Critical Infrastructure Protection: DHS Risk Assessments Inform Owner and Operator Protection Efforts and Departmental Strategic Planning
Released: 2017-10-30T00:00:00

Letter

Background

Presidential Directives Define DHS’s CI Security Mission

In February 2013, the White House released Presidential Policy Directive (PPD)-21, Critical Infrastructure Security and Resilience, directing DHS to coordinate the overall federal effort to promote the security and resilience of the nation’s CI from all hazards. Within DHS, NPPD has been delegated the responsibility for the security and resilience of the nation’s CI, and within NPPD, the Office of Infrastructure Protection (IP) leads and coordinates national programs and policies on CI issues.

Also in February 2013, the President issued Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” citing repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity. Among other things, the order addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards; stated U.S. policy to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities; directed the federal government to develop a technology- neutral cybersecurity framework to help CI owners and operators identify, assess, and manage cyber risk; and required DHS to use a consultative process to identify infrastructure in which a cybersecurity incident could result in catastrophic consequences.

The National Infrastructure Protection Plan Provides a Framework for Managing Risk

The NIPP sets forth a risk management framework and outlines DHS’s roles and responsibilities regarding CI security and resilience. As shown in Figure 1, the NIPP risk management framework is a planning methodology that outlines the process for setting goals and objectives; identifying assets, systems, and networks; assessing risk; implementing protective programs and resiliency strategies; and measuring performance and taking corrective action.

The risk management framework calls for public and private CI partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation in a coordinated manner. According to the NIPP, the risk management framework is also intended to inform how decision makers take actions to manage risk, which according to DHS, is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in figure 2.

Multiple DHS Offices Are Involved in CI Risk Assessment Activities

Multiple DHS offices conduct or assist with risk assessments for CI, including the Office of Cybersecurity and Communications (CS&C), Office of Infrastructure Protection, and Office of Cyber and Infrastructure Analysis (OCIA). The Office of Infrastructure Protection and CS&C both use voluntary programs to introduce risk-related tools intended to identify gaps in infrastructure security. These include voluntary security surveys and vulnerability assessments carried out by DHS’s Protective Security Advisors (PSA) and Cyber Security Advisors (CSA). PSAs are CI protection and security specialists responsible for assisting asset owners and operators with protection strategies of physical assets, and CSAs are cybersecurity specialists responsible for helping to bolster owners’ and operators’ cyber assessment capabilities. Both types of advisors use their respective assessment tools to work with CI stakeholders to develop measures intended to make assets more resilient. Other DHS offices with CI risk assessment responsibilities include DHS’s Office of Intelligence and Analysis, U.S. Coast Guard, and TSA.

PPD-21 and the NIPP also call for other federal departments and agencies to play a key role in CI security and resilience activities in their capacity as SSAs. In general, an SSA is a federal department or agency responsible for, among other things, supporting the security and resilience programs and related activities of designated CI sectors. DHS is designated as the SSA or co-SSA for 10 of the 16 CI sectors, and has assigned its SSA duties to multiple entities including the Office of Infrastructure Protection, TSA, Coast Guard, and Federal Protective Service. For our three selected sectors, DHS’s Sector Outreach and Programs Division (SOPD), within the Office of Infrastructure Protection, serves as the SSA for the Critical Manufacturing and nuclear sectors. DHS’s TSA and the U.S. Department of Transportation serve as co-SSAs for the Transportation Systems sector. Other federal agencies or departments external to DHS serve as the SSAs for the remaining 6 sectors for which DHS is not designated as the SSA or co-SSA. Figure 3 provides descriptions of the 16 sectors, identifies the SSA of each sector, and highlights the three selected sectors.

Risk Assessment Activities Vary Based on Sector’s Regulatory Environment

For some sectors, assets or operations are regulated by federal or state regulatory agencies that possess unique insight into the risk mitigation strategies of the CI they oversee. These regulators, who may not serve as the designated SSA for the sector, help establish safety and security protocols for the industries they regulate and ensure sector resilience through the policymaking and oversight processes. For example, the Nuclear Regulatory Commission, in its role as the regulatory agency for the nuclear sector, conducts threat assessments to help protect against acts of radiological sabotage and to prevent the theft of special nuclear material. Additionally, pursuant to the Maritime Transportation Security Act of 2002, DHS must use risk management in specific aspects of its homeland security efforts. For example, the Coast Guard and other port security stakeholders are required to carry out certain risk-based tasks, including assessing risks and developing security plans for ports, facilities, and vessels.

NIST Framework Provides Voluntary Cybersecurity Guidance

DHS is also involved in promoting and supporting the adoption of the NIST Framework for Improving Critical Infrastructure Cybersecurity. In accordance with requirements in Executive Order 13636, as discussed above, this framework provides voluntary standards and procedures for CI organizations to follow to better manage and reduce cybersecurity risk, and is designed to foster communication among CI stakeholders about cybersecurity management.

