Critical Infrastructure: Challenges Remain in Protecting Key Sectors
Published: 2007-03-20T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: As Hurricane Katrina so forcefully demonstrated, the nation's critical infrastructures--both physical and cyber--have been vulnerable to a wide variety of threats. Because about 85 percent of the nation's critical infrastructure is owned by the private sector, it is vital that the public and private sectors work together to protect these assets. The Department of Homeland Security (DHS) is responsible for coordinating a national protection strategy including formation of government and private sector councils as a collaborating tool. The councils, among other things, are to identify their most critical assets, assess the risks they face, and identify protective measures, in sector-specific plans that comply with DHS's National Infrastructure Protection Plan (NIPP). This testimony is based primarily on GAO's October 2006 sector council report and a body of work on cyber critical infrastructure protection. Specifically, it addresses (1) the extent to which these councils have been established, (2) key facilitating factors and challenges affecting the formation of the council, (3) key facilitating factors and challenges encountered in developing sector plans, and (4) the status of DHS's efforts to fulfill key cybersecurity responsibilities. GAO has made previous recommendations, particularly in the area of cybersecurity that have not been fully implemented. Continued monitoring will determine whether further recommendations are warranted.
section_title: What GAO Found
paragraphs: To better coordinate infrastructure protection efforts as called for in the NIPP, all 17 critical infrastructure sectors have established their respective government councils, and nearly all sectors have initiated their voluntary private sector councils. But council progress has varied due to their characteristics and level of maturity. For example, the public health and healthcare sector is quite diverse and collaboration has been difficult as a result; on the other hand, the nuclear sector is quite homogenous and has a long history of collaboration. As a result, council activities have ranged from getting organized to refining infrastructure protection strategies. Ten sectors, such as banking and finance, had formed councils prior to development of the NIPP and had collaborated on plans for economic reasons, while others had formed councils more recently. As a result, the more mature councils could focus on strategic issues, such as recovering after disasters, while the newer councils were focusing on getting organized. Council members reported mixed views on what factors facilitated or challenged their actions. For example, long-standing working relationships with regulatory agencies and within sectors were frequently cited as the most helpful factor. Challenges most frequently cited included the lack of an effective relationship with DHS as well as private sector hesitancy to share information on vulnerabilities with the government or within the sector for fear the information would be released and open to competitors. GAO's past work has shown that a lack of trust in DHS and fear that sensitive information would be released are recurring barriers to the private sector's sharing information with the federal government, and GAO has made recommendations to help address these barriers. DHS has generally concurred with these recommendations and is in the process of implementing them. All the sectors met the December 2006 deadline to submit their sector-specific plans to DHS, although the level of collaboration between the sector and government councils on the plans, which the NIPP recognizes as critical to establishing relationships between the government and private sectors, varied by sector. Issuing the NIPP and completing sector plans are only first steps to ensure critical infrastructure is protected. Moving forward to implement sector plans and make progress will require continued commitment and oversight. While DHS has initiatives under way to fulfill its many cybersecurity responsibilities, major tasks remain to be done. These include assessing and reducing cyber threats and vulnerabilities and coordinating incident response and recovery planning efforts. Effective leadership by the Assistant Secretary for Cyber Security and Telecommunications is essential to DHS fulfilling its key responsibilities, addressing the challenges, and implementing recommendations.

section_title: Letter
paragraphs: Thank you for inviting us to participate in today’s hearing on infrastructure  protection issues. The nation’s critical infrastructures and key resources— including those cyber and physical assets essential to national security,  national economic security, and national public health and safety—have  been and continue to be vulnerable to a wide variety of threats. In 2005,  Hurricane Katrina devastated the Gulf Coast, damaging critical  infrastructure such as oil platforms, pipelines, and refineries; water mains;  electric power lines; and cellular phone towers. The chaos resulting from  this infrastructure damage disrupted the functioning of government and  business alike and produced cascading effects far beyond the physical  location of the storm. In 2004, authorities discovered a plan to target  financial institutions in New York, and in 2005 suicide bombings struck  London’s public transportation system, disrupting the city’s transportation  and mobile telecommunications infrastructure. Because the private sector  owns approximately 85 percent of the nation’s critical infrastructure— such as banking and financial institutions, telecommunications networks,  and energy production and transmission facilities—it is vital that the  public and private sectors form effective partnerships to successfully  protect these assets.
