Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened
Released: 2010-10-25T00:00:00

Letter

Background

The Homeland Security Act, as well as other statutes, provide legal authority for both cross-sector and sector-specific protection and resiliency programs. For example, the purpose of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 is to improve the ability of the United States to prevent, prepare for, and respond to acts of bioterrorism and other public health emergencies, and the Pandemic and All-Hazards Preparedness Act of 2006 addresses public health security and all-hazards preparedness and response. Also, the Cyber Security Research and Development Act of 2002 authorized funding for the National Institute of Standards and Technology and the National Science Foundation to facilitate increased research and development for computer and network security and to support research fellowships and training. CIKR protection issues are also covered under various presidential directives, including HSPD-5 and HSPD-8. HSPD-5 calls for coordination among all levels of government as well as between the government and the private sector for domestic incident management, and HSPD-8 establishes policies to strengthen national preparedness to prevent, detect, respond to, and recover from threatened domestic terrorist attacks and other emergencies. These separate authorities and directives are tied together as part of the national approach for CIKR protection through the unifying framework established in HSPD-7.

The NIPP outlines the roles and responsibilities of DHS and its partners— including other federal agencies, state, local, territorial, and tribal governments, and private companies. Within the NIPP framework, DHS is responsible for leading and coordinating the overall national effort to enhance protection via 18 CIKR sectors. HSPD-7 and the NIPP assign responsibility for CIKR sectors to SSAs. As an SSA, DHS has direct responsibility for leading, integrating, and coordinating efforts of sector partners to protect 11 of the 18 CIKR sectors. The remaining sectors are coordinated by 8 other federal agencies. Table 1 lists the SSAs and their sectors.

The DHS’s Office of Infrastructure Protection (IP), located in the National Protection and Programs Directorate, is responsible for working with public- and private-sector CIKR partners and leads the coordinated national effort to mitigate risk to the nation’s CIKR through the development and implementation of the CIKR protection program. Using a sector partnership model, IP’s Partnership and Outreach Division (POD) works with owners and operators of the nation’s CIKR to develop, facilitate, and sustain strategic relationships and information sharing, including the sharing of best practices. The POD also works with public and private partners to coordinate efforts to establish and operate various councils intended to protect CIKR and provide CIKR functions to strengthen incident response. These councils include the aforementioned SCCs, which coordinate sectorwide CIKR activities and initiatives among private sector owners, operators, and trade associations in each of the 18 sectors, and the GCCs that represent federal, state, and local government and tribal interests to support the effort of SCCs to develop collaborative strategies for CIKR protection for each of the 18 sectors. The partnership model also includes various cross-sector councils, including the CIKR Cross-Sector Council, which addresses cross-sector issues and interdependencies among SCCs; the NIPP Federal Senior Leadership Council, which focuses on enhanced communication and coordination between and among federal departments and agencies responsible for implementing the NIPP and HSPD-7; and the State, Local, Tribal, and Territorial Government Coordinating Council, which promotes coordination across state and local jurisdictions. The model also includes a Regional Consortium Coordinating Council, which bring together representatives of regional partnerships, groupings, and governance bodies to foster coordination among CIKR partners within and across geographical areas and sectors.

Figure 1 illustrates the sector partnership model and the interrelationships among the various councils, sectors, and asset owners and operators.

IP’s Protective Security Coordination Division (PSCD) also operates the Protective Security Advisor Program, which deploys critical infrastructure protection and security specialists, called PSAs, to local communities throughout the country. Established in 2004, the program has 93 PSAs serving in 74 districts in 50 states and Puerto Rico, with deployment locations based on population density and major concentrations of CIKR throughout the United States. PSAs lead IP’s efforts in these locations and act as the link between state, local, tribal, and territorial organizations and DHS infrastructure mission partners. PSAs are to assist with ongoing state and local CIKR security efforts by establishing and maintaining relationships with state Homeland Security Advisors, State Critical Infrastructure Protection stakeholders, and other state, local, tribal, territorial and private-sector organizations. PSAs are to support the development of the national risk picture by conducting vulnerability and security assessments to identify security gaps and potential vulnerabilities in the nation’s most critical infrastructures. PSAs also are to share vulnerability information and protective measure suggestions with local partners and asset owners and operators. In addition, PSAs are to coordinate training for private-and public-sector officials in the communities in which they are located; support incident management; and serve as a channel of communication for state, local, tribal, and territorial officials and asset owners and operators seeking to communicate with DHS.

Critical Infrastructure and the Concept of Resiliency

“Despite ongoing vigilance and efforts to protect this country and its citizens, major accidents and disasters, as well as deliberate attacks, will occur. The challenge is to build the capacity of American society to be resilient in the face of disruptions, disasters, and other crises. Our vision is a Nation that understands the hazards and risks we face; is prepared for disasters; can withstand the disruptions disasters may cause; can sustain social trust, economic, and other functions under adverse conditions; can manage itself effectively during a crisis; can recover quickly and effectively; and can adapt to conditions that have changed as a result of the event.”

The report also articulates that one of the goals for this mission is to “Rapidly Recover.” The two objectives associated with this goal are to (1) enhance recovery capabilities: establish and maintain nationwide capabilities for recovery from major disasters and (2) ensure continuity of essential services and functions: improve capabilities of families, communities, private-sector organizations, and all levels of government to sustain essential services and functions.

DHS Efforts to Incorporate Resiliency into Programs Used to Work with Asset Owners and Operators Is Evolving but Program Management Could Be Strengthened

Consistent with recent changes to the NIPP, DHS has begun to increase its emphasis on resiliency in the various programs it uses to assess vulnerability and risk at and among CIKR facilities so that it can help asset owners and operators identify resiliency characteristics of their facilities and provide suggested actions, called options for consideration, to help them mitigate gaps that have been identified. However, DHS has not developed an approach to measure owners’ and operators’ actions to address resiliency gaps identified as a result of these assessments. DHS has also begun to train PSAs about resiliency and how it applies to asset owners and operators, but it has not updated guidance that discusses PSAs’ roles and responsibilities to explicitly include resiliency and resiliency strategies.

