success.

C. Additional Considerations

From a municipal perspective, CIP is primarily about

protecting thoseinfrastructures unquestionably necessary for thecontinuity ofcrucialcommunity services

upon which citizen survivability depends.

For Emergency Services Sector (ESS) departmentsand

agencies,critical infrastructure protection (CIP) is foremostabout protecting thoseinternal infrastructuresabsolutely required for thesurvivability ofemergency first

respondersand the preservation of their response-ability.

•

•

•

•

•

•

•


CIP can beatool to producean American “mind-set”

of protection awarenessand confidencein our nation’s

security and prosperity. Given these new thoughts, it

may evokecitizen behaviors thatarefully supportiveand

cooperative with necessary protective measures.

CIP may also bea means to changethe behavior of

terrorists. The proper protection of American critical

infrastructures has the potential to develop a new “mindset”among terrorists that theiractions will befutileand

not yield theresults they seek.

D. CIP Process Review

CIP involves theapplication ofasystematicanalytical

process fully integrated into the plansand operations of

ESS departmentsand agencies.

It isasecurity related, timeefficient,and resource-restrained practiceintended to berepeatedly used by the

leaders of theemergency services.

The CIP processcan makea difference only ifapplied by

organizational leaders,and periodically reapplied when

there have been changes in key personnel, physicalassets,

communication/cyber systems, or the generalenvironment.

The CIP processconsists of thefollowing fivesteps:

1.	 Identifying critical infrastructures that must remain

continuously intactand operational to accomplish ESS

missions (e.g., firesuppression,emergency medical services, law enforcement, HAZMAT, search and rescue,

emergency management,and 9-1-1).

2.	 Determining the threat by all hazardsagainst those

critical infrastructures.

3.	 Analyzing the vulnerabilities or weaknessesexisting in

thethreatened critical infrastructures.

•

•

•

•

•

•
4.	 Assessing risk of the degradation or loss ofcredibly

threatened and vulnerablecritical infrastructures.

5.	 Applying protective or resiliency measures whererisk is

unacceptableto prevent thethreat, protect thecredibly

threatened and vulnerablecritical infrastructures, orensuretherapid restoration ofcritical infrastructuresafter

an all-hazardsattack.
III. CIP Process Methodology

A. Identifying Critical Infrastructures

1.	 Identifying critical infrastructures is the first step of the

CIP process.

2.	 Theremaining steps of the CIP processcannot beinitiated without theaccurateidentification ofan organization’scriticalcomponents.

3.	 ESS critical infrastructuresarethose personnel, physicalassets,and communication/cyber systems thatare

indispensably essential for thesurvivability,continuity of

operations, response-ability,and mission success of ESS

departmentsand agencies.

4.	 Critical infrastructuresarethe people, things, or systems

that will seriously degrade or prevent survivability,continuity, response-ability,and mission success if they are not

continuously intactand operational.

5.	 Thefollowing aresomeexamples of potential ESS critical

infrastructures:

a.	 Firefighters, police, paramedics,and emergency medical

technicians.

b.	 Fire, police,and emergency medical vehicles,equipment,

stations,and communications systems.

c.	 Computer-aided dispatch and computer networks.

d.	 9-1-1 Centers (Public Safety Answering Points).

e.	 Water pumping stationsand distribution systems.

f.	 Major roadsand highways.

g.	 Key bridgesand tunnels.

h.	 Localand regional medical facilities.
6.	 Despite many similarities, the differences in personnel, physicalassets,and communication/cyber systems

among individual ESS departmentsand agencies necessitatethat senior leaders identify their own critical infrastructures.

7.	 Remember that protection measurescannot beimplemented if what needs protection is unknown!

8.	 Following the disasters in New York City (September

2001)and New Orleans (August 2005), ESS organizations in thosetwo citiescontinued to servetheircitizens. 

However, theirability to do so was tremendously degraded fora period of time given the unprecedented losses of

first respondercritical infrastructures.

B. Determining the Threat

1.	 Determining thethreat from all hazards (e.g., terrorists,

criminals, hurricanes, tornadoes,earthquakes, floods,

wildfires,etc.)against identified critical infrastructures is

thesecond step of the CIP process.

2.	 A threat is the potential foran attack from people or

nature oracombination of these. Italso includes the

probability ofa HAZMAT accident.
3.	 Theremaining steps of the CIP process depend upon

whether or notan organization’scritical infrastructures

arethreatened.