A key player in these partnerships is the Department of Homeland Security  (DHS). The Homeland Security Act of 2002 created DHS and gave it wide- ranging responsibilities for leading and coordinating the overall national  critical infrastructure protection effort. The act required DHS to develop a  comprehensive national plan for securing the nation’s critical  infrastructures and recommend measures to protect key resources.  Homeland Security Presidential Directive 7 (HSPD-7) further defined  critical infrastructure protection responsibilities for DHS and those federal  agencies given responsibility for particular industry sectors, such as  transportation, energy, and telecommunications, known as sector-specific  agencies. DHS is to establish uniform policies, approaches, guidelines, and  methodologies to help ensure that critical infrastructure within and across  the 17 infrastructure sectors is protected, and is to use a risk management  approach to coordinate protection efforts. This includes using risk  assessments to set priorities for protective measures by the department;  sector-specific agencies; tribal, state, and local government agencies and  authorities with critical assets and resources in their jurisdiction, owners  and operators of these assets; and other entities.
HSPD-7 required DHS to develop a comprehensive and integrated plan by  December 2004 that outlines national protection goals, objectives,  milestones, and key initiatives necessary to fulfilling these responsibilities.  In response, DHS developed the National Infrastructure Protection Plan  (NIPP). Issued in June 2006, the NIPP is a base plan that is to serve as a  road map for how DHS and other relevant stakeholders should use risk  management principles to prioritize protection activities within and across  sectors in an integrated, coordinated fashion. In particular, the NIPP  required the individual sector-specific agencies, working with relevant  government and private sector representatives, to submit plans to DHS by  the end of December 2006 that would establish the means by which the  sectors will identify their critical assets, assess risks of terrorist attacks or  other hazards on them, assess and prioritize those which have national  significance, and develop protective measures for the sector. DHS is to use  these individual plans to evaluate whether any gaps exist in the protection  of critical infrastructures on a national level and, if so, to work with the  sectors to address the gaps. defense industrial base; drinking water and water treatment systems; emergency services;  energy; government facilities; information technology; national monuments and icons;  postal and shipping; public health and health care; telecommunications; and transportation  systems. Critical infrastructure are systems and assets, whether physical or virtual, so vital  to the United States that their incapacity or destruction would have a debilitating impact on  national security, national economic security, and national public health or safety, or any  combination of those matters. Key resources are publicly or privately controlled resources  essential to minimal operations of the economy or government, including individual targets  whose destruction would not endanger vital systems but could create a local disaster or  profoundly damage the nation’s morale or confidence. For purposes of this report, we will  use the term “critical infrastructure” to also include key resources. planning and implementing efforts to protect critical infrastructure, and  are envisioned to focus on policy issues.
My testimony today highlights four key areas from our previously issued  work: (1) the extent to which sectors have established councils, (2) the  key facilitating factors and challenges that critical infrastructure  protection stakeholders encountered in establishing their respective  councils, (3) the key facilitating factors and challenges sectors  encountered in developing their sector-specific plans, and (4) the status of  DHS’s efforts to fulfill key cybersecurity responsibilities and challenges.  My comments today are based on GAO’s October 2006 report addressing  the progress made in coordinating government and private sector efforts  to establish councils and develop sector-specific plans and on a body of  GAO work related to cyber critical infrastructure protection that has been  designated as a GAO high-risk area since 2003. GAO’s October 2006 report  was based on work conducted at the Departments of Agriculture, Defense,  Energy, Health and Human Services, Homeland Security, Interior, and  Treasury; the Environmental Protection Agency; as well as with private  sector representatives of 14 councils. We conducted our work in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
subsections: section_title: Critical Infrastructure Protection Policy Has Emphasized Government and Private Sector Coordination
paragraphs: The protection of the nation’s critical infrastructure against natural and  man-made catastrophic events has been a concern of the federal  government for over a decade. For example, in May 1998, Presidential  Decision Directive 63 (PDD-63) established critical infrastructure  protection as a national goal and presented a strategy for cooperative  efforts by the government and the private sector to protect it.
In December 2003, HSPD-7 was issued, defining responsibilities for DHS  and federal agencies responsible for addressing specific critical  infrastructure sectors. These agencies are to identify, prioritize, and  coordinate the protection of critical infrastructure to prevent, deter, and  mitigate the effects of attacks. DHS is to, among other things, coordinate  national critical infrastructure protection efforts, establish uniform  policies, approaches, guidelines, and methodologies for integrating federal  infrastructure protection and risk management activities within and across  sectors; and provide for the sharing of information essential to critical  infrastructure protection. According to the NIPP, DHS is also to develop  and implement comprehensive risk management programs and  methodologies, develop cross-sector and cross-jurisdictional protection  guidance, recommend risk management and performance criteria and  metrics within and across sectors, and establish structures to enhance the  close cooperation between the private sector and government at all levels.