In December 2015, we reported that SSAs and NIST had promoted and supported adoption of the cybersecurity framework in the CI sectors. For example, in February 2014, DHS established the Critical Infrastructure Cyber Community Voluntary Program to encourage adoption of the framework and has undertaken multiple efforts as part of this program. These include developing guidance and tools that are intended to help sector entities use the framework. We also reported that DHS did not have metrics to measure the success of these program efforts, and recommended that DHS develop metrics to understand the effectiveness of their promotion activities. DHS concurred, and in December 2016 DHS officials stated that they plan to continue to work with SSA partners and NIST to determine how to develop measurement activities and collect information on the voluntary program’s outreach and its effectiveness in promoting and supporting the cybersecurity framework. We are currently conducting a review that will identify actions taken by relevant federal entities including NIST, DHS, and other SSAs to promote the adoption of the cybersecurity framework. We will continue to monitor the voluntary program’s outreach as well as DHS’s efforts to measure its effectiveness in promoting and supporting the cybersecurity framework.

Efforts to Increase Operational Efficiency among CI Assets Result in Physical and Cyber Security Convergence and Expand the Potential for Cyberattacks

The convergence of physical and cyber security is a major challenge for owners and operators of CI as more physical processes and systems are connected to Internet-enabled networks to improve operational efficiency, according to DHS officials. For example, facilities may make use of automated building control systems to control certain processes or functions, such as security, lighting, or heating, ventilation, and air conditioning (HVAC). These control systems increase efficiency and optimize operational performance by reducing the need for manual controls and adjustments. Building control systems and the devices within them are often configured with connections to the Internet. These Internet connections allow the systems to be accessed remotely for control and monitoring and, for example, to receive software patches and updates. Figure 4 illustrates how a facility’s HVAC and security systems are managed through a building automation system and operated over a control network. In this example, the information systems and networks are protected by a firewall—a cybersecurity countermeasure—while the control network and its devices have direct Internet connectivity without going through a firewall, potentially allowing a cyber-attacker to control the building’s electronic door locks.

Broader examples of these types of networked systems include electrical grids and water distribution systems, as well as control systems that operate chemical manufacturing processes, monitor natural gas pipelines, and control petroleum refineries. Depending on the cyberattack, there is potential to cause a disruption to specific infrastructure operations and a possibility that such an event could lead to cascading effects within the sector or to other sectors in the economy. According to a 2015 DHS report on cyber-physical infrastructure risks, greater connectivity among technologies that connect cyber systems to physical systems expands the potential for cyberattack by malicious actors. The growing convergence of these systems mean that exploited cyber vulnerabilities can result in physical consequences, as well.

DHS Primarily Assesses the Three Elements of Risk Separately for CI, and Private Sector Representatives from Selected Sectors Report Threat Information Most Valuable

DHS primarily assesses the three elements of risk–threat, vulnerability, and consequence–separately for individual CI assets and sectors. According to DHS officials, these assessments help critical infrastructure owners and operators take actions to improve security and mitigate risks. However, according to SCC representatives from three selected sectors, timely and actionable threat assessment data is the most useful type of risk information. In limited circumstances, DHS generates risk assessments that collectively incorporate all three elements of risk which selected SCC representatives found of limited use for their sectors’ infrastructure protection efforts due to the amount of time it takes to finalize the assessment data, the inclusion of risk scenarios that are not likely to occur, and the results not being applicable to individual assets.

DHS Shares Threat Assessment Information with CI Owners and Operators

Threat Information Products Help Make Critical Infrastructure in Selected Sectors More Secure and Resilient DHS’s Office of Intelligence and Analysis (I&A) compiles information from a variety of classified and unclassified sources to develop threat-related analytic products for each of the 16 CI sectors. I&A’s threat assessment efforts include classified briefings intended to help CI owners and operators manage risks to their individual operations and assets, and to determine effective strategies to make them more secure and resilient. DHS typically shares these products via its Homeland Security Information Network for Critical Infrastructure (HSIN-CI) platform. I&A also partners with sector-specific agencies to engage asset owners and operators directly during biweekly classified threat briefings to share threat data. During these meetings, both I&A officials and CI owners and operators take this opportunity to identify potential threat-related risks that may inform future I&A threat products.

The Homeland Security Information Network–Critical Infrastructure (HSIN-CI) HSIN-CI is the Department of Homeland Security’s (DHS) information sharing platform and collaboration tool for critical infrastructure stakeholders. It is the primary system through which private sector owners and operators, DHS, and other federal, state, and local government agencies collaborate to protect CI. According to DHS, it is an unclassified, web-based communications system for sharing sensitive but unclassified information. Users can access protection alerts, information bulletins, incident reports, situational updates, and analyses. Users can also engage in secure discussions with sector peer groups. Other features include CI protection training, planning and preparedness information, and a document library.

