The NIPP provides the framework for developing, implementing, and maintaining a coordinated national effort to bring together government at all levels, the private sector, nongovernmental organizations, and international partners to manage the risks to CIKR. In addition to the Homeland Security Act, various statutes provide legal authority for both cross-sector and sector-specific protection and resiliency programs. For example, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 was intended to improve the ability of the United States to prevent, prepare for, and respond to acts of bioterrorism and other public health emergencies and the Pandemic and All-Hazards Preparedness Act addresses public health security and all-hazards preparedness and response. Also, the Cyber Security Research and Development Act of 2002 authorized funding for the National Institute of Standards and Technology (NIST) and the National Science Foundation to facilitate increased research and development for computer and network security and to support research fellowships and training. CIKR protection issues are also covered under various presidential directives, including HSPD-5 and HSPD-8. HSPD-5 calls for coordination among all levels of government as well as between the government and the private sector for domestic incident management, and HSPD-8 establishes policies to strengthen national preparedness to prevent, detect, respond to, and recover from threatened domestic terrorist attacks and other emergencies. These separate authorities and directives are tied together as part of the national approach for CIKR protection through the unifying framework established in HSPD-7. The NIPP outlines the roles and responsibilities of DHS and other security partners—including other federal agencies, state, territorial, local, and tribal governments, and private companies. Within the NIPP framework, DHS is responsible for leading and coordinating the overall national effort to enhance protection via 18 CIKR sectors. The NIPP is prepared by the NIPP Program Management Office (PMO) within the Infrastructure Protection office of the National Preparedness and Protection Directorate of DHS. The NIPP PMO has the responsibility for coordinating and ensuring development, implementation, and maintenance of the NIPP and the associated sector-specific plans. HSPD-7 and the NIPP assign responsibility for CIKR sectors to SSAs. As an SSA, DHS has direct responsibility for leading, integrating, and coordinating efforts of sector partners to protect 11 CIKR sectors. The remaining sectors are coordinated by eight other federal agencies. The NIPP depends on supporting SSPs for full implementation of this framework within and across CIKR sectors. SSPs are developed by the SSAs designated in HSPD-7 in close collaboration with sector partners, including sector and government coordinating councils. These SSPs contain the plan to identify and address the risks to CIKR specific to each sector and are reviewed by DHS for adherence to DHS guidance which follows the format of the NIPP. Table 1 lists the SSAs and their sectors. The concept of resilience has gained particular importance and application in a number of areas of federal CIKR planning. Both Congress and executive branch agencies have addressed resilience in relation to the importance of the recovery of the nation’s critical infrastructure from damage. In February 2006, the Task Force of the Homeland Security Advisory Council defined resiliency as “the capability of a system to maintain its functions and structure in the face of internal and external change and to degrade gracefully when it must.” Later in 2006, the Department of Homeland Security’s National Infrastructure Protection Plan defined resilience as “the capability of an asset, system, or network to maintain its function during or to recover from a terrorist attack or other incident.” In May 2007 the President issued Homeland Security Presidential Directive 20—National Continuity Policy. This directive establishes a comprehensive national policy on the continuity of federal government structures and operations and a single National Continuity Coordinator responsible for coordinating the development and implementation of federal continuity policies. It also directs executive departments and agencies to integrate continuity requirements into operations, and provides guidance for state, local, territorial, and tribal governments, and private sector organizations in order to ensure a comprehensive and integrated national continuity program that will enhance the credibility of our national security posture and enable a more rapid and effective response to and recovery from a national emergency. As part of Homeland Security Presidential Directive 20, the Secretary of Homeland Security is directed to, among other things, coordinate the implementation, execution, and assessment of continuity operations and activities; develop, lead, and conduct a federal continuity training and exercise program, which shall be incorporated into the National Exercise Program; and develop and promulgate continuity planning guidance to state, local, territorial, and tribal governments, and private sector critical infrastructure owners and operators. For additional discussion of the concept of resiliency, see appendix 1. DHS incorporated changes in the 2009 NIPP—including a greater emphasis on CIKR regional planning and updates to DHS’s overall risk