Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience
Published: 2010-03-05T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: According to the Department of Homeland Security (DHS), there are thousands of facilities in the United States that if destroyed by a disaster could cause casualties, economic losses, or disruptions to national security. The Homeland Security Act of 2002 gave DHS responsibility for leading and coordinating the nation's effort to protect critical infrastructure and key resources (CIKR). Homeland Security Presidential Directive 7 (HSPD-7) defined responsibilities for DHS and certain federal agencies--known as sector-specific agencies (SSAs)--that represent 18 industry sectors, such as energy. In accordance with the Homeland Security Act and HSPD-7, DHS issued the National Infrastructure Protection Plan (NIPP) in June 2006 to provide the approach for integrating the nation's CIKR. GAO was asked to study DHS's January 2009 revisions to the NIPP in light of a debate over whether DHS has emphasized protection--to deter threats, mitigate vulnerabilities, or minimize the consequences of disasters---rather than resilience---to resist, absorb, or successfully adapt, respond to, or recover from disasters. This report discusses (1) how the 2009 NIPP changed compared to the 2006 NIPP and (2) how DHS and SSAs addressed resiliency as part of their planning efforts. GAO compared the 2006 and 2009 NIPPs, analyzed documents, including NIPP Implementation Guides and sector- specific plans, and interviewed DHS and SSA officials from all 18 sectors about their process to identify potential revisions to the NIPP and address resiliency.
section_title: What GAO Found
paragraphs: Compared to the 2006 NIPP, DHS's 2009 update to the NIPP incorporated various changes, including a greater emphasis on regional CIKR protection planning and updates to DHS's overall risk management framework, such as instructions for sectors to develop metrics to gauge how well programs reduced the risk to their sector. For example, in the 2006 NIPP, DHS encouraged stakeholders to address CIKR across sectors within and across geographic regions; by contrast, the 2009 NIPP called for regional coordination through the formation of a consortium of representatives from multiple regional organizations. DHS also enhanced its discussion of risk management methodologies in the 2009 NIPP. The 2006 NIPP listed the minimum requirements for conducting risk analyses, while the 2009 NIPP includes the use of a common risk assessment approach, including the core criteria for these analyses to allow the comparison of risk across sectors. DHS officials said that the changes highlighted in the 2009 NIPP were the result of knowledge gained and issues raised during discussions with partners and outside organizations like GAO. DHS has also issued guidance for SSAs to consider revisions to the NIPP when updating their sector-specific plans (SSPs). Fourteen of 18 SSA representatives that responded to our query said they used a process similar to DHS's to incorporate NIPP changes into their SSPs. They reported that they intend to discuss the expectations for the SSP with DHS, draft the SSP based on their knowledge of their sectors, and obtain input and feedback from stakeholders. DHS increased its emphasis on resiliency in the 2009 NIPP by discussing it with the same level of importance as protection. While the 2009 NIPP uses much of the same language as the 2006 NIPP to describe resiliency, the 2006 NIPP primarily treated resiliency as a subset of protection while the 2009 NIPP generally referred to resiliency alongside protection. For example, while the Managing Risk chapter of the 2006 NIPP has a section entitled "Characteristics of Effective Protection Programs," the same chapter in the 2009 NIPP has a section entitled, "Characteristics of Effective Protection Programs and Resiliency Strategies." DHS officials stated that these changes are not a major shift in policy; rather they are intended to raise awareness about resiliency as it applies within individual sectors. Furthermore, they stated that there is a greater emphasis on resilience in the 2009 NIPP to encourage more sector and cross-sector activities to address a broader spectrum of risks, such as cyber security. DHS officials also used guidance to encourage SSAs to devote more attention to resiliency. For example, in the 2009 guidance, SSAs are advised that in sectors where infrastructure resiliency is as or more important than physical security, they should focus on describing the resiliency measures and strategies being used by the sector. The 2010 updates to the SSPs are due to be released by DHS in mid-2010 and all sector representatives who responded to our questions said they will address the issue as is appropriate for their sectors. In commenting on a draft of this report, DHS reiterated its process for updating the NIPP and its views on resiliency.

section_title: Letter
paragraphs: According to the Department of Homeland Security (DHS), there are  thousands of facilities in the United States that if degraded or destroyed by  a manmade or natural disaster could cause some combination of  significant casualties, major economic losses, or widespread and long-term   disruptions to national well-being and governance capacity. There are also  networks and systems—including cyber networks that support physical  infrastructure—that are vulnerable and valuable.  Damages to these  facilities, networks, and systems and the economic impact of their  destruction could easily run into the billions of dollars.
The Homeland Security Act of 2002 created DHS and gave the department  wide-ranging responsibilities for, among other things, leading and  coordinating the overall national critical infrastructure protection effort.   For example, the act required DHS to (1) develop a comprehensive  national plan for securing the nation’s critical infrastructures and key  resources (CIKR) and (2) recommend measures to protect CIKR in  coordination with other agencies of the federal government and in  cooperation with state and local government agencies and authorities, the  private sector, and other entities.  Homeland Security Presidential  Directive 7 (HSPD-7) further defined critical infrastructure protection  responsibilities for DHS and those federal agencies—known as sector- specific agencies (SSA)—responsible for particular industry sectors, such  as transportation, energy, and communications. For example, the  Department of the Treasury as the SSA is responsible for the banking and  finance sector while the Department of Energy as the SSA is responsible  for the energy sector. HSPD-7 directed DHS to establish uniform policies,  approaches, guidelines, and methodologies for integrating federal  infrastructure protection and risk management activities within and across  17 sectors. The directive also gave DHS the authority to establish  additional sectors and in 2008, DHS created an 18th sector for critical  manufacturing.   We placed the protection of the federal government’s  information systems and the nation’s critical infrastructures on our high- risk list in 1997.  We consider this area high risk because federal agencies  and our nation’s critical infrastructures—such as power distribution,  water treatment and supply, telecommunications, national defense, and  emergency services—rely extensively on computerized information  systems and electronic data to carry out their operations. The security of  these systems and data is essential to preventing disruptions in critical  operations, fraud, and inappropriate disclosure of sensitive information.  Protecting federal computer systems and the systems that support critical  infrastructures—referred to as cyber critical infrastructure protection, or  cyber CIP—is a continuing concern.
In accordance with the Homeland Security Act and in response to HSPD-7,  DHS issued, in June 2006, the first National Infrastructure Protection Plan  (NIPP), which provides the overarching approach for integrating the  nation’s CIKR protection initiatives in a single effort. DHS issued a revised  NIPP in January 2009. The NIPP sets forth a risk management framework  and details the roles and responsibilities of DHS, SSAs, and other federal,  state, regional, local, tribal, territorial, and private sector partners,  including how they should use risk management principles to prioritize  protection activities within and across sectors. Within the NIPP  framework, DHS has emphasized the importance of collaboration and  partnering with and among the various partners and its reliance on  voluntary information sharing between the private sector and DHS. The  NIPP provides the framework for developing, implementing, and  maintaining a coordinated national effort to protect CIKR in the 18  sectors. Each of the CIKR sectors is represented in the federal planning  process by a sector-specific agency; a government coordinating council to  represent each sector’s interests among government agencies; and a sector  coordinating council  that includes private sector representatives of the  sector. Each sector is responsible for developing sector-specific plans  (SSPs) and sector annual reports (SARs). In 2007, each SSA then operating  published an SSP that mirrored and applied the NIPP framework. SSPs are  to be updated, like the NIPP, every 3 years and the second iteration of  SSPs is due in 2010. In addition, beginning in 2006 each sector then  operating was to produce a SAR that is expected to focus on sector goals,  priorities, and SSP implementation. “The challenge facing government is to maintain its role in protecting critical  infrastructures, while determining how best to encourage market forces to improve the  resilience of companies, provide appropriate incentives and tools to help entire sectors  become resilient, and step in when market forces alone cannot produce the level of  infrastructure security needed to protect citizens, communities, and essential economic  systems.”