DHS Has Increased Emphasis on Resiliency in Programs, but Has Not Developed an Approach to Measure Performance

In March 2010 we reported that DHS has increased its emphasis on resiliency in the 2009 NIPP by, among other things, generally pairing it with the concept of protection. We further stated that DHS has encouraged SSAs to emphasize resiliency in guidance provided to them in updating their sector-specific plans. Consistent with these efforts, DHS has also taken action to develop or enhance the programs it uses to work with asset owners and operators to bring a stronger focus to resiliency.

The Regional Resiliency Assessment Program (RRAP) and the Mini-Resiliency Assessment Program (Mini- RAP)

In 2009 DHS developed the RRAP to assess vulnerability and risk associated with resiliency. The RRAP is an analysis of groups of related infrastructure, regions, and systems in major metropolitan areas. The RRAP evaluates CIKR on a regional level to examine vulnerabilities, threats, and potential consequences from an all-hazards perspective to identify dependencies, interdependencies, cascading effects, resiliency characteristics, and gaps. In conducting the RRAP, DHS does an analysis of a region’s CIKR and protection and prevention capabilities and focuses on (1) integrating vulnerability and capability assessments and infrastructure protection planning efforts; (2) identifying security gaps and corresponding options for considerations to improve prevention, protection, and resiliency; (3) analyzing system recovery capabilities and providing options to secure operability during long-term recovery; and (4) assessing state and regional resiliency, mutual aid, coordination, and interoperable communication capabilities. RRAP assessments are to be conducted by DHS officials, including PSAs, in collaboration with SSAs: other federal officials; state, local, tribal, and territorial officials; and the private sector depending upon the sectors and facilities selected as well as a resiliency subject matter expert(s) deployed by the state’s homeland security agency. The results of the RRAP are to be used to enhance the overall security posture of the facilities, surrounding communities, and the geographic region covered by the project and are shared with the state. According to DHS officials, the results of specific asset-level assessments conducted as part of the RRAP are made available to asset owners and operators and other partners (as appropriate), but the final analysis and report is delivered to the state where the RRAP was conducted.

One of the assessment tools DHS developed for the RRAP analysis is a “resiliency assessment builder,” which contains a series of questions designed to help officials identify resiliency issues associated with facilities included in the RRAP. The resiliency assessment builder, among other things, focuses on: the impact of loss associated with the facility, including any national security, sociopolitical, and economic impacts; interdependencies between the facility under review and other infrastructure—such as electrical power or natural gas suppliers, water, and supply chain systems—that if disrupted, could cause deterioration or cessation of facility operations; the impact of the loss of significant assets—such as an electrical substation to provide power or a rail spur to transport supplies— critical to the operation of the facility and backup systems available to maintain operations if losses occur; and specific vulnerabilities, unusual conditions, threats, or events—such as hurricanes, transportation chokepoints, or hazardous materials issues—that could disrupt operations and whether the facility is prepared to address the situation via specific capabilities or an action plan.

Senior IP officials told us that they believe the RRAP has been successful in helping DHS understand resiliency in the context of interdependencies among individual assets. For example, while the focus of the Tennessee Valley Authority RRAP was energy sector sites and resources, DHS and its partners examined sites and resources in those sectors, like water and dams, which appeared to be obvious interdependencies. However, they also found that they needed to examine sites and resources in those sectors that appeared less obvious but were interdependent because they were intricately connected to the Tennessee Valley Authority operations, like sites and resources in the transportation sector. Also, in fiscal year 2010, DHS started an RRAP in Atlanta that focused primarily on commercial facilities. DHS’s related vulnerability assessment of sites (see the discussion below for additional details of these assessments) and resources associated with the water sector in Atlanta showed that an accident or attack involving one component of the water sector could disrupt the operations of sites or resources of other sectors in the geographic area covered by the RRAP. By discovering this vulnerability, and taking steps to address it, asset owners and operators in various sectors that were provided this information were better positioned to be able to work together to mitigate this potential problem. Senior IP officials said that the overall RRAP effort was piloted in five projects, but they no longer consider it a pilot program. They added that they plan to conduct five other RRAPs in 2010 in addition to the one already started in Atlanta. They further stated that because the program focuses only on areas with a high density of critical assets, they plan to develop a new “mini-RAP.” According to these officials, the mini-RAP is intended to provide assessments similar to those provided during an RRAP (but on a reduced scale) to groups of related infrastructure or assets that are not selected to receive an RRAP. An IP official stated that he anticipates that the mini- RAP, which is under development, will be finalized in October 2010.

Site Assistance Visits (SAVs)

DHS is also revising another vulnerability assessment called the SAV to foster greater emphasis on resiliency at individual CIKR sites. The SAV, which is a facility-specific “inside-the-fence” vulnerability assessment conducted at the request of asset owners and operators, is intended to identify security gaps and provide options for consideration to mitigate these identified gaps. SAVs are conducted at individual facilities or as part of an RRAP and are conducted by IP assessment teams in coordination with PSAs, SSAs, state and local government organizations (including law enforcement and emergency management officials), asset owners and operators, and the National Guard, which is engaged as part of a joint initiative between DHS and the National Guard Bureau. The National Guard provides teams of subject matter experts experienced in conducting vulnerability assessments. The private sector asset owners and operators that volunteer for the SAV are the primary recipient of the SAV analysis, which produces options for consideration to increase their ability to detect and prevent terrorist attacks. In addition, it provides mitigating options that address the identified vulnerabilities of the facility. The SAV is developed using a questionnaire that focuses on various aspects of the security of a facility, such as vulnerabilities associated with access to facility air handling systems; physical security; and the ability to deter or withstand a blast or explosion. Our review of the SAV questionnaire showed that it focuses primarily on vulnerability issues related to the protection of the facility. The SAV questionnaire also contains some questions that focus on resiliency issues because it asks questions about backup systems or contingencies for key systems, such as electrical power, transportation, natural gas, water, and telecommunications systems. Officials with IP’s PSCD said that they are working with IP’s Field Operations Branch to update the SAV to include more questions intended to capture the resiliency of a facility, especially since the SAV is used during the RRAP. They said that the effort is ongoing and, as of June 8, 2010, DHS had developed a time line showing the revised SAV is to be introduced in October or November 2010.

