Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened
Published: 2010-09-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: According to the Department of Homeland Security (DHS), protecting and ensuring the resiliency (the ability to resist, absorb, recover from, or successfully adapt to adversity or changing conditions) of critical infrastructure and key resources (CIKR) is essential to the nation's security. By law, DHS is to lead and coordinate efforts to protect several thousand CIKR assets deemed vital to the nation's security, public health, and economy. In 2006, DHS created the National Infrastructure Protection Plan (NIPP) to outline the approach for integrating CIKR and increased its emphasis on resiliency in its 2009 update. GAO was asked to assess the extent to which DHS (1) has incorporated resiliency into the programs it uses to work with asset owners and operators and (2) is positioned to disseminate information it gathers on resiliency practices to asset owners and operators. GAO reviewed DHS documents, such as the NIPP, and interviewed DHS officials and 15 owners and operators of assets selected on the basis of geographic diversity. The results of these interviews are not generalizable but provide insights.
section_title: What GAO Found
paragraphs: DHS's efforts to incorporate resiliency into the programs it uses to work with asset owners and operators is evolving but program management could be strengthened. Specifically, DHS is developing or updating programs to assess vulnerability and risk at CIKR facilities and within groups of related infrastructure, regions, and systems to place greater emphasis on resiliency. However, DHS has not taken commensurate efforts to measure asset owners' and operators' actions to address resiliency gaps. DHS operates its Protective Security Advisor Program, which deploys critical infrastructure protection and security specialists, called Protective Security Advisors (PSA), to assist asset owners and operators on CIKR protection strategies, and has provided guidelines to PSAs on key job tasks such as how to establish relationships between asset owners and operators and DHS, federal, state, and local officials. DHS has provided training to PSAs on resiliency topics, but has not updated PSA guidelines to articulate the role of PSAs with regard to resiliency issues, or how PSAs are to promote resiliency strategies and practices to asset owners and operators. A senior DHS official described plans to update PSA guidelines and the intent to outline this plan in October 2010, but did not provide information on what changes would be made to articulate PSA roles and responsibility with regard to resiliency. By developing measures to assess the extent to which asset owners and operators are addressing resiliency gaps and updating PSA guidance, DHS would be better positioned to manage its efforts to help asset owners and operators enhance their resiliency. DHS faces barriers disseminating information about resiliency practices across the spectrum of asset owners and operators. DHS shares information on potential protective measures with asset owners and operators and others including state and local officials (generally on a case-by-case basis) after it has completed vulnerability assessments at CIKR facilities. DHS officials told GAO that they have considered ways to disseminate information that they collect or plan to collect with regard to resiliency. However, DHS faces barriers sharing information about resiliency strategies. For example, given the voluntary nature of the CIKR partnership, DHS officials stated that DHS should not be viewed as identifying and promoting practices which could be construed by CIKR partners to be standards. Also, according to DHS officials, the need for and the emphasis on resiliency can vary across different types of facilities depending on the nature of the facility. For example, an oil refinery is inherently different than a government office building. DHS's efforts to emphasize resiliency when developing or updating the programs it uses to work with owners and operators creates an opportunity for DHS to position itself to disseminate information about resiliency practices within and across the spectrum of asset owners and operators. By determining the feasibility of overcoming barriers and developing an approach for disseminating information on resiliency practices within and across sectors, DHS could better position itself to help asset owners and operators consider and adopt resiliency strategies.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS develop resiliency performance measures, update PSA guidelines, and determine the feasibility of developing an approach to disseminate resiliency information. DHS is taking action to implement two recommendations and is internally considering the third.

section_title: Letter
paragraphs: In 2005, Hurricane Katrina devastated the Gulf Coast, damaging critical  infrastructure, such as oil platforms, pipelines, and refineries; water mains;  electric power lines; and cellular phone towers. The infrastructure damage  and resulting chaos disrupted government and business functions alike,  producing cascading effects far beyond the physical location of the storm.  Threats against critical infrastructure are not limited to natural disasters.  For example, in 2005, suicide bombers struck London’s public  transportation system, disrupting the city’s transportation and mobile  telecommunications infrastructure. In March 2007, we reported that our  nation’s critical infrastructures and key resources (CIKR)—assets and  systems, whether physical or virtual, so vital to the United States that their  incapacity or destruction would have a debilitating impact on national  security, national economic security, national public health or safety, or  any combination of those matters—continue to be vulnerable to a wide  variety of threats. According to the Department of Homeland Security  (DHS), because the private sector owns the vast majority of the nation’s  CIKR—banking and financial institutions, telecommunications networks,  and energy production and transmission facilities, among others—it is  vital that the public and private sectors work together to protect these  assets and systems.
The Homeland Security Act of 2002 created DHS and gave the department  wide-ranging responsibilities for, among other things, leading and  coordinating the overall national critical infrastructure protection effort.  Homeland Security Presidential Directive (HSPD)-7 further defined critical  infrastructure protection responsibilities for DHS and those federal  agencies—known as sector-specific agencies (SSAs)—responsible for  particular CIKR sectors, such as the chemical, commercial facilities,  communications, energy, and transportation sectors. HSPD-7 directed  DHS to establish uniform policies, approaches, guidelines, and  methodologies for integrating federal infrastructure protection and risk  management activities within and across the 17 CIKR sectors. The  directive also gave DHS the authority to establish additional sectors and in  2008, DHS established an 18th sector for critical manufacturing.
In accordance with the Homeland Security Act and in response to HSPD-7,  DHS issued the first National Infrastructure Protection Plan (NIPP) in  June 2006, which provides the overarching approach for integrating the  nation’s CIKR protection initiatives into a single national effort. DHS  issued a revised NIPP in January 2009. The NIPP sets forth a risk  management framework and details the roles and responsibilities for DHS,  SSAs, and other federal, state, regional, local, tribal, territorial, and private  sector partners implementing the NIPP, including how they should use  risk management principles to prioritize protection activities within and  across sectors. Within the NIPP framework, DHS has emphasized the  importance of collaboration and partnering with and among the various  partners and its reliance on voluntary information sharing between the  private sector and DHS. The NIPP provides the framework for developing,  implementing, and maintaining a coordinated national effort to protect  CIKR in the 18 sectors. Each of the CIKR sectors is represented in the  federal planning process by a SSA; a government coordinating council  (GCC) to represent each sector’s interests among government agencies;  and a sector coordinating council (SCC) that includes private sector  representatives of the sector. Each sector is responsible for developing  sector-specific plans and sector annual reports. The sector-specific plans  are to provide the means by which the NIPP is implemented across the  sectors, as well as a national framework for each sector that guides the  development, implementation, and updating of state and local homeland  security strategies and CIKR protection programs. Sector annual reports  articulate the progress of the sector’s CIKR protection and resiliency  efforts, challenges, and needs to other sectors, government agencies, CIKR  partners, the Executive Office of the President, and Congress.
As part of its risk management strategy, DHS has established a National  Critical Infrastructure Prioritization Program which uses a tiered approach  to identify nationally significant CIKR to enhance decision making related  to CIKR protection. These assets and systems can include a range of  businesses or facilities in a local geographic area, such as refineries,  chemical facilities, or commercial facilities, as well as the information  systems and data systems that ensure their continued operation. CIKR  identified through the program include several thousand level 1 or level 2  assets and systems which are those that if destroyed or disrupted, could  cause some combination of significant casualties, major economic losses,  or widespread and long-term disruptions to national well-being and  governance capacity. According to DHS, the overwhelming majority of the  assets and systems identified through this effort are classified as level 2.  Only a small subset of assets meet the level 1 consequence threshold— those whose loss or damage could result in major national or regional  impacts similar to the impacts of Hurricane Katrina or the September 11,  2001 attacks. We placed the protection of the federal government’s  information systems and the nation’s critical infrastructure on our high- risk list in 1997 because the security of the information systems, networks,  and data that sustain the operations of CIKR is essential to preventing  disruptions in critical operations across and among CIKR.
