The Homeland Security Act of 2002 provides the basis for DHS responsibilities in the protection of the nation’s critical infrastructure. The act assigns DHS responsibility for developing a comprehensive national plan for securing critical infrastructure and for recommending the measures necessary to protect the key resources and critical infrastructure of the United States in coordination with other agencies and in cooperation with state and local government agencies and authorities, the private sector, and other entities. Other legislation enacted over the last decade has produced major changes in the nation’s approach to maritime security. Much of the federal framework for port security is contained in the Maritime Transportation Security Act of 2002 (MTSA). The MTSA establishes requirements for various layers of maritime security, including requiring a national security plan, area security plans, and facility and vessel security plans. DHS has placed some responsibility for this and other MTSA requirements with the Coast Guard. In October 2006, the Security and Accountability for Every Port Act of 2006 (SAFE Port Act) further refined the nation’s port security framework, For creating and codifying certain port security programs and initiatives.example, the SAFE Port Act required the development of protocols for resumption of trade following a transportation security incident, as well as Salvage Response Plans. DHS emphasizes the importance of resilience through key documents like the NIPP, QHSR, and directives. As the lead federal agency for the Marine Transportation System, the Coast Guard is responsible for facilitating the recovery of the system following a significant transportation disruption and working with maritime stakeholders in the resumption of trade. The Coast Guard is also the Sector-Specific Agency (SSA) for the Maritime subsector of the Transportation sector and coordinates the preparedness activities among the sector’s partners to prevent, protect against, respond to, and recover from all hazards that could have a debilitating effect on homeland security, public health and safety, or economic well-being. IP is responsible for working with public and private sector critical infrastructure partners and leads the coordinated national effort to mitigate risk to the nation’s critical infrastructure. IP also has the overall responsibility for coordinating implementation of the NIPP across 18 critical infrastructure sectors; overseeing the development of 18 Sector- Specific Plans; providing training and planning guidance to SSAs and owners and operators on protective measures to assist in enhancing the security of critical infrastructure within their control; and helping state, local, tribal, territorial, and private sector partners develop the capabilities to mitigate vulnerabilities and identifiable risks to their assets. IP’s Protective Security Coordination Division provides programs and initiatives to enhance critical infrastructure protection and resilience and reduce risk associated with all-hazards incidents. To carry out these responsibilities, IP has deployed PSAs in 50 states and Puerto Rico, with deployment locations based on population density and major concentrations of critical infrastructure. One PSA duty is to coordinate and conduct voluntary assessment services to assist critical infrastructure owners and operators in reviewing and strengthening their security posture. Specifically, PSAs coordinate and carry out various IP protective programs such as the Enhanced Critical Infrastructure Protection (ECIP) initiative, which is a voluntary program focused on forming or maintaining partnerships between DHS and critical infrastructure owners and operators of high-priority assets and systems, as well as other assets of significant value. The PSAs also coordinate and participate in Site Assistance Visit vulnerability assessments to identify security gaps and provide options for consideration to mitigate these identified gaps. These assessments are on-site, asset-specific, nonregulatory assessments conducted at the request of asset owners and operators. Port operations involve a complicated system of systems, which operates across multiple sectors. The port area consists of many assets that are interdependent with other sectors, such as power and water, to continue normal operations. For example, container terminals have large energy needs to operate the cranes that load and unload cargo. In most cases, backup generators cannot produce enough power to keep these cranes operational, so reliable energy production and transportation are vital to maintaining normal port operations. Similarly, refinery, chemical plant, cruise line, ferry, and other port operations also have high energy and water needs. In addition, many port operations rely heavily upon trucking and rail transportation to move personnel and cargo in and out of the port area. Furthermore, the availability of a functional labor force and information technology support—which may be located within or outside of a port area—is important for port stakeholders’ operations. Similarly, many businesses and communities rely on the port for their normal operations. Energy, food, and product shipments are vital to port operations, port stakeholders, and the broader community. Interruptions in the supply chain often have secondary and tertiary impacts that may not be immediately obvious to businesses and communities. Figure 1 illustrates some of the key stakeholders within a port and the importance of their interactions. Understanding the interdependencies among various port area stakeholders and other critical partners outside the port area is necessary to ensure and enhance a port’s resilience. National high-level documents currently promote resilience as a key national