Enhanced Critical Infrastructure Protection (ECIP) Security Survey

DHS is also revising its ECIP security survey to further focus on resiliency at individual facilities. Under the ECIP survey, PSAs meet with facility owners and operators in order to provide awareness of the many programs, assessments, and training opportunities available to the private sector; educate owners and operators on security; and promote communication and information sharing among asset owners and operators, DHS, and state governments. ECIP visits are also used to conduct security surveys using the ECIP security survey, a Web-based tool developed by DHS to collect, process, and analyze vulnerability and protective measures information during the course of a survey. The ECIP security survey is also used to develop metrics; conduct sector-by-sector and cross-sector vulnerability comparisons; identify security gaps and trends across CIKR sectors and sub-sectors; establish sector baseline security survey scores; and track progress toward improving CIKR security through activities, programs, outreach, and training. Our review of the ECIP security survey showed that the original version of the survey made references to resiliency-related concepts—business continuity plans and continuity of operations. The newest version of the survey, published in June 2009, contains additional references to resiliency and resiliency- related concepts, including identifying whether or not a facility has backup plans for key resources such as electrical power, natural gas, telecommunications, and information technology systems. It is also used to identify key dependencies critical to the operation of the facility, such as water and wastewater, and to state whether backup plans exist for service or access to these dependencies in the event of an interruption. Further, senior IP officials told us that in addition to the updates on resiliency in the latest version of the ECIP security survey, they plan to incorporate 22 additional questions to a subsequent update of the survey that will focus on determining the level of resiliency of a facility. According to these officials, DHS also intends to use the updated survey to develop a resiliency “dashboard” for CIKR owners and operators that is intended to provide them a computerized tool that shows how the resiliency of their facility compares with other similar facilities (see the discussion below for a more detailed discussion of DHS’s ECIP dashboard). A DHS document on revisions to the SAV showed that the revised ECIP security survey is to be introduced at the same time as the revised SAV (October or November 2010) so that data collection associated with each remains compatible. DHS’s current projected release of the updated ECIP security survey is planned for October 2010.

Program Management Could Be Improved by Measuring Efforts to Mitigate Resiliency Gaps Identified during Vulnerability Assessments

DHS intends to take further actions to enhance the programs and tools it uses to work with asset owners and operators when assessing resiliency, but it has not developed an approach to measure its effectiveness in working with asset owners and operators in their efforts to adopt measures to mitigate resiliency gaps identified during the various vulnerability assessments. According to the NIPP, the use of performance measures is a critical step in the NIPP risk management process to enable DHS and the SSAs to objectively and quantitatively assess improvement in CIKR protection and resiliency at the sector and national levels. The NIPP states that while the results of risk analyses help sectors set priorities, performance metrics allow NIPP partners to track progress against these priorities and provide a basis for DHS and the SSAs to establish accountability, document actual performance, facilitate diagnoses, promote effective management, and provide a feedback mechanism to decision makers. Consistent with the NIPP, senior DHS officials told us that they have recently begun to measure the rate of asset owner and operator implementation of protective measures following the conduct of the ECIP security survey. Specifically, in a June 2010 memorandum to the Assistant Secretary for NPPD, the Acting Director of PSCD stated that 234 (49 percent) of 437 sites where the ECIP security survey had been conducted implemented protective measures during the 180-day period following the conduct of the ECIP survey. The Acting Director reported that the 234 sites made a total of 497 improvements across the various categories covered by the ECIP security survey, including information sharing, security management, security force, physical security, and dependencies while 239 sites reported no improvements during the period. The Acting Director stated that the metrics were the first that were produced demonstrating the impact of the ECIP program, but noted that PSCD is reexamining the collection process to determine whether additional details should be gathered during the update to the ECIP security survey planned for October 2010. However, because DHS has not completed its efforts to include resiliency material as part of its vulnerability assessment programs, it does not currently have performance metrics of resiliency measures taken by asset owners and operators.

Moving forward, as DHS’s efforts to emphasize resiliency evolve through the introduction of new or revised assessment programs and tools, it has the opportunity to consider including additional metrics of resiliency measures adopted at the facilities it assesses for vulnerability and risk, particularly as it revises the ECIP security survey and develops the resiliency dashboard. Moreover, DHS could consider developing similar metrics for the SAV at individual facilities and the RRAP and mini-RAP in the areas covered by RRAPs and mini-RAPs. By doing so, DHS could be able to demonstrate its effectiveness in promoting resiliency among the asset owners and operators it works with and would have a basis for analyzing performance gaps. Regarding the latter, DHS managers would have a valuable tool to help them assess where problems might be occurring or alternatively provide insights into the tools used to assess vulnerability and risk and whether they were focusing on the correct elements of resiliency at individual facilities or groups of facilities.

DHS Has Made Training on Resiliency Available to PSAs, but Guidelines on PSA Roles and Responsibilities Do Not Reflect DHS’s Growing Emphasis on Resiliency

DHS uses PSAs to provide assistance to asset owners and operators on CIKR protection strategies. Although DHS had begun to train PSAs about resiliency and how it applies to the owners and operators they interact with, DHS has not updated PSAs’ guidance that outlines their roles and responsibilities to reflect DHS’s growing emphasis on resiliency. In April 2010, DHS provided a 1-hour training course called “An Introduction to Resilience” to all PSAs at a conference in Washington, D.C. The training was designed to define resilience; present resilience concepts, including information on how resilience is tied to risk analysis and its link to infrastructure dependencies and interdependencies; discuss how resilience applies to PSAs, including a discussion of the aforementioned updates to programs and tools used to do vulnerability assessments; and explain how DHS’s focus on resilience can benefit asset owners and operators. According to the Acting Deputy Director of PSCD, PSCD is expected to deliver the training to PSAs again during regional conferences to foster further discussions about resiliency and to give PSAs an additional opportunity to ask questions about the training they received in April 2010.