In addition, DHS is the focal point for the security of cyberspace— including analysis, warning, information sharing, vulnerability reduction,  mitigation and recovery efforts for public and private critical  infrastructure information systems. To accomplish this mission, DHS is to  work with other federal agencies, state and local governments, and the  private sector. Federal policy further recognizes the need to prepare for  debilitating Internet disruptions and—because the vast majority of the  Internet infrastructure is owned and operated by the private sector—tasks  DHS with developing an integrated public/private plan for Internet  recovery.
section_title: Sector-Specific Agencies Are to Coordinate Protection Efforts and Develop Plans
paragraphs: HSPD-7 designated sector-specific agencies for each of the critical  infrastructure sectors, responsible for coordinating and collaborating with  relevant federal agencies, state and local governments, and the private  sector, and facilitating the sharing of information about threats,  vulnerabilities, incidents, potential protective measures, and best  practices. Agencies must submit an annual report to DHS on their efforts.  DHS serves as the sector-specific agency for 10 of the sectors: information  technology; telecommunications; transportation systems; chemical;  emergency services; commercial nuclear reactors, material, and waste;  postal and shipping; dams; government facilities; and commercial  facilities. (See table 1 for a list of sector-specific agencies and a brief  description of each sector).
Under the NIPP, the sector-specific agencies, in coordination with their  respective government and private sector councils, are responsible for  developing individual protection plans for their sectors that, among other  things, (1) define the security roles and responsibilities of members of the  sector, (2) establish the methods that members will use to interact and  share information related to protection of critical infrastructure, (3)  describe how the sector will identify its critical assets, and (4) identify the  approaches the sector will take to assess risks and develop programs to  protect these assets. DHS is to use these individual plans to evaluate  whether any gaps exist in the protection of critical infrastructures on a  national level and, if so, to work with the sectors to address these gaps.
section_title: Sectors Have Established Government and Sector Councils, Which are Generally Representative of their Sectors; Council Activities Have Varied Depending on Their Maturity and Other Characteristics
paragraphs: All of the sectors have established government councils, and voluntary  private sector councils under the NIPP model have been formed for all  sectors except transportation systems. The nature of the 17 sectors varies  and council membership reflects this diversity, but the councils are  generally comprised of representatives from the various federal agencies  with regulatory or other interests in the sector, some state and local  officials with purview over the sectors, and asset owners and operators.  Because some of the councils are newer than others, council activities  vary based on the council’s maturity and other characteristics, with some  younger councils focusing on establishing council charters, while more  mature councils focused on developing protection strategies.
subsections: section_title: Some Councils Formed in Response to the NIPP, While Others Formed Earlier because of Increased Vulnerabilities
paragraphs: Seven sectors had not formed either a government council or sector  council until after publication of an Interim NIPP in February 2005, while  10 of the sectors had done so. These 10 sectors said they recognized the  need to collaborate to address risks and vulnerabilities that could result in  economic consequences for their sectors. For example, prior to the  development of the NIPP, DHS and the Department of Agriculture had (1)  established a government coordinating council for the agriculture and  food sector to coordinate efforts to protect against agroterrorism, and (2)  helped the agriculture and food sector establish a private sector council to  facilitate the flow of alerts, plans, and other information. As of March 2007,  the transportation systems sector had yet to form a sector council, but a  DHS Infrastructure Protection official said each transportation mode— such as rail, aviation, and maritime—had established a sector council.  According to DHS officials, once the modes are organized, the  transportation systems council will be formed. Transportation Security  Administration (TSA) officials attributed the delay to the heterogeneous  nature of the transportation sector—ranging from aviation to shipping to  trucking.
section_title: Council Leaders Believe That Their Memberships Are Generally Representative of Government Agencies with Purview over the Sectors and Are Generally Representative of Asset Owners and Operators
paragraphs: The composition, scope, and nature of the 17 sectors themselves vary  significantly, and the memberships of their government and sector  councils reflect this diversity. The enormity and complexity of the nation’s  critical infrastructure require council membership to be as representative  as possible of their respective sectors. As such, council leaders— government sector representatives and private council chairs—believe  that their membership is generally representative of their sectors.  Government councils include representatives from various federal  agencies with regulatory or other interests in the sectors. For example, the  chemical sector council includes officials with DHS; the Bureau of  Alcohol, Tobacco, Firearms and Explosives; the Department of  Commerce; the Department of Justice; the Department of Transportation;  and the Environmental Protection Agency because each has some interest  in the sector. Some government councils also include officials from state  and local governments with jurisdiction over entities in the sector.