Over the last several years, various stakeholders, including members of  Congress, academia, and the private sector have questioned DHS’s  approach to critical infrastructure protection. These stakeholders have  expressed concerns that DHS has placed most of its emphasis on  protection—actions to deter the threat, mitigate vulnerabilities, or  minimize the consequences associated with an attack or disaster—rather  than resiliency—which, according to DHS, is the ability to resist, absorb,  recover from, or successfully adapt to adversity or a change in conditions.  In response to your request that we study DHS’s revisions to the NIPP and  efforts by DHS to address resiliency as part of its national planning efforts,  in March 2010 we reported that DHS had increased its emphasis on the  concept of critical infrastructure resiliency as a part of its national CIKR  planning efforts. Specifically, DHS has increased its emphasis on  resiliency in the most recent edition of the NIPP and has directed SSAs to  address resiliency in their sector-specific plans, which SSAs intend to  publish later this year.
To further address your request, this report focuses on DHS efforts to  work with asset owners and operators to incorporate and enhance  resiliency, commensurate with DHS’s increased emphasis on resiliency in  the NIPP. Specifically, we assessed the extent to which DHS    has taken action to incorporate resiliency into the programs it uses to  work with asset owners and operators, and is positioned to disseminate information it gathers about resiliency  practices to asset owners and operators within and across sectors.
To assess the extent to which DHS has taken action to incorporate  resiliency into the programs it uses to work with asset owners and  operators, we reviewed DHS policies, procedures, and documents on  partnering and information sharing between the public and private sectors  including the NIPP; sector-specific plans; and sector annual reports. We  interviewed senior DHS officials responsible for planning, coordinating,  and overseeing the national effort to reduce risk to CIKR to obtain  information on DHS’s efforts to work with CIKR partners, including asset  owners and operators. Furthermore, we reviewed DHS documents on  programs used to assess vulnerability and risk at CIKR facilities and the  tools DHS uses to assess vulnerability to examine the extent to which, and  in what context, the concept of resiliency was used as part of those  assessments. Because it was out of the scope of our work, we did not  assess the implementation or results of these assessments. In addition, we  reviewed and analyzed DHS documents and reports resulting from these  vulnerability assessments. We selected 4 of 17 sectors—the chemical,  commercial facilities, communications, and energy sectors—based on our  analysis of sector-specific plans published in fiscal year 2007. In making  our selections, we focused on the extent to which the plans (1) discussed  the concept of resiliency while considering key terms associated with  resiliency—resilience, resilient, and continuity (business or operational  continuity) and (2) provided key information on various factors— including goals and objectives, measuring performance, and processes for  prioritizing assets and assessing vulnerability—called for in DHS  guidelines for developing these plans. We used our analysis to rank the  sectors and conferred with various DHS officials familiar with the sector  plans about the results of our analysis. Based on these discussions, we  selected 2 of the highest and 2 of the lowest ranked sectors in terms of  discussing resiliency concepts and providing key information.
We also used our selection methodology as the basis for interviewing  representatives—owners and operators—of assets, also known as  facilities, in two geographic locations. These facilities were (1) designated  as a level 1 or 2 asset on the DHS critical asset list and (2) located in areas  that had recently been affected by disasters (hurricanes in Texas and  wildfires in California). We chose these locations to visit considering the  type of disaster and geographic dispersion. During our site visits, we  interviewed representatives of 15 individual assets, including  representatives that worked on-site and in the corporate office, to  determine the extent to which they receive guidance on resiliency from  and partner with DHS. Among other things, we focused on the role of  Protective Security Advisors (PSAs) who serve as liaisons between DHS  and security stakeholders, to include asset owners and operators, in local  communities. We also reviewed PSA program guidance and interviewed 10  of 93 PSAs to discuss their roles and responsibilities in partnering with  asset owners and operators to incorporate resiliency practices and their  knowledge of resiliency policies, practices, and techniques. We selected  these PSAs from a nonprobability sample based on a variety of factors  including geographic location, the number of CIKR assets in a location,  and types and frequency of natural disasters in the region. While the  results of our interviews cannot be generalized to reflect the views of all  asset owners and operators or PSAs nationwide, the information obtained  provided us with the perspectives of various asset owners and operators  and PSAs about critical infrastructure protection and resiliency. We also  interviewed DHS officials about their plans for revising the various  assessment programs and tools and compared the results of our work with  The Standard for Program Management, which provides guidelines for  successfully managing programs and projects. We also compared the  results of our efforts and DHS’s PSA guidance with criteria in the  Standards for Internal Control in the Federal Government and the  Standard for Program Management.
To assess the extent to which DHS is positioned to disseminate  information it gathers about resiliency practices with asset owners and  operators within and across sectors, we reviewed DHS policies,  procedures, and documents including the NIPP, sector-specific plans, and  sector annual reports on CIKR information sharing with a particular focus  on DHS’s approach to information sharing on protective measures and  resiliency practices and strategies with asset owners and operators. We  interviewed DHS officials on their efforts to share information and  facilitate the sharing of information on resiliency practices. In addition, we  interviewed representatives of 15 assets in Texas and California about the  mechanisms, policies, and practices DHS uses to facilitate the sharing of  information related to resiliency, what resiliency-related practices  associated with disasters they had identified, the extent to which they  have implemented or are continuing to implement such practices into their  daily operations, and whether they shared these best practices with DHS  and other CIKR partners.
We conducted this performance audit from August 2008 through  September 2010 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our objectives.
subsections: section_title: Background
paragraphs: The Homeland Security Act, as well as other statutes, provide legal  authority for both cross-sector and sector-specific protection and  resiliency programs. For example, the purpose of the Public Health  Security and Bioterrorism Preparedness and Response Act of 2002 is to  improve the ability of the United States to prevent, prepare for, and  respond to acts of bioterrorism and other public health emergencies, and  the Pandemic and All-Hazards Preparedness Act of 2006 addresses public  health security and all-hazards preparedness and response. Also, the  Cyber Security Research and Development Act of 2002 authorized funding  for the National Institute of Standards and Technology and the National  Science Foundation to facilitate increased research and development for  computer and network security and to support research fellowships and  training. CIKR protection issues are also covered under various  presidential directives, including HSPD-5 and HSPD-8. HSPD-5 calls for  coordination among all levels of government as well as between the  government and the private sector for domestic incident management, and  HSPD-8 establishes policies to strengthen national preparedness to  prevent, detect, respond to, and recover from threatened domestic  terrorist attacks and other emergencies. These separate authorities and  directives are tied together as part of the national approach for CIKR  protection through the unifying framework established in HSPD-7.
The NIPP outlines the roles and responsibilities of DHS and its partners— including other federal agencies, state, local, territorial, and tribal  governments, and private companies. Within the NIPP framework, DHS is  responsible for leading and coordinating the overall national effort to  enhance protection via 18 CIKR sectors. HSPD-7 and the NIPP assign  responsibility for CIKR sectors to SSAs. As an SSA, DHS has direct  responsibility for leading, integrating, and coordinating efforts of sector  partners to protect 11 of the 18 CIKR sectors. The remaining sectors are  coordinated by 8 other federal agencies. Table 1 lists the SSAs and their  sectors.
The DHS’s Office of Infrastructure Protection (IP), located in the National  Protection and Programs Directorate, is responsible for working with  public- and private-sector CIKR partners and leads the coordinated  national effort to mitigate risk to the nation’s CIKR through the  development and implementation of the CIKR protection program. Using a  sector partnership model, IP’s Partnership and Outreach Division (POD)  works with owners and operators of the nation’s CIKR to develop,  facilitate, and sustain strategic relationships and information sharing,  including the sharing of best practices. The POD also works with public  and private partners to coordinate efforts to establish and operate various  councils intended to protect CIKR and provide CIKR functions to  strengthen incident response. These councils include the aforementioned  SCCs, which coordinate sectorwide CIKR activities and initiatives among  private sector owners, operators, and trade associations in each of the 18  sectors, and the GCCs that represent federal, state, and local government  and tribal interests to support the effort of SCCs to develop collaborative  strategies for CIKR protection for each of the 18 sectors. The partnership  model also includes various cross-sector councils, including the CIKR  Cross-Sector Council, which addresses cross-sector issues and  interdependencies among SCCs; the NIPP Federal Senior Leadership  Council, which focuses on enhanced communication and coordination  between and among federal departments and agencies responsible for  implementing the NIPP and HSPD-7; and the State, Local, Tribal, and  Territorial Government Coordinating Council, which promotes  coordination across state and local jurisdictions. The model also includes  a Regional Consortium Coordinating Council, which bring together  representatives of regional partnerships, groupings, and governance  bodies to foster coordination among CIKR partners within and across  geographical areas and sectors.