Although DHS’s training discusses how resiliency applies to PSAs and how it can benefit asset owners and operators, DHS has not updated guidance that discusses PSA roles and responsibilities related to resiliency. The guidance DHS has provided to PSAs on certain key job tasks, issued in 2008, includes discussions about how PSAs are to (1) implement their role and responsibilities during a disaster; (2) conduct vulnerability assessments; and (3) establish or enhance existing strong relationships between asset owners and operators and DHS, federal, state, and local law enforcement personnel. However, the guidance does not articulate the role of PSAs with regard to resiliency issues, or how PSAs are to promote resiliency strategies and practices to asset owners and operators. For example, our review of DHS’s engagement guidance for PSAs showed that the guidance does not explicitly discuss resiliency; rather, it focuses primarily on protection. Specifically, the executive summary of the guidance states that one of the key infrastructure protection roles for DHS in fiscal year 2008 was to form partnerships with the owners and operators of the nation’s identified high-priority CIKR, known as level 1 and level 2 assets and systems. The guidance describes particular PSA responsibilities with regard to partnerships, including (1) identifying protective measures currently in place at these facilities and tracking the implementation of any new measures into the future; (2) informing owners and operators of the importance of their facilities in light of the ever-present threat of terrorism; and (3) establishing or enhancing existing relationships between owners and operators, DHS, and federal, state, and local law enforcement personnel to provide increased situational awareness regarding potential threats, knowledge of the current security posture at each facility, and a federal resource to asset owners and operators. There is one reference to a resiliency-related concept in an appendix where DHS indicated that the criteria to identify level 2 assets in the Information Technology sector should be “those assets that provide incident management capabilities, specifically, sites needed for rapid restoration or continuity of operations.”

PSA program officials said that they are currently developing guidelines on a number of issues as DHS transitions from a CIKR program heavily focused on protection to one that incorporates and promotes resiliency. They said that PSAs do not currently have roles and responsibilities specific to “resiliency” because resiliency is a concept that has only recently gained significant and specific attention. They added that PSA roles and responsibilities, while not specifically mentioning resiliency, include component topics that comprise or otherwise contribute to resiliency as it is now defined. Nonetheless, the Acting Deputy Director of IP’s PSCD said that he envisions updating PSA guidance to incorporate resiliency concepts and that he intends to outline his plan for doing so in October 2010 as part of IP’s program planning process. However, he was not specific about the changes he plans to make to address resiliency concepts or whether the PSA’s roles and responsibilities related to resiliency would be articulated. According to standards for internal control in the federal government, management is responsible for developing and documenting the detailed policies and procedures to ensure that they are an integral part of operations. By updating PSA guidance that discusses the role PSAs play in assisting asset owners and operators, including how PSAs can work with them to mitigate vulnerabilities and strengthen their security, PSA program officials would be better positioned to help asset owners and operators have the tools they need to develop resilience strategies. This would be consistent with DHS efforts to train PSAs about resiliency and how it affects asset owners and operators. Updating PSA guidelines to address resiliency issues would also be consistent with DHS’s efforts to treat resiliency on an equal footing with protection, and would comport with DHS guidance that calls for SSAs to enhance their discussion of resiliency and resiliency strategies in SSPs.

DHS Could Better Position Itself to Disseminate Information about Resiliency Practices with Asset Owners and Operators within and across Sectors

DHS’s efforts to emphasize resiliency in the programs and tools it uses to work with asset owners and operators also creates an opportunity for DHS to better position itself to disseminate information about resiliency practices to asset owners and operators within and across sectors. Currently, DHS shares information on vulnerabilities and protective measures on a case-by-case basis. However, while it is uniquely positioned and has considered disseminating information about resiliency practices, DHS faces barriers in doing so and has not developed an approach for sharing this information more broadly, across sectors.

DHS Shares Information on Vulnerabilities and Protective Measures on a Case-by-Case Basis

According to the NIPP, its effective implementation is predicated on active participation by government and private-sector partners in meaningful, multidirectional information sharing. The NIPP states that when asset owners and operators are provided with a comprehensive picture of threats or hazards to CIKR and participate in ongoing multidirectional information flow, their ability to assess risks, make prudent security investments, and develop appropriate resiliency strategies is substantially enhanced. Similarly, according to the NIPP, when the government is provided with an understanding of private-sector information needs, it can adjust its information collection, analysis, synthesis, and dissemination accordingly. Consistent with the NIPP, DHS shares information on vulnerabilities and potential protective measures with asset owners and operators after it has collected and analyzed information during SAVs and ECIP security surveys performed at their individual facilities. This information includes vulnerabilities DHS has identified, and corresponding steps these owners and operators can take to mitigate these vulnerabilities, including options for consideration, which are suggestions presented to owners and operators to help them resolve vulnerabilities identified during DHS’s assessments. For example, DHS issues SAV reports to owners and operators that, among other things, identify vulnerabilities; help them identify their security posture; provide options for consideration to increase their ability to detect and prevent terrorist attacks; and enhance their ability to mitigate vulnerabilities. Regarding the ECIP security survey, DHS provides owners and operators an ECIP “dashboard” which shows the results for each component of the survey for a facility using an index, called the Protective Measures Index (PMI), which are scores DHS prepares for the facility and individual components that can be compared to other similar facilities’ scores. SAV reports and the ECIP dashboard generally focus on similar protection issues, such as facility or physical security, security personnel, and access control. The SAV reports and the ECIP dashboard discuss some continuity of operations issues that could be considered resiliency related. For example, the ECIP dashboard contains PMIs focused on whether the facility has a continuity plan and conducts continuity exercises, while the SAV report discusses whether the facility would be able to operate if resources such as electricity, water, or natural gas were not available. As discussed earlier, DHS is currently updating the SAV to include, among other things, an assessment of resiliency characteristics and gaps, and is taking action to develop a resiliency dashboard similar to that used under the ECIP security survey.