Private sector council membership varies, reflecting the unique  composition of entities within each, but is generally representative of a  broad base of owners, operators, and associations—both large and  small—within a sector. For example, members of the drinking water and  water treatment systems sector council include national organizations  such as the American Water Works Association and the Association of  Metropolitan Water Agencies and also members of these associations that  are representatives of local entities including Breezy Hill Water and Sewer  Company and the City of Portland Bureau of Environmental Services. In  addition, the commercial facilities sector council includes more than   200 representatives of individual companies spanning 8 different  subsectors, including public assembly facilities; sports leagues; resorts;  lodging; outdoor events facilities; entertainment and media; real estate;  and retail. This provides the councils opportunities to build the  relationships needed to help ensure critical infrastructure protection  efforts are comprehensive.
section_title: While Newer Councils Are Just Forming, More Mature Councils Are Addressing Long-Term Strategies
paragraphs: Council activities have varied based on the maturity of the councils.  Because some of the councils are newer than others, council meetings  have addressed a range of topics from agreeing on a council charter to  developing industry standards and guidelines for business continuity in the  event of a disaster or incident. For example, the commercial facilities  government council, which formed in 2005, has held meetings to address  operational issues—such as agreeing on a charter, learning what issues are  important to the sector, learning about risk management tools, and  beginning work on the sector-specific plan. Councils that are more mature  have been able to move beyond these activities to address more strategic  issues. For example, the banking and finance sector council, which formed  in 2002, focused its efforts most recently on strengthening the financial  system’s ability to continue to function in the event of a disaster or  incident (known as “resilience”), identifying a structured and coordinated  approach to testing sector resilience, and promoting appropriate industry  standards and guidelines for business continuity and resilience.
section_title: Good Prior Working Relationships, Willingness to Share Critical Information, and Sufficient Resources Are Key to Council Formation and Progress
paragraphs: Government and sector council representatives most commonly cited  long-standing working relationships between entities within their  respective sectors and with the federal agencies that regulate them, the  recognition among some sector entities of the need to share infrastructure  information with the government and within the sector, and operational  support from DHS contractors as factors that facilitated council formation.  However, these representatives also most commonly identified several key  factors that posed challenges to forming some of the councils, including  (1) difficulty establishing partnerships with DHS because of issues  including high turnover of its staff and DHS staff who lacked knowledge  about the sector to which they were assigned, (2) hesitancy to provide  sensitive information or industry vulnerabilities to the government due to  concerns that the information might be publicly disclosed, and (3) lack of  long-standing working relationships within the sector or with federal  agencies.
subsections: section_title: Recognizing the Need to Work Together; Share Information, and Obtain Support Were Most Common Factors That Helped Facilitate Council Development
paragraphs: One of the factors assisting the formation of many of the government and  sector councils was the existence of long-standing working relationships  within the sectors and with the federal agencies that regulate them. Ten of  the sectors had formed either a government council or private sector  council that addressed critical infrastructure protection issues prior to  publication of an Interim NIPP. In addition, according to government and  sector council representatives, sectors in which the industries have been  highly regulated by the federal government—such as the banking and  finance sector as well as the commercial nuclear sector—were already  used to dealing with the federal government on many issues. Therefore,  forming a relationship between the government and the private sector and  within the sector was not very difficult.
The availability of DHS contractors that provided administrative and other  assistance—such as meeting planning, developing materials, recording and  producing minutes, delivering progress reports, and supporting  development of governance documents—to the government and sector  councils was a third facilitating factor cited by representatives of 13  government and 5 sector councils. For example, representatives of the  emergency services sector council and the telecommunications sector  council stated that some of the services were very helpful, including  guidance the contractors provided on lessons learned from how other  sector councils were organized.