Similarly, TSA’s Office of Intelligence (TSA-OI) receives intelligence information regarding threats to transportation-related assets and disseminates it to industry officials with transportation responsibilities, as well as to other federal, state, and local officials. TSA-OI disseminates security information through products including reports, assessments, and briefings. For example, TSA-OI, in conjunction with I&A and the Federal Bureau of Investigation, provides intelligence and security information to mass transit and passenger rail security directors, law enforcement chiefs in major metropolitan areas, and Amtrak officials through joint classified intelligence and analysis briefings. Although it is not an intelligence generator, TSA-OI receives and assesses intelligence from within and outside of the intelligence community to determine its relevance to transportation security. Sources of information outside the intelligence community include other DHS components, law enforcement agencies, and owners and operators of transportation systems. TSA-OI also reviews suspicious activity reporting by Transportation Security Officers, Behavior Detection Officers, and Federal Air Marshals.

DHS officials from IP and TSA told us that they also share threat information within their respective sectors. For example, as the Critical Manufacturing SSA, IP disseminates threat information to sector stakeholders daily. Officials from IP also hold quarterly threat briefings to alert stakeholders of relevant threats. TSA likewise shares transportation security related information, including details on threats, vulnerabilities, and suspicious activities, with Transportation Systems sector stakeholders through unclassified or classified products and briefings. For example, TSA provides Transportation Intelligence Notes to transportation security partners to offer additional information or analysis on a specific topic and also provides situational awareness of ongoing or recent incidents. Table 1 in appendix I summarizes DHS threat assessment activities and products provided to the three selected sectors.

Examples of Threat Information the Department of Homeland Security Provides to Critical Infrastructure Owners and Operators Classified Threat Briefings: Officials from the Office of Intelligence and Analysis and the sector-specific agencies participate in briefings at regular intervals with critical infrastructure owners and operators to share threat information gathered from intelligence sources. Incident-Specific Outreach: The Nuclear Reactors, Materials and Waste sector-specific agency hosts incident-specific meetings and calls for sector stakeholders. Daily Threat Briefings: DHS publishes a daily e-mail that contains threat information intended to provide situational awareness from a variety of sources including the Federal Emergency Management Agency, Department of Justice, and other stakeholders as appropriate. According to DHS, these emails are distributed to more than 140 recipients in the Critical Manufacturing sector.

NCCIC Established to Share Cyber Threat Information According to DHS, the NCCIC is a 24x7 cyber situational awareness, incident response, and management center. The center shares information among public and private sector partners to build awareness of cyber vulnerabilities, incidents, and mitigation strategies and its partners include other government agencies, the private sector, and international entities. The NCCIC works with the private sector by integrating (both physically and virtually) CI owners and operators into the center’s operations so that, during an incident, threat information can be aggregated and communicated between government and appropriate private sector partners in an efficient manner. The NCCIC manages several programs that provide data used in developing 43 products and services in support of its 11 statutorily required cybersecurity functions. The programs include monitoring network traffic entering and exiting federal agency networks and analyzing computer network vulnerabilities and threats. The products and services are provided to its customers in the private sector; federal, state, local, tribal, and territorial government entities; and other partner organizations. For example, the NCCIC issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents. A list of these products and services is summarized in table 5 in appendix II. As of September 2017, 199 private sector CI owners and operators had as-needed access to NCCIC through their participation in the Cyber Information Sharing and Collaboration Program (CISCP).

The National Cybersecurity and Communications Integration Center (NCCIC) The Department of Homeland Security’s (DHS) NCCIC serves as a central location where partners involved in cybersecurity and communications protection coordinate and synchronize their efforts. NCCIC's partners include other government agencies, the private sector, and international entities. According the DHS, working closely with its partners, NCCIC analyzes cybersecurity and communications information, shares timely and actionable information, and coordinates response, mitigation, and recovery efforts. The NCCIC is made up of four branches: NCCIC Operations and Integration; United States Computer Emergency Readiness Team; Industrial Control Systems Cyber Emergency Response Team; and National Coordinating Center for Communications.

In February 2017, we reported that the NCCIC had taken steps to perform each of its 11 statutorily required cybersecurity functions, such as being a federal civilian interface for sharing cybersecurity-related information with federal and nonfederal entities. However, we recommended nine actions to DHS for enhancing the effectiveness and efficiency of the NCCIC, including determining the applicability of the implementing principles and establishing metrics and methods for evaluating performance. DHS concurred with our recommendations and we will monitor DHS’s progress toward addressing them.