Senior IP officials also stated that they share information on steps owners and operators can take to protect their facilities via Common Vulnerabilities, Potential Indicators, and Protective Measures (CV/PI/PM) reports. DHS develops and disseminates these reports to various stakeholders, generally on a need-to-know basis, including specific owners and operators, such as those that have been included in assessments by PSAs; law enforcement officials, emergency responders, and state homeland security officials; and others who request access to the reports. These reports, which focus on vulnerabilities and security measures associated with terrorist attacks, are intended to provide information on potential vulnerabilities and specific protective measures that various stakeholders can implement to increase their security posture. According to DHS, these reports are developed based on DHS’s experiences and observations gathered from a range of security-related vulnerability assessments, including SAVs, performed at infrastructures over time, such as the chemical and commercial facilities sectors and subsectors and asset types within those sectors, such as the chemical hazardous storage industry or the restaurant industry, respectively. For example, like other CV/PI/PM reports, DHS’s report on the restaurant industry gives a brief overview of the industry; potential indicators of terrorist activity; common vulnerabilities; and protective measures. Common vulnerabilities include unrestricted public access and open access to food; potential indicators of terrorist activity include arson, small arms attack, persons wearing unusually bulky clothing to conceal explosives, and unattended packages; and protective measures include developing a comprehensive security plan to prepare for and respond to food tampering and providing appropriate signage to restrict access to nonpublic areas. The CV/PI/PM reports discuss aspects of resiliency such as infrastructure interdependencies and incident response, but they do not discuss other aspects of resiliency. For example, the report on restaurants discusses protective measures including providing security and backup for critical utility services, such as power or water––efforts that may also enhance the resiliency of restaurants. Moving forward, as its efforts to emphasize resiliency evolve, DHS could consider including other aspects of resiliency in the CV/PI/PM reports.

DHS Is Uniquely Positioned to Disseminate Information about Resiliency Practices but Faces Barriers

Senior IP officials told us that they have considered ways to disseminate information that DHS currently collects or plans to collect with regard to resiliency. However, they have not explored the feasibility of developing an approach for doing so. Senior IP officials explained that given the voluntary nature of the CIKR partnership, DHS should not be viewed as identifying or promoting practices, particularly best practices, which could be construed to be standards or requirements. They said that DHS goes to great lengths to provide assurance to owners and operators that the information gathered during assessments will not be provided to regulators. They also stated that they provide owners and operators assurance that they will not share proprietary information with competitors. For example, certain information that they collect is protected under the Protected Critical Infrastructure Information (PCII) program, which institutes a means for the voluntary sharing of certain private sector, state, and local CIKR information with the federal government while providing assurance that the information will be exempt from disclosure under the Freedom of Information Act, among other things, and will be properly safeguarded. DHS has established a PCII program office, which among other things, is responsible for validating information provided by CIKR partners as PCII, and developing protocols to access and safeguard information that is deemed PCII.

IP senior officials further explained that DHS relies on its private-sector partners to develop and share information on practices they use to enhance their protection and resilience. They said that the practices shared by sector partners, including best practices, are largely identified and developed by the private sector, at times with the support of its partners in government such as the SSAs. DHS facilitates this process by making various mechanisms available for information sharing, including information they deem to be best practices. For example, according to senior IP officials, DHS’s Homeland Security Information Network-Critical Sectors (HSIN-CS) was designed to provide each sector a portal to post useful or important information, such as activities or concepts that private-sector partners discern to be best practices on protection and resiliency topics. They also said that one factor to consider is that resiliency can mean different things to different sectors, as measures or strategies that are applicable or inherent to one sector may not be applicable to another given the unique characteristics of each sector. For example, the energy sector, which includes oil refineries, is inherently different than the government facilities sector, which includes government office buildings. In our March 2010 report on DHS’s increased emphasis on resilience in the NIPP, we reported that DHS officials told us that the balance between protection and resiliency is unique to each sector and the extent to which any one sector increases the emphasis on resiliency in its sector-specific plans will depend on the nature of the sector and the risks to its CIKR. Further, the Branch Chief of IP’s Office of Information Coordination and Analysis Office explained that differences in corporate cultures across the spectrum of companies could be a barrier to widely disseminating information on resiliency practices because it is often challenging to translate information, such as what constitutes a success or failure, from one company to another. He further stated that differences in the regulatory structures affecting different industries may be a factor that could limit the extent to which certain types of information could be disseminated.

We recognize that DHS faces barriers to sharing information it gathers on resiliency practices within and among sectors. However, as the primary federal agency responsible for coordinating and enhancing the protection and resiliency of critical infrastructure across the spectrum of CIKR sectors, DHS is uniquely positioned to disseminate this information which would be consistent with the NIPP’s emphasis on information sharing. By working to explore ways to address any challenges or barriers to sharing resiliency information, DHS could build upon the partnering and information-sharing arrangements that CIKR owners and operators use in their own communities. For example, our work at CIKR assets along the Gulf Coast in Texas and in southern California showed that asset owners and operators viewed resiliency as critical to their facilities because it is in their best interests to either keep a facility operating during and after an event, or rebound as quickly as possible following an event. They said that they rely on a variety of sources for information to enhance their ability to be more resilient if a catastrophic event occurs, including information- sharing or partnering arrangements within and among CIKR partners and their local communities. Each of the 15 owners and operators we contacted in Texas and California said that they have partnering relationships with their sector coordinating councils, local/state government, law enforcement, emergency management, or mutual aid organizations. Furthermore, 14 of the 15 said that they work with these organizations to share information, including best practices and lessons learned, from recent disasters. Among the owners and operators we contacted: Representatives of one facility said that following a recent event, their company shared lessons learned with the local mutual aid association and various trade associations. These officials said that they also share best practices within the industry and across their facilities in other locations on an ongoing basis and that the company is currently organizing a committee made up of security staff from each facility within the organization whose primary responsibility is expected to be the sharing of best practices.

Officials representing another facility told us that following an event or a drill, they critique the event and their response to garner any lessons learned or best practices. They said that they share information with the local fire department and a regional trade association. These officials stated that they will share information with other trade association members if they believe that it would be beneficial to others, but will not discuss proprietary information.

Officials representing a different facility said that, following a hurricane in the same area, the company’s managers from various facilities met to share lessons learned and adopted best practices from other facilities within the same company and with external partners, including a mutual aid organization and local emergency responders. They said that they also have learned from the experiences of others— after an explosion at a similar company’s facility, they became aware that the other company had located its administration building too close to the company’s operations, thereby jeopardizing employee safety.