4.	 Threeexamples ofcrediblethreatsagainst ESS critical

infrastructures:

a.	 National intelligencesources warn that suspected terrorists may attempt to drivea vehicle-borneimprovised explosive deviceinto the police headquarters ofalargecity. 

(Thisexample demonstratesaterrorist threatagainstall

components ofa police department’scritical infrastructures.)

b.	 Policeciteincreasing incidents of individuals breaking

into fire departments to steal valuableequipmentand

damageapparatus. (Thisexample demonstratesacriminal threatagainst the physicalassets ofa fire department’s

critical infrastructures.)

c.	 The National Weather Serviceforecasted that theeastern

and southern coasts of the United States willexperience

eight major hurricanes between 1 Juneand 30 November. (Thisexample demonstratesa naturethreatagainst

allcritical infrastructurecomponents ofallemergency

departmentsand agencies in a designated area.)

5.	 A determination ofcrediblethreat must be madefor

each critical infrastructureidentified in step one.

6.	 If thereis no threat ofan attack against one ofan organization’scritical infrastructures, then the CIP processcan

stop herefor that particularasset.

7.	 When thereisacrediblethreat ofan attack againsta

department’scritical infrastructures, prior to proceeding to the next step of the CIP process, it is necessary

to determineexactly which critical infrastructuresare

threatened and by whom or what iseach of theseinfrastructures threatened.
8.	 Leaders should concentrate only on thosethreats that

will dangerously degrade or prevent survivability and

response-ability. 

9.	 Resources should beapplied to protect only thosecritical

infrastructuresagainst which acrediblethreatexists!

C. Analyzing the Vulnerabilities

1.	 Analyzing the vulnerabilities of only credibly threatened

infrastructuresisthethird step ofthe CIP process.

2.	 Thisstep requiresan examination ofthesecurity vulnerabilities(i.e.,weaknessesrendering theinfrastructures

susceptibleto degradation or destruction)in each ofthe

threatened infrastructures determined in step 2 ofthe

CIP process. 

3.	 Therearetwo types of vulnerabilitiesto considerin the

CIP process:

a.	 Aweaknessin acritical infrastructurethat makestheinfrastructuresusceptibleto disruption orlossfrom an attack

by human adversaries.

b.	 Aweaknessin acritical infrastructurethatwill further

weaken orcompletely deteriorateasaresult ofa natural

disaster or HAZMATaccident.

4.	 An efficient vulnerability analysiswillexamine only the

credibly threatened infrastructuresfrom the“threat point

of view.” Thisis particularly usefulwhen trying to getinto

the minds ofterrorists orcriminalsto understand how

they think and,therefore, howtheywill behave.

5.	 Theanalysiswillseek to comprehend theways bywhich

threatsfrom adversaries, nature, or HAZMATaccidents

might disrupt or destroy theexamined infrastructure

because ofexisting vulnerabilities.
6.	 Thefollowing arethreeexamples of vulnerabilities:

a.	 An ESS facility is vulnerableif located in atornado-prone

area, but has not been engineered towithstand atornado. 

b.	 Emergency services personneland equipmentare vulnerableto injury, death,and destruction if not properly

trained to protectagainstsecondary explosionsatincidents

ofterrorism.

c. Emergency services personnelare vulnerableto acute

illness or death if not vaccinated for hepatitis, tetanus,

influenza,etc. 

7.	 Ifathreatened infrastructure has no vulnerabilities, then

the CIP processcan stop herefor that particularasset.

8.	 The CIP process should proceed to thefourth step only

for thosethreatened infrastructures having vulnerabilities.

9.	 The protection of threatened and vulnerableinfrastructuresand the mitigation orelimination ofexisting weaknessescannot beaccomplished without knowing what or

wherethe vulnerabilitiesare! 

D. Assessing Risk

1.	 Assessing risk of the degradation or loss ofacritical

infrastructureis thefourth step of the CIP process.

2. Threatened and vulnerablecritical infrastructures from

step 3 of the CIP processarea high priority forassessing

therisk of degradation or incapacitation. 

3. Focusing on each high priority infrastructure, decision

makers mustevaluatethecost of protective or resiliency

measures in terms ofavailableresources (e.g., personnel,

time, money,and materials).
4. The determined costs of protective or resiliency measures

(i.e., doing something) foreach high priority infrastructureare now weighed against theresults of the degradation or loss of that infrastructure(i.e., doing nothing and

accepting risk). 

