Pursuant to the Homeland Security Act of 2002, as amended, DHS has responsibility for the protection of the nation’s critical infrastructure. Within DHS, the Office of Infrastructure Protection is responsible for critical infrastructure protection and resilience and leads the coordinated national effort to mitigate risk to the nation’s critical infrastructure, which includes working with public and private sector infrastructure partners.The Office of Infrastructure Protection also has the overall responsibility for coordinating implementation of the NIPP across the 18 critical infrastructure sectors; overseeing the development of Sector-Specific Plans; providing training and planning guidance to SSAs and asset owners and operators on protective measures to assist in enhancing the security of infrastructure within their control; and helping state, local, tribal, territorial, and private sector partners develop the capabilities to mitigate vulnerabilities and identifiable risks to their assets. Within the Office of Infrastructure Protection, IASD manages the NCIPP. According to DHS, the main goals of the NCIPP are to (1) identify the infrastructure that if disrupted or destroyed could significantly affect the nation’s public health and safety, economic, or national security; (2) increase the accuracy of infrastructure prioritization efforts used to inform DHS resource allocation decisions; and (3) focus planning, foster coordination, and support preparedness efforts for incident management, response, and restoration activities among federal, state, and private sector partners. Critical infrastructure identified through the program includes several thousand level 1 or level 2 assets and systems. The levels are used to enhance decision making related to infrastructure protection and can include a range of businesses or assets in a local geographic area, such as refineries, water treatment plants, or commercial facilities, as well as the information and data systems that ensure their continued operation. Consistent with the generally voluntary critical infrastructure protection approach identified in the NIPP, according to DHS, the success of the NCIPP relies upon the voluntary contributions and cooperation of public and private sector partners from the infrastructure protection community. To compile the NCIPP list, consistent with statutory requirements, IASD conducts a voluntary annual data call to solicit nominations to the list from state homeland security and federal partners. To submit nominations, partners are to develop realistic scenarios for infrastructure that meet specific criteria developed by IASD. Consistent with the consequence categories identified in the NIPP risk management framework, NCIPP nominations are to meet minimum specified consequence thresholds outlined in the annual data call for at least two of the following four categories: fatalities, economic loss, mass evacuation length, and degradation of national security. After nominations are submitted, according to DHS guidance, IASD conducts a multiphase adjudication process intended to give state and federal partners the opportunity to review IASD’s preliminary decisions and submit additional information to support nominations that were not initially accepted, before IASD finalizes the NCIPP list. The NCIPP list is used to establish risk management priorities. According to the NIPP, prioritizing risk management efforts provides the basis for understanding potential risk mitigation benefits that are used to inform The NCIPP list, which identifies planning and resource decisions.nationally significant critical infrastructure based on consequences, informs the NIPP risk management prioritization process. The NIPP risk management prioritization process involves analyzing risk assessment results to determine which critical infrastructure faces the highest risk so that management priorities can be established. The NCIPP list is also used to, among other things: Allocate Homeland Security Grants. Within DHS, FEMA uses the number of assets included on the NCIPP list, among other data, in its risk formula for allocating State Homeland Security Program (SHSP) and UASI grant funds. The SHSP and UASI provide funding to states and cities, respectively, to support a range of preparedness activities to prevent, protect against, respond to, and recover from acts of terrorism and other catastrophic events. While the number of critical infrastructure a state or city has on the NCIPP list is used to determine the allocation of SHSP and UASI grant funds, there is no requirement that states or cities use these grant funds to enhance protection of these assets. For fiscal year 2012, FEMA allocated $294 million in SHSP funding to all 50 states, the District of Columbia, Puerto Rico, American Samoa, Guam, the Northern Mariana Islands, and the U.S. Virgin Islands. Additionally, in fiscal year 2012, FEMA allocated approximately $490 million in UASI funding to the nation’s 31 highest-risk cities. Prioritize Voluntary Critical Infrastructure Protection Programs. The Office of Infrastructure Protection’s Protective Security Coordination Division (PSCD) uses the NCIPP list and other inputs to prioritize its efforts to work with critical infrastructure owners and operators and state and local responders to (1) assess vulnerabilities, interdependencies, capabilities, and incident