According to DOD’s Strategy for Homeland Defense and Civil Support, dated June 2005, without the important contributions of the private sector, DOD cannot effectively execute its core defense missions. Private industry manufacturers provide the majority of equipment, materials, services, and weapons for the U.S. armed forces. The President designated DOD as the sector-specific agency for the DIB. In this role, DOD is responsible for collaborating with all relevant federal departments and agencies, state and local governments, and the private sector; encouraging risk management strategies; and conducting or facilitating vulnerability assessments of the DIB as set forth in HSPD-7. In executing these responsibilities, the Secretary of Defense requires a network of organizations with diverse roles and missions. Key participants in the network include the following: The Undersecretary of Defense for Acquisition, Technology, and Logistics, USD(AT&L), who is responsible for, among other things, integrating DCIP policies into acquisition, procurement, and installation policy guidance and for coordinating with ASD(HD&ASA) to ensure DCIP-related guidance is developed and implemented, and that system providers remediate vulnerabilities identified prior to system fielding or deployment. ASD(HD&ASA), which serves as the principal civilian advisor to the Secretary of Defense on the identification, prioritization, and protection of DOD’s critical infrastructure. ASD(HD&ASA) assigned responsibility for the DCIP, including DIB sector-specific agency responsibilities, to the Director for Critical Infrastructure Protection under the Deputy Assistant Secretary of Defense for Crisis Management and Defense Support to Civil Authorities. The DCIP office provides policy, program oversight, integration, and coordination of activities. DCMA, which is the defense sector lead agent responsible for the coordination and oversight of DCIP matters pertaining to the DIB because of DCMA’s established working relationship with DIB owners/operators. DCMA responsibilities include planning and coordinating with all DOD components and private-sector partners that own or operate elements of the DIB. Private-sector owners, operators, and organizations; and other federal departments and agencies, including DHS, the FBI, and the Departments of Energy, Commerce, the Treasury, and State. It also includes state and local agencies, international organizations, and foreign countries. Under Homeland Security Presidential Directive 7, federal departments and agencies are to identify, prioritize, and coordinate the protection of critical infrastructure and key resources in order to prevent, deter, and mitigate the effects of deliberate efforts to destroy, incapacitate, or exploit the infrastructure and resources; and they are to work with state and local governments and the private sector to accomplish this objective. Sector- specific agencies, among other things, are to encourage risk management strategies to protect against and mitigate the effect of attacks against critical infrastructure and key resources. DOD’s risk management approach is based on assessing threats, vulnerabilities, criticalities, and the ability to respond to incidents. Threat assessments identify and evaluate potential threats on the basis of capabilities, intentions, and past activities. Vulnerability assessments identify potential weaknesses that may be exploited and recommend options to address those weaknesses. Criticality assessments evaluate and prioritize contractors on the basis of their importance to mission success. These assessments help prioritize limited resources and thus, if implemented properly, would reduce the expense of resources on lower- priority contractors. DOD’s risk management approach also includes an assessment of the ability to respond to, and recover from, an incident. ASD(HD&ASA) officials said it provided research and development funding for program development in fiscal years 2005 and 2006 of $550,000 and $675,000, respectively. It did not provide research and development funding to DCMA in 2007 and said it did not intend to provide any during the period of fiscal years 2008 to 2013. They said that for operations and maintenance, DOD funded the program at about $1.1 million and $1.0 million in fiscal years 2004 and 2005, respectively; and $2.5 million and $2.0 million in fiscal years 2006 and 2007, respectively. DOD plans to increase operations and maintenance funding to about $8.3 million in fiscal year 2008, about $9.4 million in 2009, and about $10.1 million in 2010 before decreasing it to about $8.8–$8.7 million in subsequent fiscal years through fiscal year 2013. In January 2007, the Joint Requirements Oversight Council, chaired by the Vice Chairman of the Joint Chiefs of Staff, approved the National Guard Critical Infrastructure Program— Mission Assurance Assessment (CIP-MAA) capability for the DIB. The council agreed that the services will provide funding to meet the requirements for fiscal years 2008–2013, and it endorsed the National Guard as the overall lead agency to implement the CIP-MAA. The operations and maintenance funding is summarized in figure 1. DOD has begun developing and implementing a risk management approach to ensure the availability of DIB assets needed to support mission-essential tasks, though implementation is still at