Selected Private Sector Representatives Reported Threat Data as Most Useful Risk Information SCC representatives we spoke to from the three selected sectors cited threat assessment data as generally the most useful risk information for CI owners and operators. Each of these six representatives indicated that threat information must be distributed rapidly to owners and operators in order to maintain its value and utility. Three of the six representatives reported that DHS generally provides threat information in a timely manner. For example, SCC representatives from the nuclear sector told us that timely threat information from DHS was helpful in clarifying erroneous reports circulating about the terror attacks in Belgium being aimed at nuclear sites in that region. According to these SCC representatives, working with DHS to gather credible information in a timely fashion was very valuable to their sector because it allowed owners and operators within their sector to determine whether they needed to implement certain protocols to ensure that they were not vulnerable to similar attacks. The remaining three representatives told us that delays in receiving threat information from DHS decreased the value of this information. For example, one representative noted that he believes DHS’s process for vetting threat information before it is shared with his sector prevents the agency from disseminating valuable threat information in a timely manner. Another representative shared an example where the threats referenced in one of the products distributed by DHS had already been identified and addressed. However, the sixth representative emphasized that despite delays in receiving information from DHS, government threat information is very credible and a major resource often used by security managers proposing security upgrades to their respective chief executive officers. This representative also highlighted the significance of TSA’s adoption of industry-defined intelligence priorities as directly supporting training and awareness initiatives to create opportunities for prevention.

The NIPP establishes that the government is to provide the private sector with access to timely and actionable information in response to developing threats and crises. Similarly, the sector-specific plans from each of three selected sectors emphasize reliance upon timely and actionable threat information. For example, the 2015 Transportation System’s sector-specific plan discusses the importance of an effective and efficient process for receiving, analyzing, and disseminating pertinent and timely threat information and states that effective protection or response to a potential hazard relies on providing the stakeholders at greatest risk with real-time or near real-time alerts of emerging or breaking events.

According to one SCC representative, threat information is the one element of risk that adds the most value because it allows owners and operators to react immediately to improve their security posture to mitigate the effects of any potential hazards. The representative added that specific products like TSA-OI’s annual country-specific threat assessments are particularly useful because a number of companies within his sector have business interests outside the U.S. and these reports help them stay abreast of potential threats abroad.

Three of the six SCC representatives we interviewed reported that information regarding cybersecurity threats has become increasingly important. One SCC representative from the Critical Manufacturing sector stated that many of the security managers within his sector are physical security experts who are now facing more and more questions related to cybersecurity threats as a result of the cyber and physical security convergence their companies are experiencing. Therefore, the Critical Manufacturing sector worked with federal partners to increase access to the NCCIC, FBI, and U.S. Secret Service for additional cybersecurity support and also began promoting the sector’s awareness and use of the NIST framework.

DHS Conducts Voluntary Physical and Cyber Vulnerability Assessments for CI

Infrastructure Survey Tool The Infrastructure Survey Tool (IST) is one of the Department of Homeland Security’s (DHS) voluntary vulnerability assessment tools available to Critical Infrastructure owners and operators. It is a web-based security survey conducted by a Protective Security Advisor in coordination with facility owners and operators to identify the overall security and resilience of a facility. The survey contains more than 100 questions used to gather information on such things as physical security, security forces, security management, information sharing, and protective measures. The IST results inform owners and operators of potential vulnerabilities facing their asset or system and recommend measures to mitigate those vulnerabilities. Facility owners access results and preview the effects of proposed mitigation measures through the interactive IST Dashboard.

NPPD helps CI owners and operators develop capabilities to mitigate vulnerabilities by conducting voluntary physical vulnerability assessments primarily by using PSAs to conduct voluntary vulnerability assessments in coordination with owners and operators. These assessments focus on physical infrastructure and are generally asset-specific and conducted during site visits at individual assets. They are used to identify security vulnerabilities and identify potential risk mitigation strategies for owners and operators to address over time. One tool PSAs use in conducting CI assessments is the Infrastructure Survey Tool to assess facilities that agree to voluntarily participate. According to NPPD officials, vulnerability assessments take longer to develop than threat assessments, and the vulnerabilities identified are typically more static than threats, which are constantly evolving. PSAs store the collected assessment data on DHS’s Infrastructure Protection Gateway, an information sharing platform intended for use by DHS and its homeland security partners, including CI owners and operators, for access to infrastructure protection tools and information in support of incident preparedness and response efforts. Table 2 in appendix I summarizes the physical vulnerability assessments DHS conducts for the three selected sectors.

In September 2014, we reported that the vulnerability assessment tools and methods that different DHS offices and components used varied with respect to the areas of vulnerability assessed. For example, we found that while all of the assessment tools we reviewed considered perimeter security, approximately half of these tools (6 of 10) included an assessment of cybersecurity. We also found that DHS had not established guidance on what areas should be included in a vulnerability assessment. We recommended, among other things, that DHS review its vulnerability assessments to identify the most important areas of vulnerability to be assessed, and establish guidance. DHS agreed with our recommendation and in July 2016 reported that IP had taken steps to collect and evaluate information on the various vulnerability assessment tools and methods used by DHS offices and components. More specifically, IP identified six security areas to incorporate into DHS assessment tools and methods. DHS reported in August 2016 that DHS offices and components received guidance for the areas and the specified levels of detail to be incorporated into existing assessment tools.