By developing an approach for disseminating information it gathers or intends to gather with regard to resiliency, DHS would then be in a position to reach a broader audience across sectors or in different geographic locations. Senior IP officials said that they agree that disseminating information on resiliency practices broadly across the CIKR community would be a worthwhile exercise, but questioned whether they would be the right organization within DHS to develop an approach for sharing resiliency information. They said that IP does not currently have the resources to perform this function and suggested that an organization like the Federal Emergency Management Agency (FEMA) might be more appropriate for sharing information on resiliency because it already has mechanisms in place to share information on practices organizations can adopt to deal with all-hazards events, including terrorism. For example, FEMA manages DHS’s Lessons Learned Information Sharing portal, called LLIS.gov, which is a national online network of lessons learned and best practices designed to help emergency response providers and homeland security officials prevent, prepare for, and respond to all hazards, including terrorism. According to FEMA officials, LLIS.gov contains information on critical infrastructure protection and resiliency and system users, such as state and local government officials, are encouraged to submit content which is then vetted and validated by subject matter experts before being posted to the system. FEMA officials explained that FEMA does not actively collect information from system users, but encourages them to submit documents for review and possible inclusion into LLIS.gov. According to FEMA, access to LLIS.gov is restricted to members that request access to the system, particularly emergency response providers and homeland security officials. In March 2010, FEMA’s Outreach and Partnerships Coordinator for Lessons Learned Information Sharing told us that LLIS.gov had about 55,000 members, of which approximately 89 percent were representatives of state and local government; about 6 percent were representatives of private-sector organizations; and about 5 percent were representatives of the federal government.

Regardless of which DHS organization would be responsible for disseminating information on resiliency practices, we recognize that DHS will face challenges in addressing any barriers it believes could hinder its ability to disseminate resiliency information. As part of this effort, DHS would have to determine what resiliency information it is collecting or plans to collect that might be most appropriate to share and what safeguards would be needed to protect against the disclosure of proprietary information within the confines of the voluntary nature of the CIKR partnership. Also, in doing so, DHS could consider some of the following questions: What additional actions, if any, would DHS need to take to convey that the information is being gathered within the voluntary framework of the CIKR partnership?

To what extent does DHS need to take additional actions, if any, to provide assurance that the information being disseminated is nonregulatory and nonbinding on the owners and operators that access it?

What additional mechanisms, if any, does DHS need to establish to provide assurance that reinforces the PCII process and how can resiliency practices information be presented to avoid disclosures of information that is PCII security sensitive or proprietary in nature?

What mechanism or information system is most suitable for disseminating resiliency practices information, and which DHS component would be responsible for managing this mechanism or system?

What approach should DHS take to review the information before it is disseminated to ensure that resiliency practices identified by DHS at one facility or in one sector are valid and viable, and applicable across facilities and sectors?

What additional resources and at what additional cost, if any, would DHS need to devote to gathering and broadly disseminating information about resiliency practices across facilities and sectors?

What actions can DHS take to measure the extent to which asset owners and operators are using resiliency information provided by DHS, and how can DHS use this information to make improvements, if needed?

By determining the feasibility of overcoming barriers and developing an approach for disseminating resiliency information, DHS could better position itself to help asset owners and operators consider and adopt resiliency strategies, and provide them with information on potential security investments, based on the practices and experiences of their peers both within and across sectors.

Conclusions

In the wake of concerns by stakeholders, including members of Congress, academia, and the private sector that DHS was placing emphasis on protection rather than resilience, DHS has increased its emphasis on critical infrastructure resiliency in the NIPP. Consistent with these changes, DHS has also taken actions to increase its emphasis on resilience in the programs and tools it uses to assess vulnerability and risk that are designed to help asset owners and operators identify resiliency characteristics and gaps. These actions continue to evolve and could be improved if DHS were to strengthen program management by developing measures to assess the extent to which asset owners and operators are taking actions to address resiliency gaps identified during vulnerability assessments; and updating PSA guidelines to articulate PSA roles and responsibilities with regard to resiliency during their interactions with asset owners and operators. By developing performance measures to assess the extent to which asset owners and operators are taking actions to resolve resiliency gaps identified during the various vulnerability assessments, DHS would, consistent with the NIPP, be better positioned to demonstrate effectiveness in promoting resiliency among the asset owners and operators it works with and would have a basis for analyzing performance gaps. DHS managers would also have a valuable tool to help them assess where problems might be occurring, or alternatively provide insights into the tools used to assess vulnerability and risk and whether they were focusing on the correct elements of resiliency at individual facilities or groups of facilities. Furthermore, by updating PSA guidance to discusses the role PSAs play during interaction with asset owners and operators, including how PSAs can work with them to mitigate vulnerabilities and strengthen their security, DHS would have greater assurance that PSAs are equipped to help asset owners and operators have the tools they need to develop resilience strategies. This would also be consistent with DHS efforts to train PSAs about resiliency and how it affects asset owners and operators.

Related to its efforts to develop or update its programs designed to assess vulnerability at asset owners’ and operators’ individual facilities and groups of facilities, DHS has considered how it can disseminate information on resiliency practices it gathers or plans to gather with asset owners and operators within and across sectors. However, it faces barriers in doing so because it would have to overcome perceptions that it is advancing or promoting standards that have to be adopted and concerns about sharing proprietary information. We recognize that DHS would face challenges disseminating information about resiliency practices within and across sectors, especially since resiliency can mean different things to different sectors. Nonetheless, as the primary federal agency responsible for coordinating and enhancing the protection and resiliency of critical infrastructure across the spectrum of CIKR sectors, DHS is uniquely positioned to disseminate this information. By determining the feasibility of overcoming barriers and developing an approach for disseminating resiliency information, DHS could better position itself to help asset owners and operators consider and adopt resiliency strategies, and provide them with information on potential security investments, based on the practices and experiences of their peers within the CIKR community, both within and across sectors.