Figure 1 illustrates the sector partnership model and the interrelationships  among the various councils, sectors, and asset owners and operators.
IP’s Protective Security Coordination Division (PSCD) also operates the  Protective Security Advisor Program, which deploys critical infrastructure  protection and security specialists, called PSAs, to local communities  throughout the country. Established in 2004, the program has 93 PSAs  serving in 74 districts in 50 states and Puerto Rico, with deployment  locations based on population density and major concentrations of CIKR  throughout the United States. PSAs lead IP’s efforts in these locations and  act as the link between state, local, tribal, and territorial organizations and  DHS infrastructure mission partners. PSAs are to assist with ongoing state  and local CIKR security efforts by establishing and maintaining  relationships with state Homeland Security Advisors, State Critical  Infrastructure Protection stakeholders, and other state, local, tribal,  territorial and private-sector organizations. PSAs are to support the  development of the national risk picture by conducting vulnerability and  security assessments to identify security gaps and potential vulnerabilities  in the nation’s most critical infrastructures. PSAs also are to share  vulnerability information and protective measure suggestions with local  partners and asset owners and operators. In addition, PSAs are to  coordinate training for private-and public-sector officials in the  communities in which they are located; support incident management; and  serve as a channel of communication for state, local, tribal, and territorial  officials and asset owners and operators seeking to communicate with  DHS.
subsections: section_title: Critical Infrastructure and the Concept of Resiliency
paragraphs: “Despite ongoing vigilance and efforts to protect this country and its citizens, major  accidents and disasters, as well as deliberate attacks, will occur. The challenge is to build  the capacity of American society to be resilient in the face of disruptions, disasters, and  other crises. Our vision is a Nation that understands the hazards and risks we face; is  prepared for disasters; can withstand the disruptions disasters may cause; can sustain  social trust, economic, and other functions under adverse conditions; can manage itself  effectively during a crisis; can recover quickly and effectively; and can adapt to conditions  that have changed as a result of the event.”
The report also articulates that one of the goals for this mission is to  “Rapidly Recover.” The two objectives associated with this goal are to (1)  enhance recovery capabilities: establish and maintain nationwide  capabilities for recovery from major disasters and (2) ensure continuity of  essential services and functions: improve capabilities of families,  communities, private-sector organizations, and all levels of government to  sustain essential services and functions.
section_title: DHS Efforts to Incorporate Resiliency into Programs Used to Work with Asset Owners and Operators Is Evolving but Program Management Could Be Strengthened
paragraphs: Consistent with recent changes to the NIPP, DHS has begun to increase its  emphasis on resiliency in the various programs it uses to assess  vulnerability and risk at and among CIKR facilities so that it can help asset  owners and operators identify resiliency characteristics of their facilities  and provide suggested actions, called options for consideration, to help  them mitigate gaps that have been identified. However, DHS has not  developed an approach to measure owners’ and operators’ actions to  address resiliency gaps identified as a result of these assessments. DHS  has also begun to train PSAs about resiliency and how it applies to asset  owners and operators, but it has not updated guidance that discusses  PSAs’ roles and responsibilities to explicitly include resiliency and  resiliency strategies.
subsections: section_title: DHS Has Increased Emphasis on Resiliency in Programs, but Has Not Developed an Approach to Measure Performance
paragraphs: In March 2010 we reported that DHS has increased its emphasis on  resiliency in the 2009 NIPP by, among other things, generally pairing it  with the concept of protection. We further stated that DHS has encouraged  SSAs to emphasize resiliency in guidance provided to them in updating  their sector-specific plans. Consistent with these efforts, DHS has also  taken action to develop or enhance the programs it uses to work with  asset owners and operators to bring a stronger focus to resiliency.
subsections: section_title: The Regional Resiliency Assessment Program (RRAP) and the Mini-Resiliency Assessment Program (Mini- RAP)
paragraphs: In 2009 DHS developed the RRAP to assess vulnerability and risk  associated with resiliency. The RRAP is an analysis of groups of related  infrastructure, regions, and systems in major metropolitan areas. The  RRAP evaluates CIKR on a regional level to examine vulnerabilities,  threats, and potential consequences from an all-hazards perspective to  identify dependencies, interdependencies, cascading effects, resiliency  characteristics, and gaps. In conducting the RRAP, DHS does an analysis  of a region’s CIKR and protection and prevention capabilities and focuses  on (1) integrating vulnerability and capability assessments and  infrastructure protection planning efforts; (2) identifying security gaps and  corresponding options for considerations to improve prevention,  protection, and resiliency; (3) analyzing system recovery capabilities and  providing options to secure operability during long-term recovery; and (4)  assessing state and regional resiliency, mutual aid, coordination, and  interoperable communication capabilities. RRAP assessments are to be  conducted by DHS officials, including PSAs, in collaboration with SSAs:  other federal officials; state, local, tribal, and territorial officials; and the  private sector depending upon the sectors and facilities selected as well as  a resiliency subject matter expert(s) deployed by the state’s homeland  security agency. The results of the RRAP are to be used to enhance the  overall security posture of the facilities, surrounding communities, and the  geographic region covered by the project and are shared with the state.  According to DHS officials, the results of specific asset-level assessments  conducted as part of the RRAP are made available to asset owners and  operators and other partners (as appropriate), but the final analysis and  report is delivered to the state where the RRAP was conducted.
One of the assessment tools DHS developed for the RRAP analysis is a  “resiliency assessment builder,” which contains a series of questions  designed to help officials identify resiliency issues associated with  facilities included in the RRAP. The resiliency assessment builder, among  other things, focuses on:  the impact of loss associated with the facility, including any national  security, sociopolitical, and economic impacts; interdependencies between the facility under review and other  infrastructure—such as electrical power or natural gas suppliers,  water, and supply chain systems—that if disrupted, could cause  deterioration or cessation of facility operations; the impact of the loss of significant assets—such as an electrical  substation to provide power or a rail spur to transport supplies— critical to the operation of the facility and backup systems available to  maintain operations if losses occur; and  specific vulnerabilities, unusual conditions, threats, or events—such as  hurricanes, transportation chokepoints, or hazardous materials  issues—that could disrupt operations and whether the facility is  prepared to address the situation via specific capabilities or an action  plan.
Senior IP officials told us that they believe the RRAP has been successful  in helping DHS understand resiliency in the context of interdependencies  among individual assets. For example, while the focus of the Tennessee  Valley Authority RRAP was energy sector sites and resources, DHS and its  partners examined sites and resources in those sectors, like water and  dams, which appeared to be obvious interdependencies. However, they  also found that they needed to examine sites and resources in those  sectors that appeared less obvious but were interdependent because they  were intricately connected to the Tennessee Valley Authority operations,  like sites and resources in the transportation sector. Also, in fiscal year  2010, DHS started an RRAP in Atlanta that focused primarily on  commercial facilities. DHS’s related vulnerability assessment of sites (see  the discussion below for additional details of these assessments) and  resources associated with the water sector in Atlanta showed that an  accident or attack involving one component of the water sector could  disrupt the operations of sites or resources of other sectors in the  geographic area covered by the RRAP. By discovering this vulnerability,  and taking steps to address it, asset owners and operators in various  sectors that were provided this information were better positioned to be  able to work together to mitigate this potential problem. Senior IP officials  said that the overall RRAP effort was piloted in five projects, but they no  longer consider it a pilot program. They added that they plan to conduct  five other RRAPs in 2010 in addition to the one already started in Atlanta.  They further stated that because the program focuses only on areas with a  high density of critical assets, they plan to develop a new “mini-RAP.”  According to these officials, the mini-RAP is intended to provide  assessments similar to those provided during an RRAP (but on a reduced  scale) to groups of related infrastructure or assets that are not selected to  receive an RRAP. An IP official stated that he anticipates that the mini- RAP, which is under development, will be finalized in October 2010.