consequences, and (2) develop, implement, and provide national coordination for protective programs. Related to these efforts, PSCD has deployed the aforementioned PSAs in 50 states and Puerto Rico to locations based on population density and major concentrations of critical infrastructure. PSAs use the NCIPP list to prioritize outreach to level 1 and level 2 assets in their area of jurisdiction for participation in DHS’s voluntary security survey and vulnerability assessment programs, such as the Enhanced Critical Infrastructure Protection and Site PSAs are also often called upon by state Assistance Visit programs.homeland security advisers to assist them in nominating assets to the NCIPP list. Inform Incident Management Planning and Response Efforts. DHS uses information collected during the NCIPP process and the NCIPP list to inform and prioritize incident management planning and response efforts. When an incident occurs, DHS officials pull information from a variety of sources, including the database of assets nominated to and accepted on the NCIPP list, to identify critical infrastructure in the affected area. IASD then prioritizes this information in an infrastructure of concern list to guide incident response efforts. The infrastructure of concern list includes any critical infrastructure affected by the event, which may include level 1 or level 2 assets.DHS components, including FEMA and PSAs, who use it on the ground to guide local incident response efforts. DHS has made several changes to its criteria for including assets on the NCIPP list. These changes initially focused on introducing criteria to make the lists entirely consequence based, with subsequent changes intended to introduce specialized criteria for some sectors and assets. DHS’s changes to the NCIPP criteria have changed the composition of the NCIPP list, which has had an impact on users of the list. However, DHS does not have a process to identify the impact of these changes on users nor has it validated its approach for developing the list. DHS’s initial approach for developing the NCIPP list differed by asset level. According to the Homeland Security Act, as amended, DHS is required to establish and maintain a prioritized list of systems and assets that the Secretary determines would, if destroyed or disrupted, cause national or regional catastrophic effects. The criteria for level 1 assets focused on consequences—the effects of an adverse event. The criteria for level 2 assets focused generally on capacity—the number of people that use an asset or output generated by an asset, such as the number of people that occupy a commercial office building, the daily ridership of a mass transit system, or the number of people served by a water utility. DHS officials told us that the level 1 consequence-based criteria and thresholds were initially established at the beginning of the program at the discretion of the Assistant Secretary for Infrastructure Protection, who sought to identify infrastructure that the destruction of which could be expected to cause impacts similar to those caused by the attacks of In contrast, the initial level 2 September 11 and Hurricane Katrina.criteria were generally capacity based in order to identify the most critical assets within each of the 18 sectors. However, the capacity-based criteria often differed by sector, making it difficult to compare criticality across sectors and therefore identify the highest-priority critical infrastructure on a national level. In 2009, DHS changed the level 2 criteria to make the NCIPP list entirely consequence based, a change that brought its approach more into line with statutory requirements and, consistent with the NIPP risk management framework, allowed for comparison across sectors. The new level 2 criteria match the level 1 consequence-based criteria— fatalities, economic loss, mass evacuation length, or national security impacts—but with lower threshold levels than those used to identify level To be included on the NCIPP list, an asset must meet at least 1 assets.two of the four consequence thresholds, and is included on the list as either level 1 or level 2 depending on which consequence thresholds it meets. As figure 1 shows, the level 1 thresholds are higher than level 2 thresholds and therefore represent the most nationally critical assets. According to officials and agency documents, DHS changed the level 2 criteria to be consequence based for several reasons. First, NCIPP program officials stated that they changed the criteria to align the list with statutory requirements. Specifically, DHS interpreted the statute’s requirement that it identify assets that “would, if destroyed or disrupted, cause national or regional catastrophic effects,” as a call for consequence-based criteria.of assets prioritized using capacity-based criteria demonstrated that the initial level 2 criteria were not sufficient to fully identify assets capable of causing catastrophic events. Second, program officials stated that they changed the criteria to allow for comparisons across sectors, which is consistent with the NIPP. The NIPP states that using a common approach with consistent assumptions and metrics increases the ability to make comparisons across sectors, different geographic regions, or different types of events. Third, DHS also changed the criteria to improve the utility of the list.