Recommendations for Executive Action

To better ensure that DHS’s efforts to incorporate resiliency into its overall CIKR protection efforts are effective and completed in a timely and consistent fashion, we recommend that the Assistant Secretary for Infrastructure Protection take the following two actions: develop performance measures to assess the extent to which asset owners and operators are taking actions to resolve resiliency gaps identified during the various vulnerability assessments; and update PSA guidance that discusses the role PSAs play during interactions with asset owners and operators with regard to resiliency, which could include how PSAs work with them to emphasize how resiliency strategies could help them mitigate vulnerabilities and strengthen their security posture and provide suggestions for enhancing resiliency at particular facilities.

Furthermore, we recommend that the Secretary of Homeland Security assign responsibility to one or more organizations within DHS to determine the feasibility of overcoming barriers and developing an approach for disseminating information on resiliency practices to CIKR owners and operators within and across sectors.

Agency Comments and Our Evaluation

We provided a draft of this report to the Secretary of Homeland Security for review and comment. In written comments DHS agreed with two of our recommendations and said that it needed additional time to internally consider the third. Regarding our first recommendation that IP develop performance measures to assess the extent to which asset owners and operators are taking actions to resolve resiliency gaps identified during vulnerability assessments, DHS said that IP had developed measures on owners’ and operators’ efforts to implement enhancements to security and resilience, and NPPD officials are reviewing these new performance metrics. With regard to our second recommendation to update guidance that discusses the role PSAs play during interactions with asset owners and operators about resiliency, DHS said that IP is actively updating PSA program guidance to reflect the evolving concept of resilience and will include information on resilience in the next revision to the PSA program management plan. Finally, regarding our third recommendation that DHS assign responsibility to one or more organizations within DHS to determine the feasibility of developing an approach for disseminating information on resiliency practices, DHS said that its components need time to further consider the recommendation and will respond to GAO and Congress at a later date. DHS also provided technical comments which we incorporated as appropriate.

As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies of this report to the Secretary of Homeland Security, the Under Secretary for the National Protection Programs Directorate, appropriate congressional committees, and other interested parties. If you have any further questions about this report, please contact me at (202) 512-8777 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II.

Appendix I: Comments from the Department of Homeland Security

Appendix II: GAO Contact and Staff Acknowledgments

Staff Acknowledgments

In addition to the contact named above, John F. Mortin, Assistant Director, and Katrina R. Moss, Analyst-in-Charge, managed this assignment. Katherine M. Davis, Anthony J. DeFrank, Michele C. Fejfar, Tracey L. King, Landis L. Lindsey, Thomas F. Lombardi, Lara R. Miklozek, Steven R. Putansu, Edith N. Sohna, and Alex M. Winograd made significant contributions to the work.

Related GAO Products

Critical Infrastructure Protection: Updates to the 2009 National Infrastructure Protection Plan and Resiliency in Planning. GAO-10-296. Washington, D.C.: March 5, 2010.

The Department of Homeland Security’s (DHS) Critical Infrastructure Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.: June 26, 2009.

Influenza Pandemic: Opportunities Exist to Address Critical Infrastructure Protection Challenges That Require Federal and Private Sector Coordination. GAO-08-36. Washington, D.C.: October 31, 2007.

Critical Infrastructure: Sector Plans Complete and Sector Councils Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.

Critical Infrastructure Protection: Sector Plans and Sector Councils Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007.

Critical Infrastructure: Challenges Remain in Protecting Key Sectors. GAO-07-626T. Washington, D.C.: March 20, 2007.

Critical Infrastructure Protection: Progress Coordinating Government and Private Sector Efforts Varies by Sectors’ Characteristics. GAO-07-39. Washington, D.C.: October 16, 2006.

Critical Infrastructure Protection: Challenges for Selected Agencies and Industry Sectors. GAO-03-233. Washington, D.C.: February 28, 2003.

Critical Infrastructure Protection: Commercial Satellite Security Should Be More Fully Addressed. GAO-02-781. Washington, D.C.: August 30, 2002.

Cyber Security

Critical Infrastructure Protection: Current Cyber Sector-Specific Planning Approach Needs Reassessment. GAO-09-969. Washington, D.C.: September 24, 2009.

Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical Systems and Information. GAO-09-835T. Washington, D.C.: June 25, 2009.

Information Security: Cyber Threats and Vulnerabilities Place Federal Systems at Risk. GAO-09-661T. Washington, D.C.: May 5, 2009.

National Cybersecurity Strategy: Key Improvements Are Needed to Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.: March 10, 2009.

Critical Infrastructure Protection: DHS Needs to Better Address Its Cybersecurity Responsibilities. GAO-08-1157T. Washington, D.C.: September 16, 2008.

Critical Infrastructure Protection: DHS Needs to Fully Address Lessons Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington, D.C.: September 9, 2008.

Cyber Analysis and Warning: DHS Faces Challenges in Establishing a Comprehensive National Capability. GAO-08-588. Washington, D.C.: July 31, 2008.

Critical Infrastructure Protection: Further Efforts Needed to Integrate Planning for and Response to Disruptions on Converged Voice and Data Networks. GAO-08-607. Washington, D.C.: June 26, 2008.

Information Security: TVA Needs to Address Weaknesses in Control Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.

Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key Cyber Security Elements Varies. GAO-08-64T. Washington, D.C.: October 31, 2007.

Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key Cyber Security Elements Varies. GAO-08-113. October 31, 2007.

Critical Infrastructure Protection: Multiple Efforts to Secure Control Systems are Under Way, but Challenges Remain. GAO-07-1036. Washington, D.C.: September 10, 2007.

Critical Infrastructure Protection: DHS Leadership Needed to Enhance Cybersecurity. GAO-06-1087T. Washington, D.C.: September 13, 2006.

Critical Infrastructure Protection: Challenges in Addressing Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005.

Critical Infrastructure Protection: Department of Homeland Security Faces Challenges in Fulfilling Cybersecurity Responsibilities. GAO-05-434. Washington, D.C.: May 26, 2005.

Critical Infrastructure Protection: Improving Information Sharing with Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.

Technology Assessment: Cybersecurity for Critical Infrastructure Protection. GAO-04-321. Washington, D.C.: May 28, 2004.

Critical Infrastructure Protection: Establishing Effective Information Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.: April 21, 2004.

Critical Infrastructure Protection: Challenges and Efforts to Secure Control Systems. GAO-04-628T. Washington, D.C.: March 30, 2004.