section_title: Site Assistance Visits (SAVs)
paragraphs: DHS is also revising another vulnerability assessment called the SAV to  foster greater emphasis on resiliency at individual CIKR sites. The SAV,  which is a facility-specific “inside-the-fence” vulnerability assessment  conducted at the request of asset owners and operators, is intended to  identify security gaps and provide options for consideration to mitigate  these identified gaps. SAVs are conducted at individual facilities or as part  of an RRAP and are conducted by IP assessment teams in coordination  with PSAs, SSAs, state and local government organizations (including law  enforcement and emergency management officials), asset owners and  operators, and the National Guard, which is engaged as part of a joint  initiative between DHS and the National Guard Bureau. The National  Guard provides teams of subject matter experts experienced in conducting  vulnerability assessments. The private sector asset owners and operators  that volunteer for the SAV are the primary recipient of the SAV analysis,  which produces options for consideration to increase their ability to  detect and prevent terrorist attacks. In addition, it provides mitigating  options that address the identified vulnerabilities of the facility. The SAV is  developed using a questionnaire that focuses on various aspects of the  security of a facility, such as vulnerabilities associated with access to  facility air handling systems; physical security; and the ability to deter or  withstand a blast or explosion. Our review of the SAV questionnaire  showed that it focuses primarily on vulnerability issues related to the  protection of the facility. The SAV questionnaire also contains some  questions that focus on resiliency issues because it asks questions about  backup systems or contingencies for key systems, such as electrical  power, transportation, natural gas, water, and telecommunications  systems. Officials with IP’s PSCD said that they are working with IP’s Field  Operations Branch to update the SAV to include more questions intended  to capture the resiliency of a facility, especially since the SAV is used  during the RRAP. They said that the effort is ongoing and, as of June 8,  2010, DHS had developed a time line showing the revised SAV is to be  introduced in October or November 2010.
section_title: Enhanced Critical Infrastructure Protection (ECIP) Security Survey
paragraphs: DHS is also revising its ECIP security survey to further focus on resiliency  at individual facilities. Under the ECIP survey, PSAs meet with facility  owners and operators in order to provide awareness of the many  programs, assessments, and training opportunities available to the private  sector; educate owners and operators on security; and promote  communication and information sharing among asset owners and  operators, DHS, and state governments. ECIP visits are also used to  conduct security surveys using the ECIP security survey, a Web-based tool  developed by DHS to collect, process, and analyze vulnerability and  protective measures information during the course of a survey. The ECIP  security survey is also used to develop metrics; conduct sector-by-sector  and cross-sector vulnerability comparisons; identify security gaps and  trends across CIKR sectors and sub-sectors; establish sector baseline  security survey scores; and track progress toward improving CIKR  security through activities, programs, outreach, and training. Our review of  the ECIP security survey showed that the original version of the survey  made references to resiliency-related concepts—business continuity plans  and continuity of operations. The newest version of the survey, published  in June 2009, contains additional references to resiliency and resiliency- related concepts, including identifying whether or not a facility has backup  plans for key resources such as electrical power, natural gas,  telecommunications, and information technology systems. It is also used  to identify key dependencies critical to the operation of the facility, such  as water and wastewater, and to state whether backup plans exist for  service or access to these dependencies in the event of an interruption.  Further, senior IP officials told us that in addition to the updates on  resiliency in the latest version of the ECIP security survey, they plan to  incorporate 22 additional questions to a subsequent update of the survey  that will focus on determining the level of resiliency of a facility.  According to these officials, DHS also intends to use the updated survey to  develop a resiliency “dashboard” for CIKR owners and operators that is  intended to provide them a computerized tool that shows how the  resiliency of their facility compares with other similar facilities (see the  discussion below for a more detailed discussion of DHS’s ECIP  dashboard). A DHS document on revisions to the SAV showed that the  revised ECIP security survey is to be introduced at the same time as the  revised SAV (October or November 2010) so that data collection  associated with each remains compatible. DHS’s current projected release  of the updated ECIP security survey is planned for October 2010.
section_title: Program Management Could Be Improved by Measuring Efforts to Mitigate Resiliency Gaps Identified during Vulnerability Assessments
paragraphs: DHS intends to take further actions to enhance the programs and tools it  uses to work with asset owners and operators when assessing resiliency,  but it has not developed an approach to measure its effectiveness in  working with asset owners and operators in their efforts to adopt  measures to mitigate resiliency gaps identified during the various  vulnerability assessments. According to the NIPP, the use of performance  measures is a critical step in the NIPP risk management process to enable  DHS and the SSAs to objectively and quantitatively assess improvement in  CIKR protection and resiliency at the sector and national levels. The NIPP  states that while the results of risk analyses help sectors set priorities,  performance metrics allow NIPP partners to track progress against these  priorities and provide a basis for DHS and the SSAs to establish  accountability, document actual performance, facilitate diagnoses,  promote effective management, and provide a feedback mechanism to  decision makers. Consistent with the NIPP, senior DHS officials told us  that they have recently begun to measure the rate of asset owner and  operator implementation of protective measures following the conduct of  the ECIP security survey. Specifically, in a June 2010 memorandum to the  Assistant Secretary for NPPD, the Acting Director of PSCD stated that 234  (49 percent) of 437 sites where the ECIP security survey had been  conducted implemented protective measures during the 180-day period  following the conduct of the ECIP survey. The Acting Director reported  that the 234 sites made a total of 497 improvements across the various  categories covered by the ECIP security survey, including information  sharing, security management, security force, physical security, and  dependencies while 239 sites reported no improvements during the period.  The Acting Director stated that the metrics were the first that were  produced demonstrating the impact of the ECIP program, but noted that  PSCD is reexamining the collection process to determine whether  additional details should be gathered during the update to the ECIP  security survey planned for October 2010. However, because DHS has not  completed its efforts to include resiliency material as part of its  vulnerability assessment programs, it does not currently have performance  metrics of resiliency measures taken by asset owners and operators.
Moving forward, as DHS’s efforts to emphasize resiliency evolve through  the introduction of new or revised assessment programs and tools, it has  the opportunity to consider including additional metrics of resiliency  measures adopted at the facilities it assesses for vulnerability and risk,  particularly as it revises the ECIP security survey and develops the  resiliency dashboard. Moreover, DHS could consider developing similar  metrics for the SAV at individual facilities and the RRAP and mini-RAP in  the areas covered by RRAPs and mini-RAPs. By doing so, DHS could be  able to demonstrate its effectiveness in promoting resiliency among the  asset owners and operators it works with and would have a basis for  analyzing performance gaps. Regarding the latter, DHS managers would  have a valuable tool to help them assess where problems might be  occurring or alternatively provide insights into the tools used to assess  vulnerability and risk and whether they were focusing on the correct  elements of resiliency at individual facilities or groups of facilities.
section_title: DHS Has Made Training on Resiliency Available to PSAs, but Guidelines on PSA Roles and Responsibilities Do Not Reflect DHS’s Growing Emphasis on Resiliency
paragraphs: DHS uses PSAs to provide assistance to asset owners and operators on  CIKR protection strategies. Although DHS had begun to train PSAs about  resiliency and how it applies to the owners and operators they interact  with, DHS has not updated PSAs’ guidance that outlines their roles and  responsibilities to reflect DHS’s growing emphasis on resiliency. In April  2010, DHS provided a 1-hour training course called “An Introduction to  Resilience” to all PSAs at a conference in Washington, D.C. The training  was designed to define resilience; present resilience concepts, including  information on how resilience is tied to risk analysis and its link to  infrastructure dependencies and interdependencies; discuss how  resilience applies to PSAs, including a discussion of the aforementioned  updates to programs and tools used to do vulnerability assessments; and  explain how DHS’s focus on resilience can benefit asset owners and  operators. According to the Acting Deputy Director of PSCD, PSCD is  expected to deliver the training to PSAs again during regional conferences  to foster further discussions about resiliency and to give PSAs an  additional opportunity to ask questions about the training they received in  April 2010.