an early stage. The approach comprises two plans. First, the DIB sector assurance plan, issued in May 2005 and updated in May 2007, outlines an approach for identifying vulnerabilities, risks, and effect on business; implementing remediation and mitigation strategies; and managing consequences to ensure continuity of operations. Second, the DIB sector-specific plan, submitted in December 2006, outlines DOD’s approach to executing its sector-specific responsibilities, follows guidance established by DHS, and complements other DOD critical infrastructure policy. It focuses efforts on assets, systems, networks, and functions that, if damaged, would result in unacceptable consequences to the DOD mission, national economic security, public health and safety, or public confidence. The sector assurance plan provides a coordinated strategy for managing risk at DIB critical asset sites located throughout the world and describes a risk management approach and plans for the DIB. It focuses on steps to (1) identify a critical asset list; (2) prioritize the critical assets on that list; (3) perform vulnerability assessments on high-priority critical assets; and (4) encourage contractors’ actions to remediate or mitigate adverse effects found during these assessments, as appropriate, to ensure continuity of business operations. DOD depends on the DIB to accomplish its work in support of military missions. The absence or unavailability of some assets designated as critical DIB assets, and the products and services these assets produce, could cause military mission failure. To identify DIB critical assets, DCMA industrial analysts and other DOD personnel compiled a list of approximately 900 important defense contractor assets, and then narrowed this number by using another set of criteria. DCMA has also developed an asset prioritization model for determining a criticality score and ranking critical assets, from highest to lowest risk. It has established a standardized mission assurance vulnerability assessment process for critical DIB assets, and as of June 1, 2007, had completed and issued reports for eight assessments and had three other assessments in process. ASD(HD&ASA) is developing guidance to provide a standardized process for determining, planning, and implementing remediation actions for DOD personnel involved in remediating risks and supporting overall DOD mission assurance. Table 1 provides a summary of the current number of important and critical DIB assets identified and the number of contractors assessed. DCMA has developed a process to identify the most important DIB assets and to narrow this list to those it considers critical using a tiered approach that enables identification of important capabilities and critical assets from the hundreds of thousands of entities constituting the DIB. The collection of data on each entity within the DIB was considered neither practical nor an effective use of limited resources, so DCMA focused on reducing the magnitude of assets to a manageable number through the use of government DIB subject-matter experts. DCMA has developed a process to identify the most important DIB assets and to narrow this list to those it considers critical. The criteria used for both lists are shown below in table 2. The critical asset list is reviewed, updated, and approved annually. DCMA identifies potential assets meeting the criteria, and the military services and defense agencies then validate and update the list. DCMA reviews and validates the updated list and prioritizes it using the asset priority model. DCMA then coordinates with senior acquisition executives and submits the revised critical asset list for approval to the Deputy Under Secretary of Defense for Industrial Policy, USD(AT&L), and ASD(HD&ASA). DCMA has been developing an asset prioritization model for determining a criticality score and ranking critical assets from highest to lowest risk. This model is to provide a mechanism for DCMA to allocate limited resources to those critical DIB assets assessed to be most vulnerable: the higher the score, the higher the priority of the asset for vulnerability assessment and possible remediation/mitigation actions. The model uses 16 weighted factors that are aggregated to assign a vulnerability score to each asset. These factors are broadly classified into mission (5), economic (4), threat (5), and other (2), as shown below in table 3. Data for the determination of these factors are collected from DCMA surveys and analysis, supplemented by various commercial and government sources, including the Defense Logistics Agency, the military services, and the combatant commands. If there are missing data for a given item, DCMA’s rule is to default to a high-risk score, as this is the most conservative assumption. For threat data currently obtained by DCMA, the model includes an assessment of current, potential, and technologically feasible threats to assets from hostile parties as well as from natural or accidental disasters inherent to the asset or its location. Hostile threat information is collected by the Counter Intelligence Field Activity office from various intelligence sources and then summarized in a threat assessment document for specific sites during the prioritization process, and in a detailed threat assessment prior to conducting an actual National Guard assessment of a site.