section_title: Difficulties in Developing Partnerships with DHS, Concerns about Sharing Information, and the Lack of Long-Standing Working Relationships Were the Most Common Challenges to the Formation of Some Councils
paragraphs: Council representatives with three government and eight private sector  councils reported that they experienced problems forming their councils  due to a number of challenges establishing partnerships with DHS.  Specifically, these reported challenges included high turnover of staff,  poor communications with councils, staff who were unfamiliar with the  sector and did not understand how it works, shifting priorities that  affected council activities, and minimal support for council strategies.  DHS acknowledged that its reorganization resulted in staff turnover, but  according to DHS’s Director of the Infrastructure Programs Office within  the Office of Infrastructure Protection, this should not have affected  formation since DHS has taken a consistent approach to implementing the  partnership model and issuing guidance. However, the director  acknowledged that continuing staff turnover could affect the eventual  success of the partnerships because they are dependent on the  interactions and developing trust. Continuity of government staff is a key  ingredient in developing trusted relationships with the private sector.
Representatives with six government and five sector councils noted that  the private sector continues to be hesitant to provide sensitive information  regarding vulnerabilities to the government as well as with other sector  members due to concerns that, among other things, it might be publicly  disclosed. For example, these representatives were concerned that the  items discussed, such as information about specific vulnerabilities, might  be subject to public disclosure under the Federal Advisory Committee Act  and thereby be available to competitors or potentially make the council  members subject to litigation for failure to publicly disclose any known  threats or vulnerabilities.
This issue continues to be a long-standing concern and one that  contributed to our designating homeland security information sharing as a  high-risk issue in January 2005. We reported then that the ability to share  security-related information is critical and necessary because it can unify  the efforts of federal, state, and local government agencies and the private  sector in preventing or minimizing terrorist attacks. In April 2006, we  reported that DHS continued to face challenges that impeded the private  sector’s willingness to share sensitive security information with the  government. In this report, we assessed the status of DHS efforts to  implement the protected critical infrastructure information (PCII)  program created pursuant to the Homeland Security Act. This program  was specifically designed to establish procedures for the receipt, care, and  storage of critical infrastructure information voluntarily submitted to the  government. We found that while DHS created the program office,  structure, and guidance, few private sector entities were using the  program. Challenges DHS faced included being able to assure the private  sector that such information will be protected and specifying who will be  authorized to have access to the information, as well as to demonstrate to  critical infrastructure owners the benefits of sharing the information. We  concluded that if DHS were able to surmount these challenges, it and  other government users may begin to overcome the lack of trust that  critical infrastructure owners have in the government’s ability to use and  protect their sensitive information. We recommended that DHS better  define its critical infrastructure information needs and better explain how  this information will be used. DHS concurred with our recommendations.  In September 2006 DHS issued a final rule that established procedures  governing the receipt, validation, handling, storage, marking, and use of  critical infrastructure information voluntarily submitted to DHS.
Four government and four sector council representatives stated that the  lack of prior working relationships either within their sector or with the  federal government created challenges in forming their respective  councils. For example, the public health and health care sector struggled  with creating a sector council that represented the interests of the sector  because it is composed of thousands of entities that are not largely  involved with each other in daily activities. According to the sector- specific agency representative of the Department of Health and Human  Services (HHS), historically, there was relatively little collaboration on  critical infrastructure protection-related issues among sector members.  Despite these reported challenges, the public health and health care sector  has been able to form a sector council that is in the early stages of  organization. The commercial facilities sector, which also involves varied  and often unrelated stakeholders nationwide, similarly reported that the  disparities among stakeholders made forming a council challenging. This  sector encompasses owners and operators of stadiums, raceways, casinos,  and office buildings that have not previously worked together. In addition,  the industries composing the commercial facilities sector did not function  as a sector prior to the NIPP and did not have any prior association with  the federal government. As a result, this sector council has been  concentrating its efforts on identifying key stakeholders and agreeing on  the scope of the council and its membership.
section_title: Councils Delayed Their Work on Plans until the NIPP Was Issued, but Despite Challenges Submitted Plans to DHS by the Due Date
paragraphs: Each of the 17 sectors provided a sector-specific plan to DHS by the end of  December 2006, as required by the NIPP, according to DHS Infrastructure  Protection officials. Representatives from both the government and sector  councils cited factors that have facilitated the development of their  plans—similar to those that facilitated development of their councils— most commonly citing pre-existing plans; historical relationships between  the federal government and the private sector or across the private sector,  and contractor support. Sector representatives most commonly reported  that key challenges in drafting their plans were the late issuance of a final  NIPP, which caused some sectors to delay work on their plans, the  changing nature of DHS guidance on how to develop the plans, and the  diverse make-up of sector membership.