Given the debate over DHS’s emphasis on protection rather than  resilience, you asked us to study DHS’s revisions to the NIPP and efforts  by DHS to address resiliency as part of its national planning efforts.   Specifically, this report addresses the following questions  1.  How has the 2009 NIPP changed compared to the 2006 NIPP and what  process was used to identify and incorporate these changes? and  2.  How have DHS and SSAs addressed the concept of critical  infrastructure resiliency as part of their national CIKR and sector- specific planning efforts?
To describe the changes DHS has made to the NIPP since it was first  published in 2006 and the process used to identify and incorporate these  changes, we compared the 2006 and 2009 versions of the NIPP and  reviewed the changes that have occurred.  We also interviewed DHS NIPP  Program Management Office (PMO) officials responsible for developing  and coordinating the NIPP revisions to discuss the process they used to  identify potential revisions and why changes were made.  We analyzed  DHS’s 2006 and 2009 SSP guidance that supports the NIPP to determine  what changes were made in the 2009 guidance which is designed to help  ensure that SSAs develop SSPs consistent with the 2009 NIPP.   Furthermore, we interviewed NIPP PMO officials about their efforts to  work with SSAs in developing plans and reports based on the guidance  provided and asked SSAs about the process they used to address changes  to the NIPP in their SSPs.  We also interviewed SSA representatives for all  18 critical infrastructure sectors and asked them how they planned to  address the changes to the NIPP in their 2010 SSPs.
To determine how DHS and the SSAs have addressed the concept of  critical infrastructure resiliency as part of their national CIKR protection  planning efforts, we collected and analyzed documentary and testimonial  evidence from DHS and SSAs.  Specifically, we reviewed the 2006 and 2009  NIPP and the NIPP Implementation Guides to compare how often and in  what context the concept of resiliency was used between those dates of  publication.  We limited our analysis to how often and where resiliency- related terms—resilience, resiliency, resilient, and continuity (business or  operational continuity)—were used in the plans and corresponding  guidance. In commenting on our approach, DHS said this is a reasonable  set of terms for our analysis. We also reviewed the sector-specific  planning documents (e.g., SSPs ) of the sectors that were issued based on  the 2006 NIPP Implementation Guide and assessed how the concept of  resiliency was addressed by the individual sectors.   Finally, we  interviewed SSA officials for all 18 sectors to determine how they plan to  address the concept of resiliency in their 2010 SSPs.
We conducted this performance audit from August 2009 through February  2010 in accordance with generally accepted auditing standards. These  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our objectives.
subsections: section_title: Background
paragraphs: The NIPP provides the framework for developing, implementing, and  maintaining a coordinated national effort to bring together government at  all levels, the private sector, nongovernmental organizations, and  international partners to manage the risks to CIKR.  In addition to the  Homeland Security Act, various statutes provide legal authority for both  cross-sector and sector-specific protection and resiliency programs.  For  example, the Public Health Security and Bioterrorism Preparedness and  Response Act of 2002 was intended to improve the ability of the United  States to prevent, prepare for, and respond to acts of bioterrorism and  other public health emergencies and the Pandemic and All-Hazards  Preparedness Act addresses public health security and all-hazards  preparedness and response.  Also, the Cyber Security Research and  Development Act of 2002 authorized funding for the National Institute of  Standards and Technology (NIST) and the National Science Foundation to  facilitate increased research and development for computer and network  security and to support research fellowships and training.   CIKR  protection issues are also covered under various presidential directives,  including HSPD-5 and HSPD-8.   HSPD-5 calls for coordination among all  levels of government as well as between the government and the private  sector for domestic incident management, and HSPD-8 establishes policies  to strengthen national preparedness to prevent, detect, respond to, and  recover from threatened domestic terrorist attacks and other  emergencies. These separate authorities and directives are tied together  as part of the national approach for CIKR protection through the unifying  framework established in HSPD-7.
The NIPP outlines the roles and responsibilities of DHS and other security  partners—including other federal agencies, state, territorial, local, and  tribal governments, and private companies. Within the NIPP framework,  DHS is responsible for leading and coordinating the overall national effort  to enhance protection via 18 CIKR sectors. The NIPP is prepared by the  NIPP Program Management Office (PMO) within the Infrastructure  Protection office of the National Preparedness and Protection Directorate  of DHS.  The NIPP PMO has the responsibility for coordinating and  ensuring development, implementation, and maintenance of the NIPP and  the associated sector-specific plans.
HSPD-7 and the NIPP assign responsibility for CIKR sectors to SSAs.  As  an SSA, DHS has direct responsibility for leading, integrating, and  coordinating efforts of sector partners to protect 11 CIKR sectors.  The  remaining sectors are coordinated by eight other federal agencies.  The  NIPP depends on supporting SSPs for full implementation of this  framework within and across CIKR sectors. SSPs are developed by the  SSAs designated in HSPD-7 in close collaboration with sector partners,  including sector and government coordinating councils. These SSPs  contain the plan to identify and address the risks to CIKR specific to each  sector and are reviewed by DHS for adherence to DHS guidance which  follows the format of the NIPP.  Table 1 lists the SSAs and their sectors.
The concept of resilience has gained particular importance and application  in a number of areas of federal CIKR planning. Both Congress and  executive branch agencies have addressed resilience in relation to the  importance of the recovery of the nation’s critical infrastructure from  damage.  In February 2006, the Task Force of the Homeland Security  Advisory Council defined resiliency as “the capability of a system to  maintain its functions and structure in the face of internal and external  change and to degrade gracefully when it must.” Later in 2006, the  Department of Homeland Security’s National Infrastructure Protection  Plan defined resilience as “the capability of an asset, system, or network to  maintain its function during or to recover from a terrorist attack or other  incident.”