Although DHS’s training discusses how resiliency applies to PSAs and how  it can benefit asset owners and operators, DHS has not updated guidance  that discusses PSA roles and responsibilities related to resiliency. The  guidance DHS has provided to PSAs on certain key job tasks, issued in  2008, includes discussions about how PSAs are to (1) implement their role  and responsibilities during a disaster; (2) conduct vulnerability  assessments; and (3) establish or enhance existing strong relationships  between asset owners and operators and DHS, federal, state, and local law  enforcement personnel. However, the guidance does not articulate the role  of PSAs with regard to resiliency issues, or how PSAs are to promote  resiliency strategies and practices to asset owners and operators. For  example, our review of DHS’s engagement guidance for PSAs showed that  the guidance does not explicitly discuss resiliency; rather, it focuses  primarily on protection. Specifically, the executive summary of the  guidance states that one of the key infrastructure protection roles for DHS  in fiscal year 2008 was to form partnerships with the owners and operators  of the nation’s identified high-priority CIKR, known as level 1 and level 2  assets and systems. The guidance describes particular PSA responsibilities  with regard to partnerships, including (1) identifying protective measures  currently in place at these facilities and tracking the implementation of  any new measures into the future; (2) informing owners and operators of  the importance of their facilities in light of the ever-present threat of  terrorism; and (3) establishing or enhancing existing relationships  between owners and operators, DHS, and federal, state, and local law  enforcement personnel to provide increased situational awareness  regarding potential threats, knowledge of the current security posture at  each facility, and a federal resource to asset owners and operators. There  is one reference to a resiliency-related concept in an appendix where DHS  indicated that the criteria to identify level 2 assets in the Information  Technology sector should be “those assets that provide incident  management capabilities, specifically, sites needed for rapid restoration or  continuity of operations.”
PSA program officials said that they are currently developing guidelines on  a number of issues as DHS transitions from a CIKR program heavily  focused on protection to one that incorporates and promotes resiliency.  They said that PSAs do not currently have roles and responsibilities  specific to “resiliency” because resiliency is a concept that has only  recently gained significant and specific attention. They added that PSA  roles and responsibilities, while not specifically mentioning resiliency,  include component topics that comprise or otherwise contribute to  resiliency as it is now defined. Nonetheless, the Acting Deputy Director of  IP’s PSCD said that he envisions updating PSA guidance to incorporate  resiliency concepts and that he intends to outline his plan for doing so in  October 2010 as part of IP’s program planning process. However, he was  not specific about the changes he plans to make to address resiliency  concepts or whether the PSA’s roles and responsibilities related to  resiliency would be articulated. According to standards for internal  control in the federal government, management is responsible for  developing and documenting the detailed policies and procedures to  ensure that they are an integral part of operations. By updating PSA  guidance that discusses the role PSAs play in assisting asset owners and  operators, including how PSAs can work with them to mitigate  vulnerabilities and strengthen their security, PSA program officials would  be better positioned to help asset owners and operators have the tools  they need to develop resilience strategies. This would be consistent with  DHS efforts to train PSAs about resiliency and how it affects asset owners  and operators. Updating PSA guidelines to address resiliency issues would  also be consistent with DHS’s efforts to treat resiliency on an equal footing  with protection, and would comport with DHS guidance that calls for SSAs  to enhance their discussion of resiliency and resiliency strategies in SSPs.
section_title: DHS Could Better Position Itself to Disseminate Information about Resiliency Practices with Asset Owners and Operators within and across Sectors
paragraphs: DHS’s efforts to emphasize resiliency in the programs and tools it uses to  work with asset owners and operators also creates an opportunity for DHS  to better position itself to disseminate information about resiliency  practices to asset owners and operators within and across sectors.  Currently, DHS shares information on vulnerabilities and protective  measures on a case-by-case basis. However, while it is uniquely positioned  and has considered disseminating information about resiliency practices,  DHS faces barriers in doing so and has not developed an approach for  sharing this information more broadly, across sectors.
subsections: section_title: DHS Shares Information on Vulnerabilities and Protective Measures on a Case-by-Case Basis
paragraphs: According to the NIPP, its effective implementation is predicated on active  participation by government and private-sector partners in meaningful,  multidirectional information sharing. The NIPP states that when asset  owners and operators are provided with a comprehensive picture of  threats or hazards to CIKR and participate in ongoing multidirectional  information flow, their ability to assess risks, make prudent security  investments, and develop appropriate resiliency strategies is substantially  enhanced. Similarly, according to the NIPP, when the government is  provided with an understanding of private-sector information needs, it can  adjust its information collection, analysis, synthesis, and dissemination  accordingly. Consistent with the NIPP, DHS shares information on  vulnerabilities and potential protective measures with asset owners and  operators after it has collected and analyzed information during SAVs and  ECIP security surveys performed at their individual facilities. This  information includes vulnerabilities DHS has identified, and corresponding  steps these owners and operators can take to mitigate these  vulnerabilities, including options for consideration, which are suggestions  presented to owners and operators to help them resolve vulnerabilities  identified during DHS’s assessments. For example, DHS issues SAV  reports to owners and operators that, among other things, identify  vulnerabilities; help them identify their security posture; provide options  for consideration to increase their ability to detect and prevent terrorist  attacks; and enhance their ability to mitigate vulnerabilities. Regarding the  ECIP security survey, DHS provides owners and operators an ECIP  “dashboard” which shows the results for each component of the survey for  a facility using an index, called the Protective Measures Index (PMI),  which are scores DHS prepares for the facility and individual components  that can be compared to other similar facilities’ scores. SAV reports and  the ECIP dashboard generally focus on similar protection issues, such as  facility or physical security, security personnel, and access control. The  SAV reports and the ECIP dashboard discuss some continuity of  operations issues that could be considered resiliency related. For example,  the ECIP dashboard contains PMIs focused on whether the facility has a  continuity plan and conducts continuity exercises, while the SAV report  discusses whether the facility would be able to operate if resources such  as electricity, water, or natural gas were not available. As discussed  earlier, DHS is currently updating the SAV to include, among other things,  an assessment of resiliency characteristics and gaps, and is taking action  to develop a resiliency dashboard similar to that used under the ECIP  security survey.
Senior IP officials also stated that they share information on steps owners  and operators can take to protect their facilities via Common  Vulnerabilities, Potential Indicators, and Protective Measures (CV/PI/PM)  reports. DHS develops and disseminates these reports to various  stakeholders, generally on a need-to-know basis, including specific owners  and operators, such as those that have been included in assessments by  PSAs; law enforcement officials, emergency responders, and state  homeland security officials; and others who request access to the reports.  These reports, which focus on vulnerabilities and security measures  associated with terrorist attacks, are intended to provide information on  potential vulnerabilities and specific protective measures that various  stakeholders can implement to increase their security posture. According  to DHS, these reports are developed based on DHS’s experiences and  observations gathered from a range of security-related vulnerability  assessments, including SAVs, performed at infrastructures over time, such  as the chemical and commercial facilities sectors and subsectors and asset  types within those sectors, such as the chemical hazardous storage  industry or the restaurant industry, respectively. For example, like other  CV/PI/PM reports, DHS’s report on the restaurant industry gives a brief  overview of the industry; potential indicators of terrorist activity; common  vulnerabilities; and protective measures. Common vulnerabilities include  unrestricted public access and open access to food; potential indicators of  terrorist activity include arson, small arms attack, persons wearing  unusually bulky clothing to conceal explosives, and unattended packages;  and protective measures include developing a comprehensive security  plan to prepare for and respond to food tampering and providing  appropriate signage to restrict access to nonpublic areas. The CV/PI/PM  reports discuss aspects of resiliency such as infrastructure  interdependencies and incident response, but they do not discuss other  aspects of resiliency. For example, the report on restaurants discusses  protective measures including providing security and backup for critical  utility services, such as power or water––efforts that may also enhance the  resiliency of restaurants. Moving forward, as its efforts to emphasize  resiliency evolve, DHS could consider including other aspects of resiliency  in the CV/PI/PM reports.