As a result of addressing this recommendation, we believe that DHS is better positioned to collect and analyze assessment data to enable comparisons and determine priorities between and across CI sectors. DHS is also taking additional steps to address related recommendations from our September 2014 report that remain open. For example, we recommended that DHS develop and implement ways it can facilitate data sharing and coordination of vulnerability assessments to minimize the risk of potential duplication or gaps in coverage. As of September 2017, in response to this recommendation, DHS officials reported they were coordinating with stakeholders and developing features in an online portal to better facilitate information vulnerability assessment data sharing. We will continue to monitor the status of DHS’s efforts to address these recommendations.

In addition, in July 2017, DHS officials reported that they were finalizing a strategy intended to identify ways that vulnerability assessment data can be used by not only CI owners and operators but DHS and other government stakeholders to improve their own decision-making. According to these officials, DHS held workshops with over 120 stakeholders from NPPD as well as senior officials from other designated sector-specific agencies and federal departments who identified the need for DHS to provide more vulnerability assessment data related to lifeline facilities—such as water and wastewater treatment plants and train stations. They also noted that stakeholders recommended that DHS use the vulnerability assessment data it collects to conduct trend analysis in specific CI sectors and geographic regions.

The Cyber Resilience Review The Cyber Resilience Review is one of the Department of Homeland Security’s (DHS) cyber vulnerability assessments available to critical infrastructure owners and operators. It is a voluntary, nontechnical assessment to evaluate an organization’s operational resilience and cybersecurity practices. It may be conducted as a self-assessment or as an on-site assessment facilitated by DHS cybersecurity Cyber Security Advisors. It assesses enterprise programs and practices across 10 domains: asset management, controls management, configuration and change management, vulnerability management, incident management, service continuity management, risk management, external dependency management, training and awareness, and situational awareness.

DHS Offers Voluntary Cyber Vulnerability Assessments for CI Owners and Operators The Office of Cybersecurity and Communications (CS&C) offers CI owners and operators a suite of voluntary vulnerability assessments aimed at securing their cyber systems. For example, CS&C’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) is responsible for taking steps to help mitigate vulnerabilities to computer- based systems that are used to monitor and control industrial processes. CS&C also maintains the National Cybersecurity Assessment and Technical Services team which offers cybersecurity scanning and testing services that identify vulnerabilities within stakeholder networks and provides risk analysis and remediation recommendations. The CSA program also provides cyber assessment services for CI owners and operators through on-site vulnerability assessments for cyber systems. CSAs offer the Cyber Infrastructure Survey Tool, an assessment of essential cybersecurity practices instituted by critical infrastructure organizations to protect their critical IT services as well as the Cyber Resilience Review which evaluates an organization’s operational resilience and cybersecurity practices. A summary of DHS’s critical infrastructure cyber vulnerability assessment efforts can be found in table 3 in appendix I.

Selected Private Sector Representatives View Asset-Specific Vulnerability Assessments As Useful Sector Coordinating Council representatives from two of the three selected sectors stated that DHS’s vulnerability assessment efforts were useful for determining vulnerabilities for individual CI owners and operators, but their opinions varied concerning the usefulness of aggregating sector-wide data and sharing broadly among private sector stakeholders. For example, one SCC representative told us that the risk scores associated with individual vulnerability assessments are of value to the CI owners and operators of the infrastructure for which that assessment was administered. However, this representative also mentioned that these scores have limited value beyond the individual asset because risks differ greatly between companies, rendering sector- wide or regional vulnerability assessments less useful. Another SCC representative told us that because the membership of their respective sectors is so broad and diverse, it is difficult for members to discern the value of high-level aggregated vulnerability data––especially from organizations with very different business models. However, another SCC representative indicated that DHS could offer aggregated vulnerability assessment data to all CI stakeholders for the purpose of developing broader situational awareness.

DHS Conducts Consequence Assessments as Part of Its Infrastructure Survey Tool

While DHS’s IST is used to assess vulnerabilities for CI, the tool also includes a consequence module intended to allow DHS to assess facility criticality in terms of potential loss of life and economic impact. Also, OCIA analyzes consequence from incidents, and models past events to better understand the effect of these disruptions on assets and predict consequences of future events. Table 4 in appendix I describes the DHS components and corresponding products and activities associated with consequence assessments.