In May 2007 the President issued Homeland Security Presidential Directive  20—National Continuity Policy.  This directive establishes a  comprehensive national policy on the continuity of federal government  structures and operations and a single National Continuity Coordinator  responsible for coordinating the development and implementation of  federal continuity policies.  It also directs executive departments and  agencies to integrate continuity requirements into operations, and  provides guidance for state, local, territorial, and tribal governments, and  private sector organizations in order to ensure a comprehensive and  integrated national continuity program that will enhance the credibility of  our national security posture and enable a more rapid and effective  response to and recovery from a national emergency.  As part of  Homeland Security Presidential Directive 20, the Secretary of Homeland  Security is directed to, among other things, coordinate the  implementation, execution, and assessment of continuity operations and  activities; develop, lead, and conduct a federal continuity training and  exercise program, which shall be incorporated into the National Exercise  Program; and develop and promulgate continuity planning guidance to  state, local, territorial, and tribal governments, and private sector critical  infrastructure owners and operators.  For additional discussion of the  concept of resiliency, see appendix 1.
section_title: DHS Has Incorporated Changes into the 2009 NIPP that Reflect Stakeholder Input and Sectors’ Experience Protecting Critical Infrastructure and an Increased Emphasis on Risk Management
paragraphs: DHS incorporated changes in the 2009 NIPP—including a greater  emphasis on CIKR regional planning and updates to DHS’s overall risk  management framework—that NIPP PMO officials said are based on  stakeholder input and sectors’ experiences performing critical  infrastructure protection.  Based on DHS guidance, SSAs are expected to  address many of the changes to the NIPP in their SSPs, based on  consultation with sector partners. Table 2 provides an overview of key  changes to the NIPP.
subsections: section_title: DHS Changes to the 2009 NIPP Include Increased Emphasis on Regional Planning and Risk Management
paragraphs: DHS changes to the 2009 NIPP include increased emphasis on regional  planning and risk management and, according to PMO officials, these  changes are based on stakeholder input and sectors’ experiences  performing critical infrastructure protection.  The changes we identified in  the 2009 NIPP were generally foreshadowed in the 2007/2008 NIPP Update  provided to SSAs in 2008. While most of the changes in the 2009 NIPP  were minor and related to changes in programs or activities that have  occurred since the publication of the 2006 NIPP, several could have an  impact on the sector planning process and the development of SSPs.  These included changes that placed a greater emphasis on regional  planning, coordination and information-sharing across sectors; changes in  how critical infrastructures are identified and prioritized; developments in  risk management to include how threats, vulnerabilities, and  consequences are assessed; and a greater emphasis on cyber security and  international interdependencies.
In contrast to the 2006 NIPP, DHS increased its emphasis on regional  planning, coordination and information-sharing in the 2009 NIPP. DHS  discussed the need for regional coordination in the 2006 NIPP and  encouraged stakeholders to address CIKR protection across sectors within  and across geographic regions. In the 2006 NIPP, regional bodies were to  be formed on an “as needed” basis. By contrast, the 2009 NIPP called for  regional coordination through the formation of a consortium of  representatives from multiple regional organizations. The 2009 NIPP states  that this was done to help enhance the engagement of regionally based  partners and to leverage the CIKR protection activities and resiliency  strategies that they lead.
In comparison to the 2006 NIPP, DHS included a discussion of changes in  how critical infrastructures are identified and prioritized in the 2009 NIPP.  Both the 2006 NIPP and the 2009 NIPP stated that CIKR inventory lists  were developed from multiple sources, including sector inventories  maintained by SSAs and government coordinating councils, voluntary  submissions from CIKR partners in the public or private sector, and the  results of studies conducted by various trade associations, advocacy  groups, and regulatory agencies. While the 2006 NIPP briefly discusses its  efforts to determine which assets are nationally critical, the 2009 NIPP  includes a more detailed discussion of the national CIKR prioritization  program that places CIKR into categories according to their importance,  nationally or regionally. Specifically, DHS prioritized assets using a tiered  approach. Tier 1 or Tier 2 assets are those that if destroyed or disrupted  could cause significant casualties, major economic losses, or widespread  and long-term disruptions to national well-being and governance capacity.  According to DHS, the overwhelming majority of the assets and systems  identified through this effort are classified as Tier 2. Only a small subset of  assets meet the Tier 1 consequence threshold—those whose loss or   damage could result in major national or regional impacts similar to the  impacts of Hurricane Katrina or the September 11, 2001, attacks.
DHS also provided a detailed discussion of risk management  methodologies in the 2009 NIPP, as compared to the 2006 NIPP. Whereas  the 2006 NIPP listed the baseline criteria—minimum requirements—for  conducting risk analyses to ensure they are credible and comparable, the  2009 NIPP includes the use of a common risk assessment approach,  including the core criteria—updated requirements—for threat,  vulnerability, and consequence analyses designed to allow the comparison  of risk across sectors. For example, regarding consequence assessments,  the 2006 NIPP discusses the use of consequence screening to help CIKR  owners and operators determine whether it is necessary to provide  additional information to DHS or the SSA.  Consequence screening is an  approach that allows CIKR owners and operators to identify their  projected level of consequence based on the nature of their business,  proximity to significant populations or other CIKR, relative importance to  the national economy or military capability, and other similar factors. In  contrast the 2009 NIPP includes a discussion of consequence uncertainty  where a range of outcomes is possible. The 2009 NIPP states that where  the range of outcomes is large, greater detail may be required to calculate  consequence and inform decisionmaking.   As part of this risk  management discussion, DHS has also made changes regarding how  sectors are to measure the performance of their CIKR programs.  While  both the 2006 and 2009 NIPP discuss descriptive and process or output  data, the 2009 NIPP included additional discussion regarding the  development of metrics that assess how well programs reduced the risk to  the sector. The 2009 NIPP also discusses changes made to the approach  for conducting these assessments.  For example, whereas the 2006 NIPP  focused on facility vulnerability assessments, the 2009 NIPP discusses  broader assessment efforts, including DHS’s efforts to conduct a  systemwide vulnerability assessment.  To illustrate a systemwide  vulnerability assessment, DHS used the example of the California Water  System Comprehensive Review, a DHS-led assessment effort to identify  critical water system assets, analyze and track the gaps in protection, and  identify potential enhancements.
In addition, DHS included a greater emphasis on cyber security in the 2009  NIPP than it did in the 2006 NIPP. The 2006 NIPP identified cross-sector  cyber security as an area worthy of special consideration by the sectors. In  comparison, the 2009 NIPP lists the progress made and new initiatives  related to cyber security, including the development of cross-sector cyber  methodologies to identify systems or networks of national significance;  the addition of a cross-sector cyber security working group and a public- private cross-sector program specifically for cyber security. The 2009 NIPP  also lists new responsibilities for CIKR partners to conduct cyber security  exercises to test the security of these systems as well as the development  of cyber security-specific vulnerability assessments by DHS.
Furthermore, in contrast to the 2006 NIPP, DHS also expanded its  emphasis on international coordination and identified it as an area  warranting special consideration in the 2009 NIPP. Whereas the 2006 NIPP  highlighted the importance of international coordination, the 2009 NIPP  instructs the SSAs to identify foreign critical infrastructure—whether  American owned or foreign owned—of  national importance, and lists the  procedures for doing so. The 2009 NIPP discusses the importance of  identifying and prioritizing infrastructure located outside the United States  that if disrupted or destroyed would have a negative impact on the United  States, lists additional SSA responsibilities for international coordination,  and lists various international organizations that are assisting in the  implementation of international CIKR agreements. The 2009 NIPP also  highlights DHS’s role in a 15-nation effort specific to cyber security.
NIPP PMO officials said that the changes highlighted in the 2009 NIPP  were the result of knowledge gained and issues raised during regularly  scheduled—bimonthly or quarterly—or specially called meetings with  security partners such as the Federal Senior Leadership Council, the CIKR  Cross-Sector Council, and other contacts with security partners such as  SSAs, sector coordinating councils, and government coordinating  councils.  DHS said concerns on CIKR issues were also elevated to DHS  based on their inclusion in Sector CIKR Protection Annual Reports, as well  as from outside organizations like GAO which NIPP PMO officials credited  for the increased attention to cyber security. NIPP PMO officials said  DHS began an effort to revise the NIPP in the Spring of 2008 and as part of  this process, DHS held discussions with infrastructure protection  components and senior leadership. Figure 1 shows the process DHS used  to update the NIPP for publication in 2009.
