An influenza pandemic can occur when an existing virus mutates into a novel strain that is highly transmissible among humans, leading to outbreaks worldwide. Such strains can be highly pathogenic because there is little or no pre-existing immunity in the population. Some of the issues associated with the preparation for and responses to an influenza pandemic are similar to those for any other type of disaster or hazard. However, a pandemic poses some unique challenges. Unlike incidents that are discretely bounded in space or time (e.g., most natural or man-made disasters), an influenza pandemic is an event likely to come in waves, each lasting weeks, months, or years, and pass through communities of all sizes across the nation and the world. While a pandemic will not directly damage physical infrastructure such as power lines or computer systems, it could threaten critical systems by potentially removing the essential personnel needed to operate them from the workplace for weeks or months. The World Health Organization (WHO) and the U.S. Centers for Disease Control and Prevention (CDC) have said that in a severe pandemic, the absences of those who are ill, taking care of ill family members, and fearing infection could reach a projected 40 percent during the peak weeks of a community outbreak, with lower rates of absence during the weeks before and after the peak. In addition, an influenza pandemic could result in 200,000 to 2 million deaths in the United States, depending on its severity. Although representing a novel strain of flu, the H1N1 outbreak, first detected in the United States around April 2009, has caused illness ranging from mild to severe. While most people who have been sick have recovered without needing medical treatment, hospitalizations and deaths from infection with this virus have occurred, and recent CDC news bulletins have indicated the second wave of the disease potentially could be more severe, especially for children and other at-risk groups. As with most disasters, the initial governmental response to a pandemic will be at the state and local level and will aim to decrease people’s exposure to the virus. Initial responses may include encouraging and facilitating good hand hygiene, requiring ill individuals to isolate themselves, educating people about conditions that put them at high risk for complications, encouraging early treatment, and encouraging creative solutions to increase the distance between people at school and work. Under conditions of increased severity of illness, government response could escalate to include more aggressive actions such as closing schools, shutting down public transportation, and prohibiting large public gatherings at venues such as sporting events. These measures are intended to create “social distance” between people to prevent large numbers of people coming into direct contact in an attempt to minimize transmission of the disease. Similarly, individual organizations are also advised to increase the distance between people in workplaces. At the federal level, the National Strategy for Pandemic Influenza Implementation Plan calls for the Secretary of HHS to lead the federal medical response to a pandemic, and the Secretary of DHS to lead the overall domestic incident management and federal coordination. Protecting the nation’s critical infrastructure against natural and manmade catastrophic events, including pandemic, has been a concern of the federal government for over a decade. Several federal policies address the importance of coordination between the government and the private sector in critical infrastructure protection. Homeland Security Presidential Directive 7 (HSPD-7), issued in December 2003, identifies various federal agencies, including DHS, as having responsibility for ensuring that steps are taken to protect specific critical infrastructure sectors of the United States. HSPD-7 makes DHS responsible for, among other things, coordinating national critical infrastructure protection efforts and establishing uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across these sectors. In addition to other sectors, DHS is the lead federal agency for two critical infrastructure sectors—information technology (IT) and communications—that are important for the Internet. Specifically, the entities within DHS responsible for coordinating national efforts to promote critical infrastructure protection activities for those sectors are the National Cyber Security Division and the Office of the Manager of the National Communications System (NCS), respectively. Although the vast majority of Internet infrastructure is owned and operated by the private sector, federal policy recognizes the need to be prepared for the possibility of debilitating disruptions in cyberspace. With the exception of the Department of Defense and intelligence community networks, DHS is the central coordinator for cyberspace security efforts and has responsibility for developing an integrated public-private plan for Internet recovery. FCC, which was established under the Communications Act of 1934 to regulate interstate and international communications by radio, television, wire, satellite, and cable—also oversees the telecommunications infrastructure on which the Internet depends. Because the functioning of the financial markets is important for our nation’s economy, the financial sector is one of the infrastructure sectors that has been designated as critical. Finally, under HSPD-7, the Department of the Treasury (Treasury) is responsible for infrastructure protection activities specifically within the banking and finance sector. The public Internet infrastructure is owned and operated primarily by private companies such as telecommunications companies, cable companies, and other Internet