section_title: DHS Is Uniquely Positioned to Disseminate Information about Resiliency Practices but Faces Barriers
paragraphs: Senior IP officials told us that they have considered ways to disseminate  information that DHS currently collects or plans to collect with regard to  resiliency. However, they have not explored the feasibility of developing  an approach for doing so. Senior IP officials explained that given the  voluntary nature of the CIKR partnership, DHS should not be viewed as  identifying or promoting practices, particularly best practices, which could  be construed to be standards or requirements. They said that DHS goes to  great lengths to provide assurance to owners and operators that the  information gathered during assessments will not be provided to  regulators. They also stated that they provide owners and operators  assurance that they will not share proprietary information with  competitors. For example, certain information that they collect is  protected under the Protected Critical Infrastructure Information (PCII)  program, which institutes a means for the voluntary sharing of certain  private sector, state, and local CIKR information with the federal  government while providing assurance that the information will be exempt  from disclosure under the Freedom of Information Act, among other  things, and will be properly safeguarded. DHS has established a PCII  program office, which among other things, is responsible for validating  information provided by CIKR partners as PCII, and developing protocols  to access and safeguard information that is deemed PCII.
IP senior officials further explained that DHS relies on its private-sector  partners to develop and share information on practices they use to  enhance their protection and resilience. They said that the practices  shared by sector partners, including best practices, are largely identified  and developed by the private sector, at times with the support of its  partners in government such as the SSAs. DHS facilitates this process by  making various mechanisms available for information sharing, including  information they deem to be best practices. For example, according to  senior IP officials, DHS’s Homeland Security Information Network-Critical  Sectors (HSIN-CS) was designed to provide each sector a portal to post  useful or important information, such as activities or concepts that  private-sector partners discern to be best practices on protection and  resiliency topics. They also said that one factor to consider is that  resiliency can mean different things to different sectors, as measures or  strategies that are applicable or inherent to one sector may not be  applicable to another given the unique characteristics of each sector. For  example, the energy sector, which includes oil refineries, is inherently  different than the government facilities sector, which includes government  office buildings. In our March 2010 report on DHS’s increased emphasis on  resilience in the NIPP, we reported that DHS officials told us that the  balance between protection and resiliency is unique to each sector and the  extent to which any one sector increases the emphasis on resiliency in its  sector-specific plans will depend on the nature of the sector and the risks  to its CIKR. Further, the Branch Chief of IP’s Office of Information  Coordination and Analysis Office explained that differences in corporate  cultures across the spectrum of companies could be a barrier to widely  disseminating information on resiliency practices because it is often  challenging to translate information, such as what constitutes a success or  failure, from one company to another. He further stated that differences in  the regulatory structures affecting different industries may be a factor that  could limit the extent to which certain types of information could be  disseminated.
We recognize that DHS faces barriers to sharing information it gathers on  resiliency practices within and among sectors. However, as the primary  federal agency responsible for coordinating and enhancing the protection  and resiliency of critical infrastructure across the spectrum of CIKR  sectors, DHS is uniquely positioned to disseminate this information which  would be consistent with the NIPP’s emphasis on information sharing. By  working to explore ways to address any challenges or barriers to sharing  resiliency information, DHS could build upon the partnering and  information-sharing arrangements that CIKR owners and operators use in  their own communities. For example, our work at CIKR assets along the  Gulf Coast in Texas and in southern California showed that asset owners  and operators viewed resiliency as critical to their facilities because it is in  their best interests to either keep a facility operating during and after an  event, or rebound as quickly as possible following an event. They said that  they rely on a variety of sources for information to enhance their ability to  be more resilient if a catastrophic event occurs, including information- sharing or partnering arrangements within and among CIKR partners and  their local communities. Each of the 15 owners and operators we  contacted in Texas and California said that they have partnering  relationships with their sector coordinating councils, local/state  government, law enforcement, emergency management, or mutual aid  organizations. Furthermore, 14 of the 15 said that they work with these  organizations to share information, including best practices and lessons  learned, from recent disasters. Among the owners and operators we  contacted:    Representatives of one facility said that following a recent event, their  company shared lessons learned with the local mutual aid association  and various trade associations. These officials said that they also share  best practices within the industry and across their facilities in other  locations on an ongoing basis and that the company is currently  organizing a committee made up of security staff from each facility  within the organization whose primary responsibility is expected to be  the sharing of best practices.
Officials representing another facility told us that following an event or  a drill, they critique the event and their response to garner any lessons  learned or best practices. They said that they share information with  the local fire department and a regional trade association. These  officials stated that they will share information with other trade  association members if they believe that it would be beneficial to  others, but will not discuss proprietary information.
Officials representing a different facility said that, following a  hurricane in the same area, the company’s managers from various  facilities met to share lessons learned and adopted best practices from  other facilities within the same company and with external partners,  including a mutual aid organization and local emergency responders.  They said that they also have learned from the experiences of others— after an explosion at a similar company’s facility, they became aware  that the other company had located its administration building too  close to the company’s operations, thereby jeopardizing employee  safety.
By developing an approach for disseminating information it gathers or  intends to gather with regard to resiliency, DHS would then be in a  position to reach a broader audience across sectors or in different  geographic locations. Senior IP officials said that they agree that  disseminating information on resiliency practices broadly across the CIKR  community would be a worthwhile exercise, but questioned whether they  would be the right organization within DHS to develop an approach for  sharing resiliency information. They said that IP does not currently have  the resources to perform this function and suggested that an organization  like the Federal Emergency Management Agency (FEMA) might be more  appropriate for sharing information on resiliency because it already has  mechanisms in place to share information on practices organizations can  adopt to deal with all-hazards events, including terrorism. For example,  FEMA manages DHS’s Lessons Learned Information Sharing portal, called  LLIS.gov, which is a national online network of lessons learned and best  practices designed to help emergency response providers and homeland  security officials prevent, prepare for, and respond to all hazards,  including terrorism. According to FEMA officials, LLIS.gov contains  information on critical infrastructure protection and resiliency and system  users, such as state and local government officials, are encouraged to  submit content which is then vetted and validated by subject matter  experts before being posted to the system. FEMA officials explained that  FEMA does not actively collect information from system users, but  encourages them to submit documents for review and possible inclusion  into LLIS.gov. According to FEMA, access to LLIS.gov is restricted to  members that request access to the system, particularly emergency  response providers and homeland security officials. In March 2010,  FEMA’s Outreach and Partnerships Coordinator for Lessons Learned  Information Sharing told us that LLIS.gov had about 55,000 members, of  which approximately 89 percent were representatives of state and local  government; about 6 percent were representatives of private-sector  organizations; and about 5 percent were representatives of the federal  government.
Regardless of which DHS organization would be responsible for  disseminating information on resiliency practices, we recognize that DHS  will face challenges in addressing any barriers it believes could hinder its  ability to disseminate resiliency information. As part of this effort, DHS  would have to determine what resiliency information it is collecting or  plans to collect that might be most appropriate to share and what  safeguards would be needed to protect against the disclosure of  proprietary information within the confines of the voluntary nature of the  CIKR partnership. Also, in doing so, DHS could consider some of the  following questions:    What additional actions, if any, would DHS need to take to convey that  the information is being gathered within the voluntary framework of  the CIKR partnership?
To what extent does DHS need to take additional actions, if any, to  provide assurance that the information being disseminated is  nonregulatory and nonbinding on the owners and operators that  access it?
What additional mechanisms, if any, does DHS need to establish to  provide assurance that reinforces the PCII process and how can  resiliency practices information be presented to avoid disclosures of  information that is PCII security sensitive or proprietary in nature?