NIPP PMO officials said that because they view NIPP updates as an  ongoing process, they will continue to reassess the NIPP and make  changes based on knowledge gained from the various partners and  stakeholders, as needed.  For example, between the release of the 2006  and 2009 NIPP DHS issued the 2007/2008 NIPP Update. The 2007/2008  NIPP Update contained references to changes that ultimately appeared in  the 2009 NIPP, including the introduction of the system used to gather and  distribute information on critical infrastructure assets, the process used to  develop metrics to measure performance and progress in critical  infrastructure protection, and the emphasis on regional coordination in  the partnership model. The 2007/2008 NIPP Update also included  discussion of a training needs assessment DHS conducted which was  followed by the creation of the CIKR competency areas that define CIKR  training requirements in the 2009 NIPP.
section_title: DHS Guidance Calls for SSAs to Develop Plans and Reports That Consider Specific Issues in the 2009 NIPP
paragraphs: Following the publication of the 2009 NIPP, DHS issued guidance to the  SSAs designed to make them aware of the changes to the NIPP and to  discuss the issues DHS believed SSAs should consider for increased  attention when developing their SSPs and SARs. The guidance provided  section-by-section instructions that discussed how SSAs were to update  their plans and annual reports to be consistent with the NIPP. For  example, the 2010 SSP guidance stated that the NIPP had increased  emphasis on DHS’s all-hazards approach to CIKR protection planning and  suggested that SSPs should place increased emphasis on their approach to  addressing all-hazards events when updating their plans.  The guidance  also noted that SSAs should give additional attention to topics such as  cyber security and international interdependencies. Regarding cyber  security, the guidance calls for SSAs to include goals or long-term  objectives for cyber security in their sector and explain their approach for  identifying their sector’s cyber assets, systems, networks, and functions;  incorporating cyber elements into sector risk assessments; and prioritizing  cyber elements—such as communication and computer networks—of  the  sector, among other things.
Fourteen of 18 SSA representatives generally described the process they  plan to use to incorporate these changes, which for the most part mirrored  DHS’s process for revising the NIPP. According to the SSA representatives,  after reviewing the guidance provided by DHS, the SSAs plan to employ  internal teams or offices to draft the SSP following DHS’s format; the SSAs  intend to provide the draft to key stakeholders, such as the sector’s  government coordinating council and sector coordinating council, who are  to provide feedback and comments on the draft via e-mail, individual and  conference calls, and in-person meetings; and the SSAs plan to make  revisions and distribute the draft to stakeholders for final review before  submission to DHS. See figure 2 for a description of this process.
Four of 18 SSA representatives who responded to our inquiries specifically  described how changes to the 2009 NIPP either had already been  addressed in their 2007 SSPs or would be addressed in the 2010 SSPs.   Regarding changes to risk assessment methodologies, for example, the  SSA representative for the Water sector stated that three risk assessment  tools are available to the Water sector. Furthermore, according to this  representative, DHS and its partners are working collaboratively to ensure  these existing assessment methodologies are upgraded and revised by  using consistent vulnerability, consequence, and threat information,  resulting in analysis of risk that is comparable within the sector. The SSA  representative said revisions to these tools are to also address the features  and elements of risk assessments as identified in the NIPP.  The Energy  SSA representative also described sector efforts in these areas, including  in regional coordination, training and education, international  coordination, and cyber security.
Those sector officials who did not offer specifics on how they expect to  address changes suggested by DHS either provided a general statement of  their efforts or said this was because the SSPs were being drafted during  our review. Four of the 18 SSA representatives said they have contacted or  plan to contact DHS about sector concerns regarding the NIPP format or  questions about the instructions provided. For example, the SSA  representative for the Healthcare and Public Health sector told us that his  agency planned to contact DHS to discuss a change that is designed to  make the SSP risk assessment methodology consistent with the NIPP, but  could be impractical for the SSA to implement. The Healthcare sector  representative said a single risk assessment methodology would not be  feasible for the Healthcare and Public Health sector because it is  composed of different kinds of partners, such as emergency medical  personnel, doctors, and hospitals and is made up of systems— transportation, communication, personnel—as opposed to other sectors  which he said may be made up predominantly of facilities. The SSA  representative said this makes the use of a single risk assessment  methodology difficult for the Healthcare sector. All 14 SSA representatives  who responded with a description of the SSP update process said they are  taking extra actions to ensure other stakeholder views are considered. For  example, the Commercial Facilities SSA said it plans to post a copy of its  draft on the Homeland Security Information Network to ensure that sector  interests are broadly represented in the review of the document. Another  example came from the Dams SSA official who said that his office  provided its draft to a dozen organizations and trade associations outside  its sector coordinating council and government coordinating council  including the American Society of Civil Engineers, the National Dam  Safety Review Board, and The Infrastructure Security Partnership for  review and comment.
SSAs also offered other comments on their efforts to address changes to  the NIPP—including changes to regional planning and risk management— in their SSPs.  Five of the 18 officials representing different SSAs said that  incorporation of these topics would not be difficult. For example, officials  representing the Chemical, Dam, and the Emergency Services sectors  SSAs said they did not foresee difficulty incorporating the key focus areas  from the 2009 NIPP into their 2010 SSP rewrite. Representatives of the  Commercial Facilities and Critical Manufacturing sectors said that they  found the DHS guidance useful to their SSPs. The Water sector  representative discussed programs or activities that were ongoing or  planned that addressed each of the topics. For example, the Water sector  SSA representative said the Environmental Protection Agency, which is  the Water sector SSA, is working with DHS and other security partners to  ensure risk assessment methodologies are upgraded and refined to be  consistent with the NIPP to produce an analysis of risk that is consistent  within the sector.  Officials representing the Banking and Finance and  Defense Industrial Base SSAs said it was premature to discuss how the  changes related to risk management, regional coordination, performance  measurement, and cyber security and international interdependencies  would affect their agencies’ efforts as the revision process was ongoing.  The SSA official representing both the Postal and Shipping sector and the  Transportation sector said that each change in the 2009 NIPP would be  addressed according to its unique characteristics for the sectors.
section_title: DHS Increased Its Emphasis on Resiliency in the 2009 NIPP and Directed SSAs to Address Resiliency in Their Sector Plans
paragraphs: Although DHS revised the NIPP to increase the use of the term resilience  and to highlight it as an important concept paired with protection, the 2009  NIPP uses much of the same language as the 2006 NIPP to describe  resiliency concepts and strategies. According to NIPP PMO officials, the  2009 NIPP has been updated to recognize the importance of resiliency and  provide SSAs the requested flexibility to incorporate resiliency within the  context of their sectors.
subsections: section_title: DHS Increased Its Emphasis on Resiliency in the 2009 NIPP, but Used Much of the Same Language as in the 2006 NIPP
paragraphs: DHS increased its emphasis on resiliency in the 2009 NIPP by using the  term more frequently and generally treating it as a concept formally paired  with protection.  Specifically, the 2006 NIPP used resiliency or resiliency- related terms 93 times while the 2009 NIPP used resiliency-related terms  183 times, about twice as often. More importantly, whereas the 2006 NIPP  primarily treated resiliency as a subset of protection, the 2009 NIPP  generally referred to resiliency alongside protection.  Both the 2006 and  2009 NIPPs include building resilience in the definition of protection, but  the 2009 NIPP increased the profile of resilience by treating it as separate  but related to CIKR protection.  For example, whereas the Managing Risk  chapter of the 2006 NIPP has a section entitled “Characteristics of  Effective Protection Programs,” the same chapter in the 2009 NIPP has a  section entitled, “Characteristics of Effective Protection Programs and  Resiliency Strategies.”