subsections: section_title: Sector-Specific Agencies Completed Their Plans on Time
paragraphs: Sector-specific agencies met the deadline to complete their plans by  December 2006, according to DHS Infrastructure Protection officials. The  NIPP requires these plans to contain definitions of the processes the  sectors will use to identify their most critical assets and resources as well  as the methodologies they will use to assess risks, but not information on  the specific protective measures that will be utilized by each sector. The  NIPP also requires agencies to coordinate the development of plans in  collaboration with their security partners represented by government and  sector councils and provide documentation of such collaboration. To date,  the level of collaboration between sector-specific agencies and the sector  councils in developing the sector-specific plans has varied—ranging from  soliciting stakeholder comments on a draft to jointly developing the plan.  For example, TSA developed the transportation systems plan and solicited  input from private sector stakeholders, while representatives of the energy  sector council worked with the Department of Energy to draft the energy  plan. Despite these differences, according to DHS Infrastructure  Protection officials, all the sectors submitted their plans to DHS by the  December 2006 deadline and DHS and other stakeholders are in the  process of reviewing them.
section_title: Pre-existing Plans, Collaboration, and Contractor Support Were Factors Most Commonly Cited as Facilitating Development of Sector- Specific Plans
paragraphs: Sector representatives from the agriculture and food, banking and finance,  chemical, and energy sectors said their sectors had already developed  protection plans prior to the interim NIPP published in February 2005  because they had recognized the economic value in planning for an attack.  These representatives said they were able to revise their previous plans to  serve as the plans called for in the NIPP. For example, the Department of  Energy, with input from the sector, had developed a protection plan in  anticipation of the Year 2000 computer threat; Department of Energy  officials noted that both this plan and the relationships established by its  development have been beneficial in developing the protection plan for  the energy sector. Similarly, the banking and finance sector council, which  worked closely with the Department of Treasury, has had a critical  infrastructure protection plan in place for the banking and finance sector  since 2003 and planned to use it, along with other strategies, to fit the  format required by the NIPP.
Representatives from 13 government and 10 sector councils agreed that  having prior relationships—either formally between the federal  government and the private sector based on regulatory requirements, or  informally within and across industries—facilitated sector-specific plan  development. For example, a nuclear sector representative said that its  regulator, the Nuclear Regulatory Commission, had already laid out clear  guidelines for security and threat response that facilitated developing the  sector’s plan. The drinking water and wastewater sector council  representative said that its long-standing culture of sharing information  and decades of work with the Environmental Protection Agency helped  with plan development.
Representatives from seven sector-specific agencies and five sector  councils said that assistance from DHS officials or DHS contractors was  also a factor that helped with plan development, such as research and  drafting. For example, DHS contract staff assisted the Department of the  Interior and DHS’s Chemical and Nuclear Preparedness and Protection  Division in drafting the plans for the national monuments and icons and  emergency services sectors, respectively. Representatives from the  chemical, emergency services, nuclear, and telecommunications sector  councils said that contractors hired by DHS were helpful as resources  providing research or drafting services.
section_title: The Late Issuance of a Final NIPP, Changing Guidance, and Other Challenges Impeded Progress on Some Sector- Specific Plans
paragraphs: Representatives from six government councils and six sector councils said  that the delays in issuing a final NIPP and changing DHS sector-specific  plan guidance contributed to delays in developing their sector plans.  According to DHS, sectors had begun drafting their sector-specific plans  following the issuance of initial plan guidance in April 2004. But, DHS  issued revised guidance based, in part, on stakeholder comments a year  later with new requirements, including how the sector will collaborate  with DHS on risk assessment processes as well as how it will identify the  types of protective measures most applicable to the sector. DHS then  issued additional guidance in 2006 requiring that the plans describe how  sector-specific agencies are to manage and coordinate their  responsibilities. These changes required some sectors—such as dams,  emergency services, and information technology—to make significant  revisions to their draft plans. Representatives from these sectors  expressed frustration with having to spend extra time and effort making  changes to the format and content of their plans each time DHS issued  new guidance. Therefore, they decided to wait until final guidance was  issued based on the final, approved NIPP. In our current work, once we  have access to these plans, it will be important to determine how these  delays may have affected the quality, completeness, and consistency of the  plans.