goal. Specifically, two key White House documents emphasize resilience on a national level—Presidential Policy Directive 8 (PPD-8) and the National Strategy for Global Supply Chain Security. PPD-8 defines resilience as the ability to adapt to changing conditions and withstand and rapidly recover from disruption due to emergencies. The National Strategy for Global Supply Chain Security endorses building a layered defense, addressing threats early, and fostering a resilient system that can absorb and recover rapidly from unanticipated disruptions. Key federal entities, including DHS, are currently working to develop frameworks or other strategies for implementing the goals and objectives of these documents, which should provide greater insights into how they plan to strengthen national resilience. Since 2009, DHS has also emphasized the concept of resilience through two high-level documents—the NIPP and QHSR. The NIPP identifies resilience as a national objective for critical infrastructure protection and defines resilience as the ability to resist, absorb, recover from, or successfully adapt to adversity or a change in conditions. The QHSR identifies ensuring resilience to disaster as one of the nation’s five homeland security missions.resilience as fostering individual, community, and system robustness, adaptability, and capacity for rapid recovery. According to DHS, resilience is one of the foundational elements for a comprehensive approach to homeland security; thus, its missions and programs designed to enhance national resilience span the department. Accordingly, DHS is currently developing a policy to bring a cohesive understanding of resilience to its components and establish resilience objectives. DHS took steps to foster departmentwide resilience initiatives by creating two internal entities—the Resilience Integration Team (RIT) and the Office of Resilience Policy (ORP). In April 2010, DHS formed RIT to develop new initiatives that support the overarching resilience mission set forth in the QHSR. To date, RIT has been the key DHS-wide working group charged with developing and disseminating resilience concepts.According to agency officials, RIT brings together subject matter experts from all components whose missions affect resilience in some manner for monthly meetings. DHS formed ORP in March 2012 to coordinate and promulgate resilience strategies throughout the department. In 2010, RIT officials surveyed components about how their activities addressed resilience in an attempt to gauge components’ understanding of resilience, as discussed in the QHSR. According to RIT officials, component responses showed that component resilience actions were very diverse and represented stovepiped efforts that were still “works in progress.” ORP officials told us that these differing approaches to implementing and identifying resilience efforts were part of the reason they saw a need for one DHS resilience policy. Specifically, ORP saw a need to establish a policy that provides component agencies with a single, consistent, departmentwide understanding of resilience; clarifies and consolidates the concepts from the four high-level guiding documents discussed above; and helps components understand how their activities address DHS’s proposed resilience objectives. The policy is currently in draft status, and ORP officials hope to have an approved policy in place later this year. Although DHS is developing a policy to establish a departmentwide resilience framework, DHS officials stated that they currently have no plans to develop an implementation strategy for DHS’s resilience policy. An implementation strategy that defines goals, objectives, and activities could help ensure that the policy is adopted consistently and in a timely manner by components, and that all components share common priorities and objectives. Additionally, an implementation strategy with specific milestones could help hold ORP and DHS components accountable for taking actions to address resilience objectives identified in the new policy in a timely manner. ORP officials acknowledged that an implementation strategy could be beneficial because it could provide concrete steps for employing DHS’s new resilience policy and harmonizing component efforts. In previous work, we identified key characteristics that should be included in a strategy, as discussed below. Goals, subordinate objectives, activities, and performance measures set clear desired results and priorities, specific milestones, and outcome-related performance measures while giving implementing parties flexibility to pursue and achieve those results within a reasonable time frame. Organizational roles, responsibilities, and mechanisms for coordinating their efforts identify the relevant departments, components, or offices and, where appropriate, the different sectors, such as state, local, private, or international sectors. The strategy would also clarify implementing organizations’ relationships in terms of leading, supporting, and partnering. Resources, investments, and risk management identify, among other things, the sources and types of resources and investments associated with the strategy, and where those resources and investments should be targeted. As DHS implements its resilience policy, an implementation strategy with these characteristics could provide ORP with a clear and more complete picture of how DHS components are implementing this policy, as well as how the various programs and activities are helping to enhance critical infrastructure resilience in their areas of responsibility. For example, establishing desired results and priorities, such as departmentwide resilience objectives, could help components better understand and communicate how their actions and strategies fulfill those policy objectives.