In addition, in contrast to the 2006 NIPP, the 2009 NIPP referred to  resiliency alongside protection in the introductory section of the  document.  Whereas the introduction to the 2006 NIPP states that it  “…provides the mechanisms for…enhancing information-sharing  mechanisms and protective measures within and across CI/KR sectors…,”  the introduction to the 2009 NIPP states that it “…provides the  mechanisms for…enhancing information-sharing mechanisms and  protection and resiliency within and across CIKR sectors.”  Also, in  comparison to the 2006 NIPP, the 2009 version of the NIPP discusses  resiliency more often in the “Authorities, Roles and Responsibilities”  chapter of the document.  These differences include a discussion on the  expanded roles and responsibilities of key partners, such as SSAs and  state and local governments, in CIKR planning with regard to resiliency.   In this section of the 2006 NIPP, resiliency was discussed almost  exclusively with regard to private sector owners and operators.  NIPP  PMO officials told us they wanted to recognize resilience as an approach  to risk management, but some security partners did not see how they  could or should influence the resilience efforts of the private sector. These  PMO officials said with the release of the 2009 NIPP, they made a more  concerted effort to help security partners understand how they can  promote both protection and resilience.
NIPP PMO officials told us that changes related to resiliency in the 2009  NIPP were not intended to represent a major shift in policy; rather they  were intended to increase attention to and raise awareness about  resiliency as it applies within individual sectors. These officials told us that  the concept of resiliency was always included in the NIPP. The 2006 NIPP  addressed resilience and even talked about it being one way to enhance  protection. However, NIPP PMO officials said that many partners interpret  or use protection as synonymous with physical protection.  To ensure that  all NIPP partners properly understand the intent of the NIPP, the NIPP  PMO has more explicitly addressed the concept of resiliency in the 2009  NIPP.  These officials said that this more explicit emphasis on resilience in  the 2009 NIPP is expected to encourage more system-based sector and  cross-sector activities that address a broader spectrum of risks.  This  would include, for example, increased attention to cyber security—which  can transcend different sectors—and discussion of the importance of  systems and networks within and among sectors as a means of fostering  resilience.
NIPP PMO officials also told us that the 2006 edition of the NIPP was  developed based on the requirements of HSPD-7, which did not include an  explicit emphasis on resiliency. They said that the 2009 NIPP was  developed taking into account concerns raised by stakeholders that the  2006 NIPP emphasized asset protection rather than resiliency.  They  explained that, shortly after the 2006 NIPP was released, as the NIPP risk  management framework and the sector partnerships matured, some  stakeholders believed that the concept of continuity and resilience in and  of itself, was not articulated and addressed as clearly as needed for their  purposes.  In addition, according to these officials, changes in the 2009  NIPP were drawn from many sources, including members of Congress and  academic and policy groups, who also expressed increasing interest in the  concept of resiliency as a critical part of national preparedness.
section_title: DHS Is Encouraging SSAs to Emphasize Resiliency in Their 2010 SSPs
paragraphs: Although DHS provides SSAs flexibility when developing their SSPs, given  increased attention to resiliency in the 2009 NIPP, NIPP PMO officials  have encouraged SSAs to emphasize resiliency in guidance provided to  SSAs in updating SSPs. One key difference between the guidance for  developing the 2007 SSPs and the 2010 SSPs is the inclusion of a resiliency  term in many places where there is a reference to protection or protection  programs.  For instance, Chapter 5 of the 2006 guidance is entitled  “Develop and Implement Protective Programs.” By contrast, chapter 5 of  the 2009 guidance is entitled “Develop and Implement Protective Programs  and Resiliency Strategies.”  Related to this change, DHS has also included  instructions for where—and at times, how—resiliency is to be  incorporated into 2010 SSPs.  For example, in the 2009 guidance set forth  in Chapter 5, SSAs are advised that in sectors for which infrastructure  resiliency is as or more important than physical security or hardening,  their SSA chapter on “Protection Program Implementation” should focus  on describing the resiliency measures and strategies being used by the  sector. The guidance also provided examples of resiliency measures such  as building hazard resistance into initial facility design; designing and  developing self-healing and self-diagnosing cyber systems; and  incorporating smart materials and embedded sensors into new physical  and cyber networks.  According to DHS officials in the NIPP PMO,  greater attention to interdependencies and cyber security in the NIPP are  resiliency-related considerations that reinforce the need for SSAs to  address systems- and network-based CIKR.
We did not examine the 2010 SSPs to determine the extent to which they  adhered to DHS’s recent SSP guidance because SSPs were not complete at  the time of our review.  However, we examined the 2007 SSPs prepared  based on 2006 guidance to ascertain the extent to which they contained  language about resiliency.  Our review showed that 13 of the 17 SSPs used  the term resiliency or terms related to resiliency, such as continuity of  operations, in their vision statements, goals, or objectives and 14 of 17  included resiliency in their risk management discussions.  Whereas the  discussion of resiliency in the risk management section was relatively  limited in some SSPs, the discussion about resiliency in others— particularly the banking and finance, energy, communications, and postal  and shipping and transportation sectors—was relatively extensive.  For  example, the 2007 National Monuments SSP mentions resilience in the  Introduction, in reference to national goals and in a discussion about the  importance CIKR protection has in making the nation more resilient. On  the other hand, the Banking and Finance and Communications SSPs  discuss how resilient these sectors are by design.  For example:      Banking and Finance Sector:  The sector consists of many  thousands of depository institutions, securities and futures firms,  insurance companies, and other financial service companies, and  supports a number of exchanges and over-the-counter markets, all of  which contribute to the sector’s resiliency because they provide a high  degree of redundancy across the sector.  Thus, according to the SSP,  the competitive structure of the financial industry and the breadth of  the financial instruments provide a level of resiliency against attack  and other types of physical or cyber disruptions.  The Banking and  Finance SSP goes further by listing publications related to resiliency  and business continuity planning and notes the Department of the  Treasury encourages security partners to develop, enhance, and test  business continuity plans. The SSP states that these plans are designed  to preemptively identify the core functions and capabilities necessary  to continue operations or resume operations after a disruption. The  Banking and Finance SSP also notes that there is an annual test of  business continuity planning by some members of the sector.
Communications Sector: Resiliency is achieved by the technology,  redundancy, and diversity employed in network design and by  customers who employ diverse and resilient primary and backup  communications capabilities, thereby increasing the availability of  service to customers and reducing the impact of outages.  For example,  according to the Communications SSP, the network backbone  remained intact on September 11, 2001, and during the hurricanes of  2005 despite the enormity of these incidents.