Critical Infrastructure Protection: Challenges and Efforts to Secure Control Systems. GAO-04-354. Washington, D.C.: March 15, 2004.

Posthearing Questions from the September 17, 2003, Hearing on “Implications of Power Blackouts for the Nation’s Cybersecurity and Critical Infrastructure Protection: The Electric Grid, Critical Interdependencies, Vulnerabilities, and Readiness”. GAO-04-300R. Washington, D.C.: December 8, 2003.

Critical Infrastructure Protection: Challenges in Securing Control Systems. GAO-04-140T. Washington, D.C.: October 1, 2003.

Critical Infrastructure Protection: Efforts of the Financial Services Sector to Address Cyber Threats. GAO-03-173. Washington, D.C.: January 30, 2003.

High-Risk Series: Protecting Information Systems Supporting the Federal Government and the Nation’s Critical Infrastructures. GAO-03-121. Washington, D.C.: January 1, 2003.

Critical Infrastructure Protection: Federal Efforts Require a More Coordinated and Comprehensive Approach for Protecting Information Systems. GAO-02-474. Washington, D.C.: July 15, 2002.

Critical Infrastructure Protection: Significant Challenges in Safeguarding Government and Privately Controlled Systems from Computer-Based Attacks. GAO-01-1168T. Washington, D.C.: September 26, 2001.

Critical Infrastructure Protection: Significant Challenges in Protecting Federal Systems and Developing Analysis and Warning Capabilities. GAO-01-1132T. Washington, D.C.: September 12, 2001.

Critical Infrastructure Protection: Significant Challenges in Developing Analysis, Warning, and Response Capabilities. GAO-01-1005T. Washington, D.C.: July 25, 2001.

Critical Infrastructure Protection: Significant Challenges in Developing Analysis, Warning, and Response Capabilities. GAO-01-769T. Washington, D.C.: May 22, 2001.

Critical Infrastructure Protection: Significant Challenges in Developing National Capabilities. GAO-01-323. Washington, D.C.: April 25, 2001.

Critical Infrastructure Protection: Challenges to Building a Comprehensive Strategy for Information Sharing and Coordination. GAO/T-AIMD-00-268. Washington, D.C.: July 26, 2000.

Critical Infrastructure Protection: Comments on the Proposed Cyber Security Information Act of 2000. GAO/T-AIMD-00-229. Washington, D.C.: June 22, 2000.

Critical Infrastructure Protection: “ILOVEYOU” Computer Virus Highlights Need for Improved Alert and Coordination Capabilities. GAO/T-AIMD-00-181. Washington, D.C.: May 18, 2000.

Critical Infrastructure Protection: National Plan for Information Systems Protection. GAO/AIMD-00-90R. Washington, D.C.: February 11, 2000.

Critical Infrastructure Protection: Comments on the National Plan for Information Systems Protection. GAO/T-AIMD-00-72. Washington, D.C.: February 1, 2000.

Critical Infrastructure Protection: Fundamental Improvements Needed to Assure Security of Federal Operations. GAO/T-AIMD-00-7. Washington, D.C.: October 6, 1999.

Critical Infrastructure Protection: Comprehensive Strategy Can Draw on Year 2000 Experiences. GAO/AIMD-00-1. Washington, D.C.: October 1, 1999.

Defense Critical Infrastructure Protection

Defense Critical Infrastructure: Actions Needed to Improve Identification and Management of Electrical Power Risks and Vulnerabilities to DoD Critical Assets. GAO-10-147. October 23, 2009.

Defense Critical Infrastructure: Actions Needed to Improve the Consistency, Reliability, and Usefulness of DOD’s Tier 1 Task Critical Asset List. GAO-09-740R. Washington, D.C.: July 17, 2009.

Defense Critical Infrastructure: Developing Training Standards and an Awareness of Existing Expertise Would Help DOD Assure the Availability of Critical Infrastructure. GAO-09-42. Washington, D.C.: October 30, 2008.

Defense Critical Infrastructure: Adherence to Guidance Would Improve DOD’s Approach to Identifying and Assuring the Availability of Critical Transportation Assets. GAO-08-851. Washington, D.C.: August 15, 2008.

Defense Critical Infrastructure: DOD’s Risk Analysis of Its Critical Infrastructure Omits Highly Sensitive Assets. GAO-08-373R. Washington, D.C.: April 2, 2008.

Defense Infrastructure: Management Actions Needed to Ensure Effectiveness of DOD’s Risk Management Approach for the Defense Industrial Base. GAO-07-1077. Washington, D.C.: August 31, 2007.

Defense Infrastructure: Actions Needed to Guide DOD’s Efforts to Identify, Prioritize, and Assess Its Critical Infrastructure. GAO-07-461. Washington, D.C.: May 24, 2007.

Electrical Power

Electricity Restructuring: FERC Could Take Additional Steps to Analyze Regional Transmission Organizations’ Benefits and Performance. GAO-08-987. Washington, D.C.: September 22, 2008.

Department of Energy, Federal Energy Regulatory Commission: Mandatory Reliability Standards for Critical Infrastructure Protection. GAO-08-493R. Washington, D.C.: February 21, 2008.

Electricity Restructuring: Key Challenges Remain. GAO-06-237. Washington, D.C.: November 15, 2005.

Meeting Energy Demand in the 21st Century: Many Challenges and Key Questions. GAO-05-414T. Washington, D.C.: March 16, 2005.

Electricity Restructuring: Action Needed to Address Emerging Gaps in Federal Information Collection. GAO-03-586. Washington, D.C.: June 30, 2003.

Restructured Electricity Markets: Three States’ Experiences in Adding Generating Capacity. GAO-02-427. Washington, D.C.: May 24, 2002.

Energy Markets: Results of FERC Outage Study and Other Market Power Studies. GAO-01-1019T. Washington, D.C.: August 2, 2001.

Other

Combating Terrorism: Observations on National Strategies Related to Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.

Critical Infrastructure Protection: Significant Challenges Need to Be Addressed. GAO-02-961T. Washington, D.C.: July 24, 2002.

Critical Infrastructure Protection: Significant Homeland Security Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9, 2002.