DHS officials we spoke with stated that consequence information is important to owners and operators. These officials added that DHS needs to demonstrate that potential losses can be avoided by owners’ and operators’ investment in risk mitigation, thereby reducing the overall consequence of a potential incident on the CI owner’s operations and the nation. Three of the six SCC representatives we interviewed shared that consequence information was not useful. For example, one SCC representative noted that consequence information is not very useful for owners and operators because timely threat information combined with knowledge of an asset’s vulnerabilities put owners and operators in a better position to mitigate potential incidents and, subsequently, any associated consequences. DHS officials acknowledged that a range of perspectives concerning the usefulness of consequence information exists and stated that these differences reflect the array of owner and operator views about how to use risk information for different risk management decisions.

DHS Conducts Complete Risk Assessments for CI Sectors on a Limited Basis

Within DHS, NPPD, TSA, and the Coast Guard are responsible for developing complete risk assessments, which can be conducted for an entire CI sector or multiple sub-sectors within a CI sector. Both TSA and the Coast Guard regularly conduct complete risk assessments within the Transportation Systems sector. However, according to a senior OCIA official, NPPD receives very few requests for complete risk assessments. Our review of available assessment documentation found that among our three selected sectors, DHS has conducted complete risk assessments for the Transportation Systems sector but not the other two sectors. For example, the Transportation Systems Sector Security Risk Assessment is TSA’s annual report to Congress on transportation security. It assesses risk by establishing risk scores for various attack scenarios within the sector, including for domestic aviation; examines risks to individual transportation modes; and compares them to risks within and across modes. Table 6 in appendix III describes the assessment in more detail.

Also within the Transportation Systems sector, the Coast Guard’s Maritime Security Risk Analysis Model (MSRAM) serves as the primary tool for assessing and managing security risks for all of the vessels, barges, and facilities regulated by the Coast Guard under the Maritime Transportation Security Act of 2002. Since its development and implementation in 2005, MSRAM has provided the Coast Guard with a standardized way of assessing risk to maritime infrastructure, referred to in the analysis model as targets that can include chemical facilities, oil refineries, hazardous cargo vessels, passenger ferries, and cruise ship terminals. For example, a scenario related to cruise ships identified using this analysis model could include a boat bomb or an attack by a hijacked vessel. MSRAM is designed to allow comparison between different targets at the local, regional, and national levels with the goal of reducing risk by prioritizing security activities and resources.

To prioritize and assess security risks at U.S. ports and facilities, the Coast Guard uses MSRAM to calculate risk using threat judgments provided by the Coast Guard Intelligence Coordination Center. The Center provides threat probabilities for MSRAM based upon judgments regarding specific intent, capability, and geographic preference of terrorist organizations to deliver an attack on a specific type of maritime target class—for example, a boat bomb attack on a ferry terminal. To make these judgments, Center officials use intelligence reports generated throughout the broader intelligence community to make qualitative determinations about certain terrorist organizations and the threat they pose to the maritime domain. At the sector level, Coast Guard MSRAM users are required to use the threat probabilities provided by the Center to ensure that threat information is consistently applied across ports.

MSRAM users at the sector level also assess the vulnerability of targets within their respective areas of responsibility and assess the consequences of a successful attack on these targets. Vulnerability and consequence factors included in the MSRAM assessment can be found in table 7 in appendix III.

According to one NPPD official, various sector councils have requested analysis of certain risk elements, such as vulnerabilities or consequences, as opposed to complete risk assessments. For example, councils have asked for analysis of vulnerabilities and consequences due to potential failures within their sector’s respective systems and the potentially cascading effects of these failures on systems beyond their own span of control. This official noted that these requests provide the opportunity for OCIA to develop analytic products that companies within these sectors can then use as part of the risk assessments they conduct for themselves, as well as analytic products more broadly related to homeland security risks.

SCC representatives from our three selected sectors told us that complete risk assessments are of limited utility for CI owners and operators because complete assessments take a long time to produce, often involve risk scenarios that are not likely to occur, or generates results that are so broad that they may not be applicable to individual assets. For example, according to one SCC representative, the diversity among the members of his sector, including size and sophistication of operations, is the primary reason that conducting a complete risk assessment for their sector would not be helpful for individual companies. Similarly, another SCC representative told us that the private sector does not operationalize information from complete risk assessments because the assessments do not add practical value and some of the scenarios evaluated in the assessments are not applicable to many of the companies within their sector.

TSA and NPPD officials provided explanations of the utility of complete risk assessments, particularly for government decision-making purposes. For example, TSA officials told us that they believe the Transportation Systems Sector Security Risk Assessment data gathering methodology for identifying risk inputs adds the most value in the assessment process for CI owners and operators in the Transportation Systems sector. According to these officials, the data gathering process is extensive and involves a substantial number of industry experts who are brought together to analyze potential threats, vulnerabilities, and consequences across the five transportation modes for which TSA is responsible. The officials added that this elicited risk information allows TSA to better allocate resources across the multiple transportation modes. According to one senior OCIA official, NPPD is best suited to execute complete risk assessments that are intended to focus on broad risks to CI and are not specific to individual CI assets. For example, NPPD is providing risk information for the execution of the 2018 Homeland Security National Risk Characterization (HSNRC), which evaluates the full range of risks addressed by DHS. This official stated that their office is working with DHS’s Office of Policy to maximize the value of the insights gained from the HSNRC effort and using it to inform NPPD decisions about strategy and policy.