We interviewed SSA representatives about the extent to which they had  included a discussion of resiliency in their past SSPs, and their plans to  expand on their discussion of resilience in their 2010 SSPs.  Seventeen of  the 18 SSA representatives who responded to our questions told us they  believe that they have already included the concept of resiliency in their  existing sector plans, although that term itself may not have been used  often. These SSA representatives also said that they intend to further  incorporate resiliency into their 2010 SSPs where appropriate based on the  characteristics of their sectors and their understanding of DHS guidance.  However, based on their comments, it is likely that SSAs will not make  significant changes to their SSPs with regard to resiliency. For example:    Banking and Finance Sector: The SSA representative said they are  reviewing the DHS guidance and working with DHS to coordinate  perspectives regarding resiliency and to ensure that it remains central  to their efforts regarding infrastructure issues.  The Banking and  Finance SSA representative added that inasmuch as the Department of  the Treasury has long focused on the issue of resilience within the  financial services sector, any changes to the Banking and Finance SSP  concerning resiliency would be modest.
Chemical Sector: The SSA representative said the sector has long  recognized that “resilient operations and effective loss prevention are a  part of managing risk. These concepts, when woven together, support  the umbrella of resiliency.” The SSA representative said that resiliency,  in terms of prevention, protection, response, and recovery along the  preparedness spectrum was covered in the 2007 SSP and the SSA  anticipates highlighting and framing the discussion of these items in  terms of resiliency in the 2010 SSP update.
Nuclear Sector: The SSA representative responded that, while  resiliency is an important goal for some aspects of the Nuclear Sector,  most Nuclear Sector programs focus on protection—physical  hardening, in additional to other protective strategies—as the  underlying goal because of the relatively serious consequences of a  successful attack on some nuclear sites. According to the SSA  representative, the draft 2010 Nuclear SSP highlights those areas where  resilience is most appropriate, while retaining the overall focus on  protection.
Finally, the SSA representative (a DHS TSA official) for the Transportation  and Postal and Shipping sectors said he did not think that DHS merely  wanted the SSAs to substitute the term resiliency where the existing plan  said “redundancy” or “recovery” and would need to clarify the issue with  DHS.  For a discussion of  resiliency in the SSPs, see appendix II.
DHS officials in the NIPP PMO told us that the balance between protection  and resilience is unique to each sector and it must be recognized that the  degree to which any one SSP increases the emphasis on resiliency will  depend on the nature of the sector and the risks to its CIKR. They also said  they will rely on the sectors themselves to determine the importance of  resiliency in their plans. NIPP PMO officials further stated that by  emphasizing both protection and resilience in the NIPP, the private sector  better appreciates that the NIPP gives them the flexibility to take actions  and implement strategies that are tailored to their risks and situation. DHS  officials said that they plan to provide additional guidance or instruction  regarding resiliency to any sectors that need additional clarification, and,  expect it to take time for resiliency to be fully understood and  incorporated across the sectors.
section_title: Agency Comments
paragraphs: We requested comments on a draft of this report from the Secretary of  Homeland Security. In commenting on this draft DHS reiterated that it  incorporated changes into the NIPP that reflect stakeholder input and the  sectors’ experience in protecting critical infrastructure.  In addition, DHS  said it increased the emphasis on resilience in the 2009 NIPP and directed  SSAs to address resilience in the revision of their SSPs.  DHS said the  changes related to resilience in the 2009 NIPP were not intended to  represent a major shift in policy as the concept of resilience was included  in the 2006 NIPP. DHS said that the more explicit emphasis on resilience in  the 2009 NIPP is expected to encourage more system-based sector and  cross-sector activities that address a broader spectrum of risks. DHS also  provided technical comments that we have incorporated as appropriate.
We also provided a draft of this report to SSAs representatives at the  Departments of Agriculture, Defense, Energy, Health and Human Services,  Interior, and Treasury and the Environmental Protection Agency and  asked them to comment on those areas of the report relevant to their  agencies. DOD, Health and Human Services and the Environmental  Protection Agency provided technical comments that we have  incorporated where appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  issue date. At that time, we will send copies of this report to the Secretary  of Homeland Security, appropriate congressional committees, and other  interested parties. In addition, the report will be available at no charge on  the GAO Web site at http://www.gao.gov.
If you or your staff has any questions about this report or wish to discuss  the matter further, please contact me at (202) 512-8777 or  caldwells@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  Major contributors to this report are listed in appendix IV.
section_title: Appendix I: The Concept of Resiliency
paragraphs: This appendix discusses how resiliency has been addressed in the context  of critical infrastructure and key resource (CIKR) protection since 2006.   The concept of resiliency has gained particular importance and application  in a number of areas of federal CIKR planning. Both members of Congress  and executive branch agencies have addressed resiliency in relation to the  importance of the recovery of the nation’s critical infrastructure from  damage.  Accordingly, most of the current focus is on assets, systems, and  networks rather than agencies or organizations.
Part of the recent discussion over resiliency has focused on the definition  of the concept. In February 2006, the Report of the Critical Infrastructure  Task Force of the Homeland Security Advisory Council defined resiliency  as “the capability of a system to maintain its functions and structure in the  face of internal and external change and to degrade gracefully when it  must.” Later in 2006, the Department of Homeland Security’s National  Infrastructure Protection Plan—again focusing on critical infrastructure,  not agencies—defined resilience as “the capability of an asset, system, or  network to maintain its function during or to recover from a terrorist  attack or other incident.”  In May 2008, the House Committee on  Homeland Security held a series of hearings focusing on resilience at  which government and private sector representatives, while agreeing on  the importance of the concept, presented a variety of definitions and  interpretations of resilience.  Also, in April 2009, we reported that  organizational resiliency is based on 21 attributes particularly associated  with resilience and assigned them to five related categories. These  categories are emergency planning, organizational flexibility, leadership,  workforce commitment, and networked organizations.  Likewise,  government and academic organizations have discussed how resiliency  can be achieved in different ways. Among these are an organization’s  robustness (based on protection, for example better security or the  hardening of facilities); the redundancy of primary systems (backups and  overlap offering alternatives if one system is damaged or destroyed); and  the degree to which flexibility can be built  into the organization’s culture  (to include continuous communications to assure awareness during a  disruption, distributed decision-making power so multiple employees can  take decisive action when needed, and being conditioned for disruptions  to improve response when necessary).
The concepts associated with resiliency, and related concepts—e.g.,  recovery and reconstitution and continuity of operations—have evolved  over the years.  Homeland Security Presidential Directive-7 did not contain  specific references to resiliency, but it provided instructions to federal  agencies to create protection plans for the facilities they own and operate  to include “…contingency planning, including the recovery and  reconstitution of essential capabilities.”  Also, in May 2007 the President  issued Homeland Security Presidential Directive 20 - National Continuity  Policy.  This directive establishes a comprehensive national policy on the  continuity of federal government structures and operations and a single  National Continuity Coordinator responsible for coordinating the  development and implementation of federal continuity policies. It also  establishes "National Essential Functions," directs executive departments  and agencies to integrate continuity requirements into operations, and  provides guidance for state, local, territorial, and tribal governments, and  private sector organizations in order to ensure a comprehensive and  integrated national continuity program that is to enhance the credibility of  our national security posture and enable a more rapid and effective  response to and recovery from a national emergency. As part of Homeland  Security Presidential Directive 20, the Secretary of Homeland Security is  directed to, among other things, coordinate the implementation,  execution, and assessment of continuity operations and activities;   develop, lead, and conduct a federal continuity training and exercise  program, which shall be incorporated into the National Exercise Program;  and develop and promulgate continuity planning guidance to state, local,  territorial, and tribal governments, and private sector critical  infrastructure owners and operators.