What mechanism or information system is most suitable for  disseminating resiliency practices information, and which DHS  component would be responsible for managing this mechanism or  system?
What approach should DHS take to review the information before it is  disseminated to ensure that resiliency practices identified by DHS at  one facility or in one sector are valid and viable, and applicable across  facilities and sectors?
What additional resources and at what additional cost, if any, would  DHS need to devote to gathering and broadly disseminating  information about resiliency practices across facilities and sectors?
What actions can DHS take to measure the extent to which asset  owners and operators are using resiliency information provided by  DHS, and how can DHS use this information to make improvements, if  needed?
By determining the feasibility of overcoming barriers and developing an  approach for disseminating resiliency information, DHS could better  position itself to help asset owners and operators consider and adopt  resiliency strategies, and provide them with information on potential  security investments, based on the practices and experiences of their  peers both within and across sectors.
section_title: Conclusions
paragraphs: In the wake of concerns by stakeholders, including members of Congress,  academia, and the private sector that DHS was placing emphasis on  protection rather than resilience, DHS has increased its emphasis on  critical infrastructure resiliency in the NIPP. Consistent with these  changes, DHS has also taken actions to increase its emphasis on resilience  in the programs and tools it uses to assess vulnerability and risk that are  designed to help asset owners and operators identify resiliency  characteristics and gaps. These actions continue to evolve and could be  improved if DHS were to strengthen program management by developing  measures to assess the extent to which asset owners and operators are  taking actions to address resiliency gaps identified during vulnerability  assessments; and updating PSA guidelines to articulate PSA roles and  responsibilities with regard to resiliency during their interactions with  asset owners and operators. By developing performance measures to  assess the extent to which asset owners and operators are taking actions  to resolve resiliency gaps identified during the various vulnerability  assessments, DHS would, consistent with the NIPP, be better positioned to  demonstrate effectiveness in promoting resiliency among the asset owners  and operators it works with and would have a basis for analyzing  performance gaps. DHS managers would also have a valuable tool to help  them assess where problems might be occurring, or alternatively provide  insights into the tools used to assess vulnerability and risk and whether  they were focusing on the correct elements of resiliency at individual  facilities or groups of facilities. Furthermore, by updating PSA guidance to  discusses the role PSAs play during interaction with asset owners and  operators, including how PSAs can work with them to mitigate  vulnerabilities and strengthen their security, DHS would have greater  assurance that PSAs are equipped to help asset owners and operators have  the tools they need to develop resilience strategies. This would also be  consistent with DHS efforts to train PSAs about resiliency and how it  affects asset owners and operators.
Related to its efforts to develop or update its programs designed to assess  vulnerability at asset owners’ and operators’ individual facilities and  groups of facilities, DHS has considered how it can disseminate  information on resiliency practices it gathers or plans to gather with asset  owners and operators within and across sectors. However, it faces barriers  in doing so because it would have to overcome perceptions that it is  advancing or promoting standards that have to be adopted and concerns  about sharing proprietary information. We recognize that DHS would face  challenges disseminating information about resiliency practices within and  across sectors, especially since resiliency can mean different things to  different sectors. Nonetheless, as the primary federal agency responsible  for coordinating and enhancing the protection and resiliency of critical  infrastructure across the spectrum of CIKR sectors, DHS is uniquely  positioned to disseminate this information. By determining the feasibility  of overcoming barriers and developing an approach for disseminating  resiliency information, DHS could better position itself to help asset  owners and operators consider and adopt resiliency strategies, and  provide them with information on potential security investments, based on  the practices and experiences of their peers within the CIKR community,  both within and across sectors.
section_title: Recommendations for Executive Action
paragraphs: To better ensure that DHS’s efforts to incorporate resiliency into its  overall CIKR protection efforts are effective and completed in a timely and  consistent fashion, we recommend that the Assistant Secretary for  Infrastructure Protection take the following two actions:    develop performance measures to assess the extent to which asset  owners and operators are taking actions to resolve resiliency gaps  identified during the various vulnerability assessments; and   update PSA guidance that discusses the role PSAs play during  interactions with asset owners and operators with regard to resiliency,  which could include how PSAs work with them to emphasize how  resiliency strategies could help them mitigate vulnerabilities and  strengthen their security posture and provide suggestions for  enhancing resiliency at particular facilities.
Furthermore, we recommend that the Secretary of Homeland Security  assign responsibility to one or more organizations within DHS to  determine the feasibility of overcoming barriers and developing an  approach for disseminating information on resiliency practices to CIKR  owners and operators within and across sectors.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Secretary of Homeland Security  for review and comment. In written comments DHS agreed with two of  our recommendations and said that it needed additional time to internally  consider the third. Regarding our first recommendation that IP develop  performance measures to assess the extent to which asset owners and  operators are taking actions to resolve resiliency gaps identified during  vulnerability assessments, DHS said that IP had developed measures on  owners’ and operators’ efforts to implement enhancements to security and  resilience, and NPPD officials are reviewing these new performance  metrics. With regard to our second recommendation to update guidance  that discusses the role PSAs play during interactions with asset owners  and operators about resiliency, DHS said that IP is actively updating PSA  program guidance to reflect the evolving concept of resilience and will  include information on resilience in the next revision to the PSA program  management plan. Finally, regarding our third recommendation that DHS  assign responsibility to one or more organizations within DHS to  determine the feasibility of developing an approach for disseminating  information on resiliency practices, DHS said that its components need  time to further consider the recommendation and will respond to GAO and  Congress at a later date. DHS also provided technical comments which we  incorporated as appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  issue date. At that time, we will send copies of this report to the Secretary  of Homeland Security, the Under Secretary for the National Protection  Programs Directorate, appropriate congressional committees, and other  interested parties. If you have any further questions about this report,  please contact me at (202) 512-8777 or caldwells@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Key contributors to this report are listed in  appendix II.
section_title: Appendix I: Comments from the Department of Homeland Security
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, John F. Mortin, Assistant Director,  and Katrina R. Moss, Analyst-in-Charge, managed this assignment.  Katherine M. Davis, Anthony J. DeFrank, Michele C. Fejfar, Tracey L. King,  Landis L. Lindsey, Thomas F. Lombardi, Lara R. Miklozek, Steven R.  Putansu, Edith N. Sohna, and Alex M. Winograd made significant  contributions to the work.
section_title: Related GAO Products
paragraphs: Critical Infrastructure Protection: Updates to the 2009 National  Infrastructure Protection Plan and Resiliency in Planning. GAO-10-296.  Washington, D.C.: March 5, 2010.
The Department of Homeland Security’s (DHS) Critical Infrastructure  Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.: June 26,  2009.
Influenza Pandemic: Opportunities Exist to Address Critical  Infrastructure Protection Challenges That Require Federal and Private  Sector Coordination. GAO-08-36. Washington, D.C.: October 31, 2007.
Critical Infrastructure: Sector Plans Complete and Sector Councils  Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.
Critical Infrastructure Protection: Sector Plans and Sector Councils  Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007.
Critical Infrastructure: Challenges Remain in Protecting Key Sectors.  GAO-07-626T. Washington, D.C.: March 20, 2007.
Critical Infrastructure Protection: Progress Coordinating Government  and Private Sector Efforts Varies by Sectors’ Characteristics. GAO-07-39.  Washington, D.C.: October 16, 2006.
Critical Infrastructure Protection: Challenges for Selected Agencies and  Industry Sectors. GAO-03-233. Washington, D.C.: February 28, 2003.
Critical Infrastructure Protection: Commercial Satellite Security Should  Be More Fully Addressed. GAO-02-781. Washington, D.C.: August 30, 2002.
subsections: section_title: Cyber Security
paragraphs: Critical Infrastructure Protection: Current Cyber Sector-Specific  Planning Approach Needs Reassessment. GAO-09-969. Washington, D.C.:  September 24, 2009.
Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical  Systems and Information. GAO-09-835T. Washington, D.C.: June 25, 2009.
Information Security: Cyber Threats and Vulnerabilities Place Federal  Systems at Risk. GAO-09-661T. Washington, D.C.: May 5, 2009.