5. Risk is unacceptableif theimpact of the degradation or

loss ofan infrastructure(i.e., from doing nothing) will

be potentially catastrophic.

6. Threeexamples of risk assessment follow:

a.	 ESS leadersassess that theincapacitation of their facility

in atornado-pronearea would seriously disruptcontinuity of operationsand response-ability and, therefore,

decidethat therisk is unacceptable. 

b.	 ESS chief officersassess that therisk of injury or death

from secondary explosionsat incidents of terrorism is too

great,and that doing nothing about this risk is unacceptable. 

c. Theemergency medical services (EMS) leadership assess

that thereis significant risk to EMS personnel foracute

illness or death from hepatitis, tetanus, influenza,etc. 

They determinethat something must be doneto protect

employeesagainst known pathogens.

7. If theimpact of the degradation or loss ofan infrastructureis notconsidered remarkable, then decision makers

can temporarily decideto accept risk and do nothing

until resources becomeavailable.

8. For theinfrastructures thatarerisk adverseand require

protection, the CIP process must proceed to the final

step for theimmediateapplication of protective or resiliency measures. 

9. Failureto assess risk can result in theinefficientapplication of resourcesand asubsequent reduction in operationaleffectiveness.
E. Applying Protective or Resiliency Measures

1.	 Applying protective or resiliency measures to credibly

threatened and vulnerablecritical infrastructures unacceptableto risk isthe fifth and laststep ofthe CIP process.

2.	 Protective or resiliency measuresareany actions that

prevent thethreat, protect thecredibly threatened and

vulnerablecritical infrastructure, orensuretheswift restoration ofcritical infrastructuresafteran all-hazardsattack.

3.	 Protective or resiliency measuresareapplied to high priority, risk-adverseinfrastructures that necessitatetheallocation of resources to preservetheability ofemergency

first responders to efficiently perform their services.

4.	 Community leaders should decidethe order in which

credibly threatened and vulnerablecritical infrastructures thatare unacceptableto risk will receivetheallocation of resourcesand application of protective or resiliency measures.

5.	 Possible protectiveand resiliency measures differ in

terms of feasibility,expense,and effectiveness. Additionally, they can besimple orcomplex actions limited only

by imagination and creativity.

6.	 Thefollowing arethreeexamples of protective or resiliency measures:

a.	 ESS leaders decidethat theincapacitation of their facility

in atornado-pronearea will unacceptably disruptcontinuity of operationsand response-ability and, therefore,

agreeto promptly acquiretheresources to alter thestructureto withstand atornado. 

b.	 ESS chief officers resolvethat therisk of injury or death

from secondary explosionsat incidents of terrorism is too

great. Consequently, they arrangefor the proper personnel training to prevent or protectagainst injury or death

from secondary explosions. 
c.	 Theemergency medical services (EMS) leadership determinethat thereis significant risk to EMS personnel for

acuteillness or death from hepatitis, tetanus, influenza,

etc. Asa protective measurethey ensurethatevery employee has been vaccinated against known pathogens.

7.	 In few instances, there may be no effective means to

protectacritical infrastructure. Sometimes, prohibitive

costs or other factors maketheapplication of protective

and resiliency measures impossible.

8.	 Decisions requiring theapplication of protectiveand

resiliency measures will influence personnel, time,and

material resources,and drivethesecurity budget.

9.	 High priority, risk-adverseinfrastructures should be

considered aloss to plansand operations if protective or

resiliency measures have not been implemented.
IV. CIP Process Question Navigator

DIRECTIONS: Asatime-efficient tactic when reviewing or

reapplying the CIP process,answer thefollowing questions for

each infrastructure of your department oragency. Alternatively,

usethe decision matrix seen at the next page.

Is the person, thing, or system part of the organization’s infrastructure?

If NO, stop. If YES,ask:

Is this infrastructureessential for survivability,continuity, and response-ability?

If NO, stop. If YES,ask:

Is there potential foran attack from people or natureagainst thiscritical infrastructure, including the probability fora

HAZMAT accident?

If NO, stop. If YES,ask:

Is thethreat ofan attack against thiscritical infrastructurea

truly credible one?

If NO, stop. If YES,ask:

Is thereasecurity vulnerability (or weakness) in thethreat- ened critical infrastructure?