In August 2009 the Homeland Security Studies and Analysis Institute  released a report that examined the operational framework that could be  used by DHS and stakeholders at all levels, both public and private, as a  basis for incorporating resilience into our infrastructure and society in  order to make the nation safer.  This framework approached resilience in  terms of three mutually reinforcing objectives: resistance, absorption, and  restoration.
Resistance is accomplished when the threat or hazard damage  potential is limited through interdiction, redirection, avoidance, or  neutralization efforts. The entire system experiences less damage than  would otherwise be the case.
Absorption is accomplished when consequences of a damage-causing  event are mitigated. The system experiences damage, but maintains its  structure and key functions. It bends, but does not break.
Restoration is accomplished when the system is rapidly reconstituted  and reset to its present status. Key functions are reestablished, possibly  at alternative sites or with substitute processes, and possibly at an  enhanced level of functionality.
Finally, the study includes funding profiles for the resistance, absorption,  and restoration objectives dependent upon whether the facility or entity  wants to put an emphasis on avoiding damage up front (protection) or the  ability to recover from damage quickly.
Most recently, the National Infrastructure Advisory Council issued a report  on critical infrastructure resilience in September 2009. The study noted  that protection and resilience are not opposing concepts and represent  complementary and necessary elements of a comprehensive risk  management strategy.  It examined current government policies and  programs for resilience in CIKR sectors. It also focused on identifying  measures to achieve sector- and national-level resilience, cross-sector and  supply-chain-related issues as they relate to resilience, and measures  implemented by individual enterprises. The NIAC made resilience-related  recommendations to the President through the DHS Secretary to improve  government coordination, clarify roles and responsibilities, and strengthen  public-private partnerships and to encourage resilience using market  incentives.
section_title: Appendix II: Discussions of Resiliency in 2007 Sector-specific Plans
paragraphs: This appendix discusses how the Sector-specific Agencies (SSAs)  addressed resiliency in their 2007 Sector-specific Plans (SSPs) and how  the SSAs will address resiliency in their 2010 SSPs.  All 17 SSAs in place at  the time the 2007 SSPs were developed incorporated resiliency-related  terms—resilient, resilience, resiliency, and continuity planning—into their  2007 SSPs.  Specifically, 13 of the 17 SSPs used these terms in their vision  statements, goals or objectives, and 14 of the 17 used these terms in their  risk management plans.
Given the increased attention to resiliency in the 2009 National  Infrastructure Protection Plan (NIPP) NIPP, NIPP Program Management  Office (PMO) officials encouraged SSAs to devote more attention to  resiliency in their 2010 SSPs.  Since the Department of Homeland Security  (DHS) does not expect these plans to be released until 2010, we contacted  representatives of the 18 SSAs to gather information on their plans to  adhere to DHS’s revised SSP guidance.  Representatives of 7 of the 18  sectors—Agriculture and Food, Communications,  Government Facilities,  Healthcare and Public Health, Information Technology (IT), Postal and  Shipping, and Transportation—responded that they intend to devote  greater attention to resiliency, and representatives of 10 of the 18  sectors—Banking and Finance, Chemical, Commercial Facilities, Dams,  Defense Industrial Base, Emergency Services, Energy, National  Monuments, Nuclear, and Water—responded that they intend to devote  the same amount of attention to resiliency as in their 2007 SSPs.  Finally, a  representative of 1 of the 18 sectors—Critical Manufacturing—responded  that the sector’s first SSP, to be released in 2010, will describe the sector’s  strategy to increase resiliency and prevent, deter, and mitigate any  disruptions caused by man-made threats or natural disasters.
The following table gives an overview of how resilience was referenced in  the 2007 SSPs and how sector representatives stated they will address  resiliency in their 2010 SSPs.
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: GAO Contacts and Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, John Mortin, Assistant Director  and Tony DeFrank, Analyst-in-Charge, managed this assignment with  assistance from Christy Bilardo and Landis Lindsey. Michele Fejar and  Steven Putansu assisted with design and methodology. Tracey King and  Thomas Lombardi provided legal support and Lara Kaskie provided  assistance in report preparation.
section_title: GAO Products Related to Critical Infrastructure Protection
subsections: section_title: Critical Infrastructure Protection
paragraphs: The Department of Homeland Security’s (DHS) Critical Infrastructure  Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.: June 26,  2009.
Influenza Pandemic: Opportunities Exist to Address Critical  Infrastructure Protection Challenges That Require Federal and Private  Sector Coordination. GAO-08-36. Washington, D.C.: October 31, 2007.
Critical Infrastructure: Sector Plans Complete and Sector Councils  Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.
Critical Infrastructure Protection: Sector Plans and Sector Councils  Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007.
Critical Infrastructure: Challenges Remain in Protecting Key Sectors.  GAO-07-626T. Washington, D.C.: March 20, 2007.
Critical Infrastructure Protection: Progress Coordinating Government  and Private Sector Efforts Varies by Sectors' Characteristics. GAO-07-39.  Washington, D.C.: October 16, 2006.
Critical Infrastructure Protection: Challenges for Selected Agencies and  Industry Sectors. GAO-03-233. Washington, D.C.: February 28, 2003.
Critical Infrastructure Protection: Commercial Satellite Security Should  Be More Fully Addressed. GAO-02-781. Washington, D.C.: August 30, 2002.
section_title: Cyber Security
paragraphs: Critical Infrastructure Protection: Current Cyber Sector-Specific  Planning Approach Needs Reassessment. GAO-09-969. Washington, D.C.:  September 2009.
Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical  Systems and Information. GAO-09-835T. Washington, D.C.: June 25, 2009.
Information Security: Cyber Threats and Vulnerabilities Place Federal  Systems at Risk. GAO-09-661T. Washington, D.C.: May 5, 2009.
National Cybersecurity Strategy: Key Improvements Are Needed to  Strengthen the Nation's Posture. GAO-09-432T. Washington, D.C.: March  10, 2009.
Critical Infrastructure Protection: DHS Needs to Better Address Its  Cybersecurity Responsibilities. GAO-08-1157T. Washington, D.C.:  September 16, 2008.
Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington,  D.C.: September 9, 2008.
Cyber Analysis and Warning: DHS Faces Challenges in Establishing a  Comprehensive National Capability. GAO-08-588. Washington, D.C.: July  31, 2008.
Critical Infrastructure Protection: Further Efforts Needed to Integrate  Planning for and Response to Disruptions on Converged Voice and Data  Networks. GAO-08-607. Washington, D.C.: June 26, 2008.
Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
Critical Infrastructure Protection: Sector-Specific Plans' Coverage of Key  Cyber Security Elements Varies. GAO-08-64T. Washington, D.C.: October  31, 2007.
Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key  Cyber Security Elements Varies. GAO-08-113. Washington, D.C.: October  31, 2007.
Critical Infrastructure Protection: Multiple Efforts to Secure Control  Systems are Under Way, but Challenges Remain. GAO-07-1036.  Washington, D.C.: September 10, 2007.
Critical Infrastructure Protection: DHS Leadership Needed to Enhance  Cybersecurity. GAO-06-1087T. Washington, D.C.: September 13, 2006.
Critical Infrastructure Protection: Challenges in Addressing  Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005.
Critical Infrastructure Protection: Department of Homeland Security  Faces Challenges in Fulfilling Cybersecurity Responsibilities.  GAO-05-434. Washington, D.C.: May 26, 2005.
Critical Infrastructure Protection: Improving Information Sharing with  Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.
Technology Assessment: Cybersecurity for Critical Infrastructure  Protection.  GAO-04-321. Washington, D.C.: May 28, 2004.
Critical Infrastructure Protection: Establishing Effective Information  Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.:  April 21, 2004.
Critical Infrastructure Protection: Challenges and Efforts to Secure  Control Systems. GAO-04-628T. Washington, D.C.: March 30, 2004.
Critical Infrastructure Protection: Challenges and Efforts to Secure  Control Systems. GAO-04-354. Washington, D.C.: March 15, 2004.
Posthearing Questions from the September 17, 2003, Hearing on  “Implications of Power Blackouts for the Nation's Cybersecurity and  Critical Infrastructure Protection: The Electric Grid, Critical  Interdependencies, Vulnerabilities, and Readiness”. GAO-04-300R.  Washington, D.C.: December 8, 2003.
Critical Infrastructure Protection: Challenges in Securing Control  Systems. GAO-04-140T. Washington, D.C.: October 1, 2003.
Critical Infrastructure Protection: Efforts of the Financial Services  Sector to Address Cyber Threats. GAO-03-173. Washington, D.C.: January  30, 2003.
High-Risk Series: Protecting Information Systems Supporting the  Federal Government and the Nation's Critical Infrastructures.  GAO-03-121. Washington, D.C.: January 1, 2003.
Critical Infrastructure Protection: Federal Efforts Require a More  Coordinated and Comprehensive Approach for Protecting Information  Systems. GAO-02-474. Washington, D.C.: July 15, 2002.
Critical Infrastructure Protection: Significant Challenges in  Safeguarding Government and Privately Controlled Systems from  Computer-Based Attacks. GAO-01-1168T. Washington, D.C.: September 26,  2001.
Critical Infrastructure Protection: Significant Challenges in Protecting  Federal Systems and Developing Analysis and Warning Capabilities.  GAO-01-1132T. Washington, D.C.: September 12, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  Analysis, Warning, and Response Capabilities. GAO-01-1005T.  Washington, D.C.: July 25, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  Analysis, Warning, and Response Capabilities. GAO-01-769T.  Washington, D.C.: May 22, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  National Capabilities. GAO-01-323. Washington, D.C.: April 25, 2001.
Critical Infrastructure Protection: Challenges to Building a  Comprehensive Strategy for Information Sharing and Coordination.  GAO/T-AIMD-00-268. Washington, D.C.: July 26, 2000.
Critical Infrastructure Protection: Comments on the Proposed Cyber  Security Information Act of 2000. GAO/T-AIMD-00-229. Washington, D.C.:  June 22, 2000.
Critical Infrastructure Protection: “ILOVEYOU” Computer Virus  Highlights Need for Improved Alert and Coordination Capabilities.  GAO/T-AIMD-00-181. Washington, D.C.: May 18, 2000.
Critical Infrastructure Protection: National Plan for Information  Systems Protection. GAO/AIMD-00-90R. Washington, D.C.: February 11,  2000.
Critical Infrastructure Protection: Comments on the National Plan for  Information Systems Protection. GAO/T-AIMD-00-72. Washington, D.C.:  February 1, 2000.
Critical Infrastructure Protection: Fundamental Improvements Needed  to Assure Security of Federal Operations. GAO/T-AIMD-00-7. Washington,  D.C.: October 6, 1999.
Critical Infrastructure Protection: Comprehensive Strategy Can Draw  on Year 2000 Experiences. GAO/AIMD-00-1. Washington, D.C.: October 1,  1999.
section_title: Defense Critical Infrastructure Protection
paragraphs: Defense Critical Infrastructure: Actions Needed to Improve  Identification and Management of Electrical Power Risks and  Vulnerabilities to DoDCritical Assets. GAO-10-147. Oct. 23, 2009.
Defense Critical Infrastructure: Actions Needed to Improve the  Consistency, Reliability, and Usefulness of DOD’s Tier 1 Task Critical  Asset List. GAO-09-740R. Washington, D.C.: July 17, 2009.
Defense Critical Infrastructure: Developing Training Standards and an  Awareness of Existing Expertise Would Help DOD Assure the  Availability of Critical Infrastructure. GAO-09-42. Washington, D.C.:  October 30, 2008.
Defense Critical Infrastructure: Adherence to Guidance Would Improve  DOD’s Approach to Identifying and Assuring the Availability of Critical  Transportation Assets. GAO-08-851. Washington, D.C.: August 15, 2008.
Defense Critical Infrastructure: DOD’s Risk Analysis of Its Critical  Infrastructure Omits Highly Sensitive Assets. GAO-08-373R. Washington,  D.C.: April 2, 2008.
Defense Infrastructure: Management Actions Needed to Ensure  Effectiveness of DOD’s Risk Management Approach for the Defense  Industrial Base. GAO-07-1077. Washington, D.C.: August 31, 2007.
Defense Infrastructure: Actions Needed to Guide DOD’s Efforts to  Identify, Prioritize, and Assess Its Critical Infrastructure. GAO-07-461.  Washington, D.C.: May 24, 2007.
section_title: Electrical Power
paragraphs: Electricity Restructuring: FERC Could Take Additional Steps to Analyze  Regional Transmission Organizations' Benefits and Performance.  GAO-08-987. Washington, D.C.: September 22, 2008.
Department of Energy, Federal Energy Regulatory Commission:  Mandatory Reliability Standards for Critical Infrastructure Protection.  GAO-08-493R. Washington, D.C.: February 21, 2008.
Electricity Restructuring: Key Challenges Remain. GAO-06-237.  Washington, D.C.: November 15, 2005.
Meeting Energy Demand in the 21st Century: Many Challenges and Key  Questions. GAO-05-414T. Washington, D.C.: March 16, 2005.
Electricity Restructuring: Action Needed to Address Emerging Gaps in  Federal Information Collection. GAO-03-586. Washington, D.C.: June 30,  2003.
Restructured Electricity Markets: Three States' Experiences in Adding  Generating Capacity. GAO-02-427. Washington, D.C.: May 24, 2002.
Energy Markets: Results of FERC Outage Study and Other Market Power  Studies. GAO-01-1019T. Washington, D.C.: August 2, 2001.
section_title: Other
paragraphs: Combating Terrorism: Observations on National Strategies Related to  Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.
Critical Infrastructure Protection: Significant Challenges Need to Be  Addressed. GAO-02-961T. Washington, D.C.: July 24, 2002.
Critical Infrastructure Protection: Significant Homeland Security  Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9,  2002.