management framework—that NIPP PMO officials said are based on stakeholder input and sectors’ experiences performing critical infrastructure protection. Based on DHS guidance, SSAs are expected to address many of the changes to the NIPP in their SSPs, based on consultation with sector partners. Table 2 provides an overview of key changes to the NIPP. DHS changes to the 2009 NIPP include increased emphasis on regional planning and risk management and, according to PMO officials, these changes are based on stakeholder input and sectors’ experiences performing critical infrastructure protection. The changes we identified in the 2009 NIPP were generally foreshadowed in the 2007/2008 NIPP Update provided to SSAs in 2008. While most of the changes in the 2009 NIPP were minor and related to changes in programs or activities that have occurred since the publication of the 2006 NIPP, several could have an impact on the sector planning process and the development of SSPs. These included changes that placed a greater emphasis on regional planning, coordination and information-sharing across sectors; changes in how critical infrastructures are identified and prioritized; developments in risk management to include how threats, vulnerabilities, and consequences are assessed; and a greater emphasis on cyber security and international interdependencies. In contrast to the 2006 NIPP, DHS increased its emphasis on regional planning, coordination and information-sharing in the 2009 NIPP. DHS discussed the need for regional coordination in the 2006 NIPP and encouraged stakeholders to address CIKR protection across sectors within and across geographic regions. In the 2006 NIPP, regional bodies were to be formed on an “as needed” basis. By contrast, the 2009 NIPP called for regional coordination through the formation of a consortium of representatives from multiple regional organizations. The 2009 NIPP states that this was done to help enhance the engagement of regionally based partners and to leverage the CIKR protection activities and resiliency strategies that they lead. In comparison to the 2006 NIPP, DHS included a discussion of changes in how critical infrastructures are identified and prioritized in the 2009 NIPP. Both the 2006 NIPP and the 2009 NIPP stated that CIKR inventory lists were developed from multiple sources, including sector inventories maintained by SSAs and government coordinating councils, voluntary submissions from CIKR partners in the public or private sector, and the results of studies conducted by various trade associations, advocacy groups, and regulatory agencies. While the 2006 NIPP briefly discusses its efforts to determine which assets are nationally critical, the 2009 NIPP includes a more detailed discussion of the national CIKR prioritization program that places CIKR into categories according to their importance, nationally or regionally. Specifically, DHS prioritized assets using a tiered approach. Tier 1 or Tier 2 assets are those that if destroyed or disrupted could cause significant casualties, major economic losses, or widespread and long-term disruptions to national well-being and governance capacity. According to DHS, the overwhelming majority of the assets and systems identified through this effort are classified as Tier 2. Only a small subset of assets meet the Tier 1 consequence threshold—those whose loss or damage could result in major national or regional impacts similar to the impacts of Hurricane Katrina or the September 11, 2001, attacks. DHS also provided a detailed discussion of risk management methodologies in the 2009 NIPP, as compared to the 2006 NIPP. Whereas the 2006 NIPP listed the baseline criteria—minimum requirements—for conducting risk analyses to ensure they are credible and comparable, the 2009 NIPP includes the use of a common risk assessment approach, including the core criteria—updated requirements—for threat, vulnerability, and consequence analyses designed to allow the comparison of risk across sectors. For example, regarding consequence assessments, the 2006 NIPP discusses the use of consequence screening to help CIKR owners and operators determine whether it is necessary to provide additional information to DHS or the SSA. Consequence screening is an approach that allows CIKR owners and operators to identify their projected level of consequence based on the nature of their business, proximity to significant populations or other CIKR, relative importance to the national economy or military capability, and other similar factors. In contrast the 2009 NIPP includes a discussion of consequence uncertainty where a range of outcomes is possible. The 2009 NIPP states that where the range of outcomes is large, greater detail may be required to calculate consequence and inform decisionmaking. As part of this risk management discussion, DHS has also made changes regarding how sectors are to measure the performance of their CIKR programs. While both the 2006 and 2009 NIPP discuss descriptive and process or output data, the 2009 NIPP included additional discussion regarding the development of metrics that assess how well programs reduced the risk to the sector. The 2009 NIPP also discusses changes made to the approach for conducting these assessments. For example, whereas the 2006 NIPP focused on facility vulnerability assessments, the 2009 NIPP discusses broader assessment efforts, including DHS’s efforts to conduct a systemwide vulnerability assessment.