DHS Uses CI Risk Information to Inform Strategic Planning and Guide Outreach to Owners and Operators

DHS uses CI risk information in multiple ways, including informing strategic planning and developing analytic products, and at the component level to guide its day-to-day owner and operator outreach and incident response. DHS is also facilitating risk-based cross-sector planning and information sharing through sector coordinating councils.

DHS Uses CI Risk Information to Inform Its Strategic Planning and is Taking Actions to Improve Supporting Risk Analysis

According to DHS Office of Policy officials, DHS is using risk information to inform departmental strategic planning as part of its third QHSR. The QHSR is DHS’s process for updating the national homeland security strategy, identifying critical homeland security missions, and assessing the organizational alignment of DHS with the homeland security strategy and missions. The results of the QHSR are used in DHS’s Strategic Plan, which outlines how DHS plans to implement the QHSR homeland security goals, lists strategies to achieve these goals, and identifies performance measures to track progress towards these goals. The QHSR incorporates multiple sources of risk information, including the HSNRC. The HSNRC assesses natural hazards such as floods, and manmade hazards such as terrorism. According to Office of Policy and NPPD officials, NPPD provides a broad range of risk-related inputs to support the implementation of the HSNRC risk assessment methodology. These inputs provide DHS officials a better understanding of risks to CI during strategic planning, according to Office of Policy officials.

Our prior work on DHS’s QHSR found that DHS assessed homeland security risks for its second QHSR for fiscal years 2014 to 2018 by considering threats, vulnerabilities, and consequences. We also found that while the QHSR risk assessment described a wide range of homeland security challenges and was a valuable step toward using risk information to prioritize and select risk management activities, DHS did not document how its various analyses were synthesized to generate results, thus limiting the reproducibility and defensibility of the results. We found that without sufficient documentation, the QHSR risk assessment results could not easily be validated or the assumptions tested, hindering DHS’s ability to improve future assessments. In addition, the QHSR described homeland security hazards, but did not rank those hazards or provide prioritized strategies to address them. We reported that comparing and prioritizing risks helps identify where risk mitigation is most needed and helps justify cost-effective risk management options. Thus, we recommended that future QHSR risk assessment reflect key elements of successful risk assessment methodologies, including being documented, reproducible, and defensible. We also recommended that DHS refine its risk assessment methodology so that in future QHSRs it can compare and prioritize homeland security risks and risk mitigation strategies. DHS concurred with these recommendations and outlined steps it planned to address them.

In response to our recommendations, DHS officials described several steps they have taken to address our recommendations. According to these officials, the Office of Policy held initial meetings with government and nongovernment subject matter experts after the release of our report to refine the HSNRC. Also, according to these officials, a Departmental Risk Modeling and Analysis Steering Committee (Risk committee) was convened in June 2016 to review and approve proposed new methodologies to help identify and prioritize threats and hazards for the HSNRC. According to NPPD officials, NPPD proposed updates to the HSNRC process as part of the Risk committee proceedings, such as changing the scope and detail of the assessment. The Risk committee evaluated these requests and finalized proposals for use in the third QHSR, which is scheduled to be released in 2018. We will continue to monitor the status of DHS’s actions to address our recommendations and how they are implemented.

DHS’s Office of Infrastructure Protection Uses CI Risk Information to Inform Outreach to Owners and Operators and Incident Response

According to IP officials, PSAs use risk information to guide their outreach to CI owners and operators. PSAs use the National Critical Infrastructure Prioritization Program (NCIPP) list––which prioritizes CI assets into different levels according to their criticality––to inform their outreach to owners and operators. PSAs and their leadership use the NCIPP list to prioritize outreach to owners and operators across each level of assets within their area of jurisdiction for participation in DHS’s voluntary security survey and vulnerability assessment programs, as shown in figure 5. Generally, PSAs engage CI owners and operators in the order in the pyramid shown in figure 5, starting with Level 1.

According to IP officials, PSAs also use risk information to guide incident response. The officials explained that when an incident occurs, they pull information from a variety of sources, including the database of assets on the NCIPP list, to identify CI in the affected area. OCIA officials then prioritize this information into a list to guide incident response efforts. For example, when Hurricane Hermine approached Georgia in September 2016, PSAs received a list from OCIA that categorized potentially affected CI assets in the region into priority levels. The PSAs used the list to prioritize their outreach to the highest priority assets.