However, some sectors found the changes in the NIPP and plan guidance  to be improvements over prior versions that helped them prepare their  plans. For example, representatives from the emergency services sector  said that guidance became more specific and, thus, more helpful over time,  and representatives from the national monuments and icons sector said  that the DHS guidance has been useful. Representatives from the  information technology, public health, energy, telecommunications, and  transportation systems sectors, among others, had commented that the  NIPP should emphasize resiliency—meaning how quickly can a key asset  or resource begin operations after an incident—rather than protection  measures, such as hiring guards, installing gates and similar actions.  According to some of these representatives, it is impossible and cost- prohibitive to try to protect every asset from every possible threat.  Instead, industries in these sectors prefer to invest resources in protecting  the most critical assets with the highest risk of damage or destruction and  to plan for recovering quickly from an event. Representatives from the  telecommunications sector added that resiliency is especially important  for interdependent industries in restoring services such as  communications, power, the flow of medical supplies, and transportation  as soon as possible. DHS incorporated the concept of resiliency into the  final NIPP to address these concerns and continues to emphasize  protection as well.
As in establishing their councils, in developing their sector-specific plans,  officials from three government councils and five sector councils said that  their sectors were made up of a number of disparate stakeholders, making  agreement on a plan more difficult. For example, the commercial facilities  sector is composed of eight different subsectors of business entities that  have historically had few prior working relationships. According to the  government council representative, the magnitude of the diversity among  these subsectors has slowed the process of developing a plan so that the  sector only had an outline of its plan as of May 2006. Similarly, government  and private council representatives of the agriculture and food sector  indicated that the diversity of industries included in this sector such as  farms, food-processing plants, and restaurants, each of which has differing  infrastructure protection needs, has made developing a plan more difficult.
section_title: DHS Needs to Fulfill Key Cybersecurity Responsibilities and Address Challenges and GAO Recommendations
paragraphs: To some extent, all sectors depend on cyber infrastructure to operate,  such as using computers to control access at nuclear facilities. So, it is  important that sectors include cybersecurity in their sector’s protection  plan and programs. As the focal point for critical infrastructure protection,  DHS has many cybersecurity-related responsibilities that are called for in  law and policy. In 2005 and 2006, we reported that DHS had initiated  efforts to address these responsibilities, but that more remained to be  done. Specifically, in 2005, we reported that DHS had initiated efforts to  fulfill 13 key cybersecurity responsibilities (shown in table 2), but it had  not fully addressed any of them. For example, DHS established forums to  foster information sharing among federal officials with information  security responsibilities and among various law enforcement entities, but  had not developed national threat and vulnerability assessments for  cybersecurity. Since that time, DHS has made progress on its  responsibilities—including the release of its NIPP—but none has been  completely addressed. Moreover, in 2006, we reported that DHS had begun  a variety of initiatives to fulfill its responsibility to develop an integrated  public/private plan for Internet recovery, but that these efforts were not  complete or comprehensive. For example, DHS had established working  groups to facilitate coordination among government and industry  infrastructure officials and fostered exercises in which government and  private industry could practice responding to cyber events, but many of its  efforts lacked time frames for completion and the relationships among its  various initiatives are not evident.
DHS faces a number of challenges that have impeded its ability to fulfill its  cybersecurity responsibilities, including establishing effective partnerships  with stakeholders, achieving two-way information sharing with  stakeholders, demonstrating the value it can provide to private sector  infrastructure owners, and reaching consensus on DHS’s role in Internet  recovery and on when the department should get involved in responding  to an Internet disruption. In addition, we reported that DHS faced a  particular challenge in attaining the organizational stability and leadership  it needed to gain the trust of other stakeholders in the cybersecurity  world—including other government agencies as well as the private sector.
In July 2005, DHS undertook a reorganization that established the position  of the Assistant Secretary of Cyber Security and Telecommunications—in  part to raise the visibility of cybersecurity issues in the department. In  September 2006, DHS announced the appointment of an Assistant  Secretary for Cyber Security and Telecommunications. Since the  appointment, the Assistant Secretary has led efforts to ensure the  inclusion of cybersecurity in each critical infrastructure sector’s sector  specific plan. The Assistant Secretary has set priorities that include (1)  preparing for and deterring attacks by encouraging entities, through  implementation of the sector specific plans, to systematically assess their  network vulnerabilities and take steps to fix them, (2) responding to cyber  attacks of potentially national significance by leveraging operational  expertise and building situational awareness and incident response  capabilities of the government and private sector; and (3) building  awareness about the responsibilities for securing networks across the  public and private sectors.
