The Homeland Security Act of 2002 created DHS and gave the department wide-ranging responsibilities for, among other things, leading and coordinating the overall national critical infrastructure protection effort. Homeland Security Presidential Directive (HSPD) 7 further defined critical infrastructure protection responsibilities for DHS and SSAs. HSPD-7 directed DHS to establish uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across CIKR sectors. Various other statutes and directives provide specific legal authorities for both cross sector and sector-specific protection and resiliency programs. For example, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 was enacted to improve the ability of the United States to prevent, prepare for, and respond to acts of bioterrorism and other public health emergencies, and the Pandemic and All-Hazards Preparedness Act of 2006 addresses, among other things, public health security and all-hazards preparedness and response. Also, the Cyber Security Research and Development Act, enacted in January 2002, authorized funding through fiscal year 2007for the National Institute of Standards and Technology and the National Science Foundation to facilitate increased research and development for computer and network security and to support related research fellowships and training. CIKR protection issues are also covered under various presidential directives, including HSPD-5 and HSPD-8. HSPD-5 calls for coordination among all levels of government as well as between the government and the private sector for managing domestic incidents, and HSPD-8 establishes policies to strengthen national preparedness to prevent, detect, respond to, and recover from threatened or actual domestic terrorist attacks, major disasters, and other emergencies.directives are tied together as part of the national approach for CIKR protection through the unifying framework established in HSPD-7. According to the NIPP, these separate authorities and NPPD’s IP is responsible for working with public and private sector CIKR partners in the 18 sectors and leads the coordinated national effort to mitigate risk to the nation’s CIKR through the development and implementation of CIKR protection and resilience programs. Using a sector partnership model, IP’s Partnership and Outreach Division works with sector representatives, including asset owners and operators, to develop, facilitate, and sustain strategic relationships and information sharing. IP’s Protective Security Coordination Division (PSCD) provides programs and initiatives to enhance CIKR protection and resilience and reduce risk associated with all-hazards incidents. In so doing, PSCD works with CIKR owners and operators and state and local responders to (1) assess vulnerabilities, interdependencies, capabilities, and incident consequences; (2) develop, implement, and provide national coordination for protective programs; and (3) facilitate CIKR response to and recovery from incidents. Related to these efforts, PSCD has deployed the aforementioned PSAs in 50 states and Puerto Rico, with deployment locations based on population density and major concentrations of CIKR. In these locations, PSAs are to act as the link between state, local, tribal, and territorial organizations and DHS infrastructure mission partners and are to assist with ongoing state and local CIKR security efforts by establishing and maintaining relationships with state, local, tribal, territorial, and private sector organizations; support the development of the national risk picture by conducting vulnerability and security assessments to identify security gaps and potential vulnerabilities in the nation’s most critical infrastructures; and share vulnerability information and protective measure suggestions with local partners and asset owners and operators. As part of their ongoing activities, PSAs are responsible for promoting the ECIP Initiative. Launched in September 2007, the ECIP Initiative is a voluntary program focused on forming or maintaining partnerships between DHS and CIKR owners and operators of high-priority level 1 and level 2 assets and systems, as well as other assets of significant value. According to DHS guidance, PSAs are to schedule ECIP visits with owners and operators in their districts using lists of high-priority and other significant assets provided by PSCD each year, with visits to level 1 assets being the first priority, and visits to level 2 assets being the second priority. Visits to other significant assets are to receive subsequent priority based on various factors, including whether they are of significant value based on the direction of IP; have been identified by the state homeland security office; or represent a critical dependency associated with higher- priority assets already identified. If an asset owner or operator agrees to participate in an ECIP visit, PSAs are to meet with the owner or operator to assess overall site security, identify gaps, provide education on security, and promote communication and information sharing among asset owners and operators, DHS, and state governments. One of the components of the ECIP Initiative is the security survey, formally called the Infrastructure Survey Tool, which a PSA can use to gather information on the asset’s current security posture and overall security awareness. If the asset owner or operator agrees to participate in the security survey, the PSA works with the owner or operator to apply the survey, which assesses more than 1,500 variables covering six major components—information