service providers. It is a network of many networks used around the world to communicate and share computing resources, engage in commerce, do research, and provide entertainment. As shown in figure 1, the various networks that make up the Internet include the national backbone and regional networks, as well as the residential Internet access networks and the networks run by individual businesses, or “enterprise” networks. The national backbone providers transmit data over long distances using high-speed fiber-optic lines. Because these providers do not service all locations worldwide, regional network providers provide regional service to supplement the long-haul traffic. When a user wants to access a Web site or send an e-mail to someone who is connected to the Internet through a different service provider, the data must be transferred between networks. Data travels from a user’s home computer to the Internet through various means, including coaxial cable, digital subscriber line (DSL), satellite, fiber, or wirelessly to a provider’s facility where it is aggregated with other users’ traffic. Data cross between networks at Internet exchange points, which can be either hub points where multiple networks exchange data or private interconnection points. At these exchange points computer systems called routers determine the optimal path for the data to reach their destination. The data then continue through the national and regional networks and exchange points, as necessary, to reach the recipient’s Internet service provider and the recipient. A functioning Internet will be important during a pandemic because it could be one important way that governments and private entities share necessary information with the public. Using the Internet to allow people to communicate effectively without coming together physically would assist in creating “social distance” to reduce the potential for illness to further spread. In addition, many organizations, including DHS, have been advocating that businesses and other enterprises consider increased use of telework by their workforce as a way to continue operations while maintaining physical separation from other workers during a pandemic. Doing so would typically involve employees working from home and accessing their business’s networks over an Internet connection. Some entities have also advocated the use of the Internet as a means for reducing the social isolation that could arise when people are asked to avoid contact with others. For the U.S. securities markets to function, ensuring that companies can raise capital to carry on commerce and investors can obtain returns on their savings for spending on necessities or for retirement security, various organizations must be able to operate. Individual investors and institutions such as mutual funds send their orders to buy and sell stocks and options to broker-dealers that, in turn, route these orders to be executed at one of the many exchanges or electronic trading venues in the United States and abroad. After a securities trade is executed, it undergoes clearance and settlement to verify the accuracy of the transaction. Ownership of the securities is then transferred from the seller to the buyer, and the necessary payment between the two parties is exchanged. Separate organizations complete the clearance and settlement process for stocks and for options. In general, a clearing organization collects and compares trade information to ensure the accuracy of the trade and calculates the amounts that are to be exchanged between parties. A depository organization then transfers ownership and maintains the records of securities held by broker-dealers and investors. To facilitate these interactions, the large broker-dealers have accounts directly with the clearing organizations, while smaller and independent broker-dealers act as introducing firms by sending their customers’ orders to an intermediary broker-dealer, known as a clearing firm, that accepts and processes the trades and clears and settles these trades with the central clearing organization. The clearing firm’s systems also maintain the records of the cash and securities holdings of the introducing broker-dealers, and their investor customers. The monies transferred as part of securities transactions are handled by the banks that maintain accounts for broker-dealers and accept and make payments for these firms’ securities activities. Payment processing systems operated by the Federal Reserve or private firms process the payments that are exchanged between the clearing banks used by the clearing organizations, broker-dealers, and their customers. Virtually all of the information processed is transferred electronically between parties; clearance and settlement and payment transactions take place over proprietary networks that do not traverse the public Internet infrastructure. Figure 2 illustrates how these various organizations participate in a trade. Although thousands of entities are active in the U.S. securities markets, certain key organizations are more critical to the ability of the markets to function, usually because they offer unique products or perform vital services. For example, markets cannot function without the activities performed by clearing organizations and in some cases, only one clearing organization exists for particular products. In addition, other market participants are critical to overall market functioning because they consolidate and distribute price quotations or information on executed trades. The inability of any one broker-dealer firm to continue operations during an event would not likely affect the markets as a whole, but a small number of large broker-dealers generally account for sizeable portions of the daily trading volume on many exchanges.