Officials from the CSA program, also plan to use risk information to guide cybersecurity outreach to CI owners and operators. According to CS&C officials, CSAs are currently able to meet resource demands for outreach with little or no delay. However, as the CSA program continues to expand, CSAs plan to use a risk-based methodology to prioritize outreach. This methodology considers cyber threats, vulnerabilities, and consequences to determine how and where CSAs are used, according to CS&C officials.

DHS SSA representatives for our three selected sectors also use risk information to guide their outreach to CI owners and operators. For example, in response to a physical threat to a nuclear facility in Brussels, Belgium, nuclear sector SSA officials engaged with private sector representatives on the SCC and discussed ways to improve their information-sharing process. In another example, Critical Manufacturing SSA officials determined that smaller businesses in their sector did not have business continuity plans. According to these SSA officials, this was a risk that could disrupt the operations of these small businesses and other businesses in their supply chain. SSA officials developed a tool to help Critical Manufacturing sector owners and operators develop their own continuity plans––including templates, tabletop exercises, and a self- directed risk assessment for private sector owners and operators to use. According to the Critical Manufacturing sector-specific plan, the expanded use of business continuity planning will enhance the resilience of the Critical Manufacturing Sector.

DHS Facilitates Sharing of Cross-Sector Risk Information through Coordinating Councils and Planning Documents

As part of DHS’s responsibility described in the NIPP, DHS created the Critical Infrastructure Partnership Advisory Council (CIPAC), a forum for stakeholders including government officials and asset owners and operators, to facilitate planning and information sharing. CIPAC membership consists of representatives from the government and sector coordinating councils—federal, state, and local agency officials, and private owners and operators, respectively—who work together to coordinate strategies, activities, and policies across governmental entities within each of the 16 CI sectors. There is also a Critical Infrastructure Cross-Sector Council comprised of SCC chairs and vice chairs from each of the 16 sectors that meets quarterly to discuss, among other things, details about risks and opportunities to share information across sectors. Additionally, this Critical Infrastructure Cross-Sector Council provides a forum for the leaders of the SCCs to provide senior-level, cross-sector strategic coordination with DHS. The chairperson of the cross-sector council also communicates with owners and operators across the sectors as situations arise. For example, the chairperson convened a teleconference within 24 hours of a recent terror attack in the United Kingdom to share information and answer questions about potential risks or lessons learned for CI owners and operators.

In addition, DHS engages private sector owners and operators in cross- sector discussions through sector planning documents. For example, the 2015 sector-specific plans for each of the three sectors we studied include descriptions of cross-sector interdependencies. These include summaries of lifeline functions––such as energy, water, communications, and transportation systems––which are essential to the operations of most CI partners and communities. During development of the 2015 sector-specific plans the sectors and SSAs also collaborated and identified emerging risks that spanned across multiple sectors, as shown in figure 6.

Agency and Third Party Comments

We provided a draft of this product to DHS for review and comment. DHS provided technical comments, which we incorporated as appropriate. We also provided draft excerpts of this product to the selected sector coordinating council representatives we interviewed, who provided technical comments that we also incorporated as appropriate.

We are sending copies of this report to interested congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V.

Appendix I: Selected Risk Information Products and Activities Distributed by the Department of Homeland Security

The following tables highlight threat, vulnerability and consequence products and activities developed by the Department of Homeland Security for the purpose of providing risk information to critical infrastructure owners and operators.

Appendix II: NCCIC Cybersecurity Products and Services

Table 5 below highlights the cybersecurity products and services that the National Cybersecurity and Communications Integration Center (NCCIC) reported providing to its customers in fiscal years 2015 and 2016.

Appendix III: Summary of Department of Homeland Security Complete Risk Assessments for Critical Infrastructure

The following tables highlight complete risk assessments regularly conducted by the Transportation Security Administration and the U.S. Coast Guard within the Transportation Systems sector.

Appendix IV: National Critical Infrastructure Prioritization Program Consequence-Based Criteria and Relative Thresholds

Figure 7 below illustrates the Department of Homeland Security’s (DHS) approach for prioritizing the list of systems and assets that the Secretary of Homeland Security determines would, if destroyed or disrupted, cause national or regional catastrophic effects. DHS has prioritized these CI assets into different levels according to their criticality, to inform their outreach to owners and operators. Consistent with the National Infrastructure Protection Plan risk management framework, the criteria for determining which level each asset is assigned to on the National Critical Infrastructure Prioritization Program (NCIPP) list are entirely consequence based thresholds and include fatalities, economic loss, mass evacuation length, or national security impacts.

Appendix VI: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Ben Atwater (Assistant Director) and Landis Lindsey (Analyst-in-Charge) managed this audit engagement. Chuck Bausell, Michele Fejfar, Daniel Glickstein, Tracey King, Steve Komadina, Tom Lombardi, Kush Malhotra, Gabrielle Matuzsan, and Claire Peachey made significant contributions to this report.