If NO, stop. If YES,ask:

Does this vulnerability (or weakness) render thecritical

infrastructuresusceptibleto disruption or loss?

If NO, stop. If YES,ask:

Is itacceptableto assumerisk and delay theallocation of

resourcesand theapplication of protective or resiliency

measures?

If YES, stop. If NO, then:

Apply protective or resiliency measures to protect thiscritical infrastructureas soon asavailableresources permit.

•

•

•

•

•

•

•

•

V. Infrastructure Protection Decision Matrix

DIRECTIONS: Completethe matrix foreach infrastructure

of your department oragency.

Is the infrastructure a critical one?

Yes No.		Stop	here.

Is the critical infrastructure threatened?

Yes No. Stop here.

Is the critical infrastructure vulnerable?

Yes No. Stop here.

Is risk of degradation or loss acceptable?

Yes

Stop here.

Or

Delay protective measures.

No

Apply protective measures.

Or

Resource for future

protective measures.

VI. Establishing a CIP Program

A. Justification

A quality CIP program supports the protection or

resiliency of the people, physicalassets,and communication/cyber systems upon which survivability,continuity

of operations, response-ability,and mission accomplishment depend. 

Thethreat of domesticand transnational terrorism

should provide ESS leaders with sufficient justification to

implementa CIP program within their organizations.

If thethreat of terrorism itself does not motivateaction,

then remember that the CIP processcan also mitigate or

eliminatethe degradation or destruction of ESS departmentsand agenciescaused by natureand HAZMAT

accidents.

The CIP program should beintegrated asacomponent

part ofan organization’s security and emergency preparedness plans,as wellas theconduct of operations.

B. Program Manager

Critical infrastructure protection is primarily leader

business. Theemergency department oragency chief,

commander, or directorappointsa program manager

from among thesenior leadership of the organization.

The program manager performs thefollowing functions:

1.	 Administer the CIP program and maintains its value,

relevance,and currency.

2.	 Prepare, obtain approval for,and publish the program’s

purpose, strategic goals,and immediate objectives.

3.	 Lead theeffort to acquiretheresources necessary to

implement protective or resiliency measures.

•

•

•

•

•

•
4.	 Initiateactions that provide protection or resiliency for

the organization’scritical infrastructuresagainstall hazards. 

C. Program Development and Management

Theemergency department oragency chief,commander,

or director institutes the organization’s CIP program

and delegatesauthority to a manager.

Thefollowing program developmentand management

stepsarerecommended:

1.	 Select the program manager from among thesenior decision makers of the organization.

2.	 Firmly establish therelationship between the organization’s mission and the purposeforcritical infrastructure

protection.

3.	 Acquirethesupport of the department seniorand junior

leadership,and orient the CIP program primarily to

them.

4.	 Focus the program on the practice of the CIP process

contained in this guide.

5.	 After determining which critical infrastructuresarerisk

adverse(i.e., the outcome of step 4 of the CIP process),

aggressively seek theresources required to apply protective or resiliency measuresas soon as possible.

6.	 Revisethe department security and emergency preparedness plans to includethe CIP program and thecritical

infrastructures that demand protective or resiliency

measures.

7.	 Briefall department personnel regarding therevised

plansand ensureawareness ofactions they can taketo

supportapplied protective or resiliency measures.

•

•
8.	 Practice operations security (i.e., protecting sensitive

information)concurrently with CIP.

9.	 Remain vigilant for threatadvisoriesand new CIP

trends, methods,and conditions disseminated by the

EMR-ISAC.

10.	 Maintain the program by reapplying the CIP process

when there have been changes in key personnel, physical

assets,communication/cyber systems,and the general

environment; however,attempt to do so at least semi-annually.

D. Contact Information

The Emergency Managementand Response—Information

Sharing and Analysis Center (EMR-ISAC) will provide CIP

consultation orassistance(viatelephone,electronic mail, or

facsimile) to any emergency organization practicing the CIP

process orestablishing a CIP program. Contact the EMR-ISAC

at 301-447-1325, or by electronic mailatemr-isac@dhs.gov. 

Interested personnelcan also visit the EMR-ISAC web siteat

http://www.usfa.dhs.gov/emr-isac. This information iscurrent

as of August 2007.


EMR-ISAC

16825 South Seton Avenue

Emmitsburg, MD 21727

301-447-1325

emr-isac@dhs.gov 

www.usfa.dhs.gov/emr-isac