sharing, security management, security force, protective measures, physical security, or dependencies—as well as 42 more specific subcomponents within those categories. For example, within the category “physical security” possible subcomponents include fences, gates, parking, lighting, and access control, among others. Once the survey is complete, the PSA submits the data to Argonne National Laboratory, which analyzes the data to produce protective measures index scores ranging from 0 (low protection) to 100 (high protection) for the entire asset and for each component of the survey. Argonne National Laboratory also uses the data to produce a “dashboard”—an interactive graphic tool that is provided to the asset owner or operator by the PSA. The dashboard displays the asset’s overall protective measures score, the score for each of the six major components, the mean protective measures score and major component scores for all like assets in the sector or subsector that have undergone a security survey, and high and low scores recorded for each component for all sector or subsector assets that have undergone a security survey. The asset score and the scores for other like assets show the asset owner or operator how the asset compares to similar assets in the sector. The asset owner can also use the dashboard to see the effect of making security upgrades to its asset. For example, if the dashboard shows a low score for physical security relative to those of other like assets, the owner or operator can add data on perimeter fencing to see how adding or improving a fence would increase the asset’s score, thereby bringing it more in line with those of other like assets. Figure 1 provides an example of the dashboard produced as a result of the security survey. Related to these security surveys, DHS also produced, from calendar years 2009 through 2011, summaries of the results of the security surveys related to sector or subsector security postures, known as sector summaries. These sector summaries were provided directly to SSAs in 2009 and 2010, and according to program officials were made available to SSAs in 2011 for sectors upon request. Unlike the summaries in past years, the 2011 summaries also included an “options for consideration” section that identified specific protective measures that had been adopted by the top 20 percent of assets in the sector or subsector as measured by the overall protective measures score. DHS also uses vulnerability assessments to identify security gaps and provide options for consideration to mitigate these identified gaps. These assessments are generally on-site, asset-specific assessments conducted at the request of asset owners and operators. As of September 30, 2011, DHS had conducted more than 1,500 vulnerability assessments. Generally, vulnerability assessments are conducted at individual assets by IP assessment teams in coordination with PSAs, SSAs, state and local government organizations (including law enforcement and emergency management officials), asset owners and operators, and the National Guard, which is engaged as part of a joint initiative between DHS and the National Guard Bureau (NGB). These assessment teams are staffed via an interagency agreement between DHS and NGB and include two national guardsmen—a physical security planner and a systems analyst, one of whom serves as the team lead. They may also be supplemented by contractor support or other federal personnel, such as PSAs or subject matter experts, when requested. Argonne National Laboratory staff then finalize the vulnerability assessment report—which includes options for consideration to increase an asset’s ability to detect and prevent terrorist attacks and mitigation options that address the identified vulnerabilities of the asset—and provide it to the PSA for delivery. The asset owners and operators that volunteer for the vulnerability assessments are the primary recipients of the analysis. The vulnerability assessment is developed using a questionnaire that focuses on various aspects of the security of an asset, such as vulnerabilities associated with access to asset air handling systems, physical security, and the ability to deter or withstand a blast or explosion. The vulnerability assessment report also contains a section called “options for consideration” where DHS makes suggestions to improve asset security or reduce identified vulnerabilities. For example, one vulnerability assessment report made suggestions to the asset owners or operators to explore the option of installing additional cameras to improve video surveillance in certain locations, install additional barriers to prevent vehicles from entering the facility at high speeds, and increase the training of its security staff. DHS revised the vulnerability assessment methodology in 2010 to enhance the analytical capabilities of IP. According to DHS officials, vulnerability assessments developed prior to 2010 did not have a consistent approach for gathering data on assets and did not produce results that were comparable from asset to asset. They also did not incorporate an approach for assessing asset resilience. DHS reported that the revised vulnerability assessment is intended to incorporate about 75 percent of the questions currently asked during an ECIP security survey, including questions on resilience, to bring the tool more in line with the security survey. As a result, vulnerability assessments completed beginning in 2011 have the capability to produce a dashboard similar to that produced from security surveys.