In addition to the National Cyber Security Division, the Assistant Secretary  is also responsible for the National Communications System, which  ensures continuity of communications and priority service for the  government under conditions of national emergency, and the Office of  Emergency Communications, established pursuant to the fiscal year 2007  DHS appropriations act. This office is responsible for developing a  national strategy and technical assistance and outreach to state and local  governments for ensuring operable and interoperable emergency  communications capabilities for first responders.
To strengthen DHS’s ability to implement its cybersecurity responsibilities  and to resolve underlying challenges, GAO has made about 25  recommendations over the last several years. These recommendations  focus on the need to (1) conduct important threat and vulnerability  assessments, (2) develop a strategic analysis and warning capability for  identifying potential cyber attacks, (3) protect infrastructure control  systems, (4) enhance public/private information sharing, and (5) facilitate  recovery planning, including recovery of the Internet in case of a major  disruption. DHS concurred with most of the recommendations addressed  to them. Together, the recommendations provide a high-level road map for  DHS to use in working to improve our nation’s cybersecurity posture.  While DHS has made progress in addressing some of these  recommendations many things remain to be done. Until it addresses these  recommendations, DHS will have difficulty achieving results in its role as  the federal focal point for the cybersecurity of critical infrastructures— including the Internet. Table 3 shows our detailed recommendations.
section_title: Concluding Observations
paragraphs: Critical infrastructure protection is vital to our national security, economic  vitality, and public health. Yet a decade after focusing on improving our  ability to protect our key assets and resources, progress has been mixed,  as Katrina demonstrated. It showed that significant damage to critical  infrastructure and key resources could disrupt the functioning of  businesses and government alike, underscoring the need for the private  and public sector to establish stronger partnerships and working  relationships in order to take a coordinated approach to critical  infrastructure protection. DHS has moved out by issuing the National  Infrastructure Protection Plan as a guiding framework for a national effort,  and is providing contractor, technical, and analytical support to sectors,  among other things, to encourage progress. Likewise, some sectors—those  who are more mature, have been regulated, are more homogeneous, or  had economic incentives, such as the threat of Y2K—came together to  collaborate, work effectively, and develop protection strategies, even  before DHS established the national plan. But other sectors—those who  have just been created, who have not worked with federal agencies in the  past, who are not regulated but must volunteer to participate in the  planning process, and who are large and diverse—face bigger challenges  in achieving this coordination and rate of progress. Despite these  challenges, each sector submitted a protection plan to DHS. However,  DHS has yet to release them. Given the wide variance in the maturity of  the sectors, the quality, comprehensiveness, completeness, and  consistency of the plans remain to be seen. In addition, it is important to  realize that in some cases, the sector specific plan is really more of a first  step—a “plan to plan.” In other words, the sectors were only to describe  how they expect to identify and prioritize critical assets, how they expect  to assess their risks, vulnerabilities, threats and consequences, and how  they will approach developing protection programs, not detail how they  will implement them.
Thus, fulfilling its statutory responsibilities for ensuring the nation’s  critical infrastructure is protected will be a long-term commitment for  DHS. This makes it even more important that DHS address challenges that  our work has identified over the years and for which we have made a  number of recommendations yet to be implemented, including our body of  work assessing the protection of cyber infrastructure. These challenges  include building trusted working relationships and better collaborating  with states and localities, given that the infrastructure is in their  communities, as well as the private sector, given that they own most of the  assets and resources. Challenges also include providing the environment  and incentives for the private sector to voluntarily share information with  DHS on gaps in vulnerabilities and protective measures, information that  the agency must have to be able to ensure assets and resources critical to  the nation are protected. Challenges also include providing organizational  stability and leadership, addressing employee turnover and gaps in  expertise, and enhancing agency capabilities, such as for providing  analysis and warning and identifying and assessing threats and  vulnerabilities.
Mr. Chairman, this concludes my statement. I would be pleased to answer  any questions that you or other members of the subcommittee may have at  any time.
section_title: Contact Information
paragraphs: For further information on this testimony, please contact Eileen Larence  at (202) 512-8777 or by e-mail at larencee@gao.gov, or regarding cyber- critical infrastructure protection issues, David Powner at (202) 512-9286 or  by e-mail at pownerd@gao.gov. Individuals making key contributions to  this testimony include Susan Quinlan, Assistant Director; Michael Gilmore;  Landis Lindsey; and Edith Sohna.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.