National Cybersecurity Strategy: Key Improvements Are Needed to  Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.: March  10, 2009.
Critical Infrastructure Protection: DHS Needs to Better Address Its  Cybersecurity Responsibilities. GAO-08-1157T. Washington, D.C.:  September 16, 2008.
Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington,  D.C.: September 9, 2008.
Cyber Analysis and Warning: DHS Faces Challenges in Establishing a  Comprehensive National Capability. GAO-08-588. Washington, D.C.: July  31, 2008.
Critical Infrastructure Protection: Further Efforts Needed to Integrate  Planning for and Response to Disruptions on Converged Voice and Data  Networks. GAO-08-607. Washington, D.C.: June 26, 2008.
Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key  Cyber Security Elements Varies. GAO-08-64T. Washington, D.C.: October  31, 2007.
Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key  Cyber Security Elements Varies. GAO-08-113. October 31, 2007.
Critical Infrastructure Protection: Multiple Efforts to Secure Control  Systems are Under Way, but Challenges Remain. GAO-07-1036.  Washington, D.C.: September 10, 2007.
Critical Infrastructure Protection: DHS Leadership Needed to Enhance  Cybersecurity. GAO-06-1087T. Washington, D.C.: September 13, 2006.
Critical Infrastructure Protection: Challenges in Addressing  Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005.
Critical Infrastructure Protection: Department of Homeland Security  Faces Challenges in Fulfilling Cybersecurity Responsibilities.  GAO-05-434. Washington, D.C.: May 26, 2005.
Critical Infrastructure Protection: Improving Information Sharing with  Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.
Technology Assessment: Cybersecurity for Critical Infrastructure  Protection. GAO-04-321. Washington, D.C.: May 28, 2004.
Critical Infrastructure Protection: Establishing Effective Information  Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.:  April 21, 2004.
Critical Infrastructure Protection: Challenges and Efforts to Secure  Control Systems. GAO-04-628T. Washington, D.C.: March 30, 2004.
Critical Infrastructure Protection: Challenges and Efforts to Secure  Control Systems. GAO-04-354. Washington, D.C.: March 15, 2004.
Posthearing Questions from the September 17, 2003, Hearing on  “Implications of Power Blackouts for the Nation’s Cybersecurity and  Critical Infrastructure Protection: The Electric Grid, Critical  Interdependencies, Vulnerabilities, and Readiness”. GAO-04-300R.  Washington, D.C.: December 8, 2003.
Critical Infrastructure Protection: Challenges in Securing Control  Systems. GAO-04-140T. Washington, D.C.: October 1, 2003.
Critical Infrastructure Protection: Efforts of the Financial Services  Sector to Address Cyber Threats. GAO-03-173. Washington, D.C.: January  30, 2003.
High-Risk Series: Protecting Information Systems Supporting the  Federal Government and the Nation’s Critical Infrastructures.  GAO-03-121. Washington, D.C.: January 1, 2003.
Critical Infrastructure Protection: Federal Efforts Require a More  Coordinated and Comprehensive Approach for Protecting Information  Systems. GAO-02-474. Washington, D.C.: July 15, 2002.
Critical Infrastructure Protection: Significant Challenges in  Safeguarding Government and Privately Controlled Systems from  Computer-Based Attacks. GAO-01-1168T. Washington, D.C.: September 26,  2001.
Critical Infrastructure Protection: Significant Challenges in Protecting  Federal Systems and Developing Analysis and Warning Capabilities.  GAO-01-1132T. Washington, D.C.: September 12, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  Analysis, Warning, and Response Capabilities. GAO-01-1005T.  Washington, D.C.: July 25, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  Analysis, Warning, and Response Capabilities. GAO-01-769T.  Washington, D.C.: May 22, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  National Capabilities. GAO-01-323. Washington, D.C.: April 25, 2001.
Critical Infrastructure Protection: Challenges to Building a  Comprehensive Strategy for Information Sharing and Coordination.  GAO/T-AIMD-00-268. Washington, D.C.: July 26, 2000.
Critical Infrastructure Protection: Comments on the Proposed Cyber  Security Information Act of 2000. GAO/T-AIMD-00-229. Washington, D.C.:  June 22, 2000.
Critical Infrastructure Protection: “ILOVEYOU” Computer Virus  Highlights Need for Improved Alert and Coordination Capabilities.  GAO/T-AIMD-00-181. Washington, D.C.: May 18, 2000.
Critical Infrastructure Protection: National Plan for Information  Systems Protection. GAO/AIMD-00-90R. Washington, D.C.: February 11,  2000.
Critical Infrastructure Protection: Comments on the National Plan for  Information Systems Protection. GAO/T-AIMD-00-72. Washington, D.C.:  February 1, 2000.
Critical Infrastructure Protection: Fundamental Improvements Needed  to Assure Security of Federal Operations. GAO/T-AIMD-00-7. Washington,  D.C.: October 6, 1999.
Critical Infrastructure Protection: Comprehensive Strategy Can Draw  on Year 2000 Experiences. GAO/AIMD-00-1. Washington, D.C.: October 1,  1999.
section_title: Defense Critical Infrastructure Protection
paragraphs: Defense Critical Infrastructure: Actions Needed to Improve  Identification and Management of Electrical Power Risks and  Vulnerabilities to DoD Critical Assets. GAO-10-147. October 23, 2009.
Defense Critical Infrastructure: Actions Needed to Improve the  Consistency, Reliability, and Usefulness of DOD’s Tier 1 Task Critical  Asset List. GAO-09-740R. Washington, D.C.: July 17, 2009.
Defense Critical Infrastructure: Developing Training Standards and an  Awareness of Existing Expertise Would Help DOD Assure the  Availability of Critical Infrastructure. GAO-09-42. Washington, D.C.:  October 30, 2008.
Defense Critical Infrastructure: Adherence to Guidance Would Improve  DOD’s Approach to Identifying and Assuring the Availability of Critical  Transportation Assets. GAO-08-851. Washington, D.C.: August 15, 2008.
Defense Critical Infrastructure: DOD’s Risk Analysis of Its Critical  Infrastructure Omits Highly Sensitive Assets. GAO-08-373R. Washington,  D.C.: April 2, 2008.
Defense Infrastructure: Management Actions Needed to Ensure  Effectiveness of DOD’s Risk Management Approach for the Defense  Industrial Base. GAO-07-1077. Washington, D.C.: August 31, 2007.
Defense Infrastructure: Actions Needed to Guide DOD’s Efforts to  Identify, Prioritize, and Assess Its Critical Infrastructure. GAO-07-461.  Washington, D.C.: May 24, 2007.
section_title: Electrical Power
paragraphs: Electricity Restructuring: FERC Could Take Additional Steps to Analyze  Regional Transmission Organizations’ Benefits and Performance.  GAO-08-987. Washington, D.C.: September 22, 2008.
Department of Energy, Federal Energy Regulatory Commission:  Mandatory Reliability Standards for Critical Infrastructure Protection.  GAO-08-493R. Washington, D.C.: February 21, 2008.
Electricity Restructuring: Key Challenges Remain. GAO-06-237.  Washington, D.C.: November 15, 2005.
Meeting Energy Demand in the 21st Century: Many Challenges and Key  Questions. GAO-05-414T. Washington, D.C.: March 16, 2005.
Electricity Restructuring: Action Needed to Address Emerging Gaps in  Federal Information Collection. GAO-03-586. Washington, D.C.: June 30,  2003.
Restructured Electricity Markets: Three States’ Experiences in Adding  Generating Capacity. GAO-02-427. Washington, D.C.: May 24, 2002.
Energy Markets: Results of FERC Outage Study and Other Market Power  Studies. GAO-01-1019T. Washington, D.C.: August 2, 2001.
section_title: Other
paragraphs: Combating Terrorism: Observations on National Strategies Related to  Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.
Critical Infrastructure Protection: Significant Challenges Need to Be  Addressed. GAO-02-961T. Washington, D.C.: July 24, 2002.
Critical Infrastructure Protection: Significant Homeland Security  Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9,  2002.