Critical infrastructures are systems and assets, whether physical or virtual, so vital to our nation that their incapacity or destruction would have a debilitating impact on national security, economic well-being, pubic health or safety, or any combination of these. Critical infrastructure includes, among other things, banking and financial institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned by the private sector. As these critical infrastructures have become increasingly dependent on computer systems and networks, the interconnectivity between information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt critical systems, with potentially harmful effects. Because the private sector owns most of the nation’s critical infrastructures, forming effective partnerships between the public and private sectors is vital to successfully protect cyber-reliant critical assets from a multitude of threats, including terrorists, criminals, and hostile nations. Federal law and policy have established roles and responsibilities for federal agencies to work with the private sector and other entities in enhancing the cyber and physical security of critical public and private infrastructures. These policies stress the importance of coordination between the government and the private sector to protect the nation’s computer-reliant critical infrastructure. In addition, they establish the Department of Homeland Security (DHS) as the focal point for the security of cyberspace—including analysis, warning, information sharing, vulnerability reduction, mitigation efforts, and recovery efforts for public and private critical infrastructure and information systems. Federal policy also establishes critical infrastructure sectors, assigns federal agencies to each sector (known as sector lead agencies), and encourages private sector involvement. Table 1 shows the 18 critical infrastructure sectors and the lead agencies assigned to each sector. In May 1998, Presidential Decision Directive 63 (PDD-63) established critical infrastructure protection as a national goal and presented a strategy for cooperative efforts by the government and the private sector to protect the physical and cyber-based systems essential to the minimum operations of the economy and the government. Among other things, this directive encouraged the development of information sharing and analysis centers (ISAC) to serve as mechanisms for gathering, analyzing, and disseminating information on cyber infrastructure threats and vulnerabilities to and from owners and operators of the sectors and the federal government. For example, the Financial Services, Electricity Sector, IT, and Communications ISACs represent sectors or subcomponents of sectors. The Homeland Security Act of 2002 created the Department of Homeland Security. Among other things, DHS was assigned with the following critical infrastructure protection responsibilities: (1) developing a comprehensive national plan for securing the key resources and critical infrastructures of the United States, (2) recommending measures to protect those key resources and critical infrastructures in coordination with other groups, and (3) disseminating, as appropriate, information to assist in the deterrence, prevention, and preemption of or response to terrorist attacks. In 2003, the National Strategy to Secure Cyberspace was issued, which assigned DHS multiple leadership roles and responsibilities in protecting the nation’s cyber critical infrastructure. These include (1) developing a comprehensive national plan for critical infrastructure protection; (2) developing and enhancing national cyber analysis and warning capabilities; (3) providing and coordinating incident response and recovery planning, including conducting incident response exercises; (4) identifying, assessing, and supporting efforts to reduce cyber threats and vulnerabilities, including those associated with infrastructure control systems; and (5) strengthening international cyberspace security. PDD-63 was superseded in December 2003 when Homeland Security Presidential Directive 7 (HSPD-7) was issued. HSPD-7 defined additional responsibilities for DHS, sector-specific agencies, and other departments and agencies. The directive instructs sector-specific agencies to identify, prioritize, and coordinate the protection of critical infrastructures to prevent, deter, and mitigate the effects of attacks. It also makes DHS responsible for, among other things, coordinating national critical infrastructure protection efforts and establishing uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across sectors. As part of its implementation of the cyberspace strategy and other requirements to establish cyber analysis and warning capabilities for the nation, DHS established the United States Computer Emergency Readiness Team (US-CERT) to help protect the nation’s information infrastructure. US-CERT is the focal point for the government’s interaction with federal and private-sector entities 24 hours a day, 7 days a week, and provides cyber-related analysis, warning, information-sharing, major incident response, and national-level recovery efforts. Threats to systems supporting critical infrastructure are evolving and growing. In February 2011, the Director of National Intelligence testified that, in the past year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, including a more than tripling of the volume of malicious software since 2009. Different types of cyber threats from numerous sources may adversely affect computers, software, networks, organizations, entire industries, or the Internet itself. Cyber threats can be unintentional or intentional. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. The potential impact of these threats is amplified by the connectivity between information systems, the Internet, and other infrastructures, creating opportunities for attackers to disrupt telecommunications, electrical power, and other critical services. For example, in May 2008, we reported that the Tennessee Valley Authority’s (TVA) corporate network contained security weaknesses that could lead to the disruption of control systems networks and devices connected to that network. We made 19 recommendations to improve the implementation of information security program activities for the control systems governing TVA’s critical infrastructures and 73 recommendations to address specific weaknesses in security controls. TVA concurred with the recommendations and has taken steps to implement them. As government, private sector, and personal activities continue to move to networked operations, the threat will continue to grow. Recent reports of cyber attacks illustrate that the cyber-based attacks on cyber-reliant critical infrastructures could have a debilitating impact on national and economic security. In June 2011, a major bank reported that hackers broke into its systems and gained access to the personal information of hundreds of thousands of customers. Through the bank’s online banking system, the attackers were able to view certain private customer information. In March 2011, according to the Deputy Secretary of Defense, a cyber attack on a defense company’s network captured 24,000 files containing Defense Department information. He added that nations typically launch such attacks, but there is a growing risk of terrorist groups and rogue states developing similar capabilities. In March 2011, a security company reported that it had suffered a sophisticated cyber attack that removed information about its two- factor authentication tool. According to the company, the extracted information did not enable successful direct attacks on any of its customers; however, the information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. In February 2011, media reports stated that computer hackers broke into and stole proprietary information worth millions of dollars from the networks of six U.S. and European energy companies. In July 2010, a sophisticated computer attack, known as Stuxnet, was discovered. It targeted control systems used to operate industrial processes in the energy, nuclear, and other critical sectors. It is designed to exploit a combination of vulnerabilities to gain access to its target and modify code to change the process. In January 2010, it was reported that at least 30 technology companies—most in Silicon Valley, California—were victims of intrusions. The cyber attackers infected computers with hidden programs allowing unauthorized access to files that may have included the companies’ computer security systems, crucial corporate data, and software source code. Over the past 2 years, the federal government has taken a number of steps aimed at addressing cyber threats to critical infrastructure. In early 2009, the President initiated a review of the nation’s cyberspace policy that specifically assessed the missions and activities associated with the nation’s information and communication infrastructure and issued the results in May of that year. The review resulted in 24 near- and mid- term recommendations to address organizational and policy changes to improve the current U.S. approach to cybersecurity. These included, among other things, that the President appoint a cybersecurity policy official for coordinating the nation’s cybersecurity policies and activities. In December 2009, the President appointed a Special Assistant to the President and Cybersecurity Coordinator to serve in this role and act as the central coordinator for the nation’s cybersecurity policies and activities. Among other things, this official is to chair the primary policy coordination body within the Executive Office of the President responsible for directing and overseeing issues related to achieving a reliable global information and communications infrastructure. Also in 2009, DHS issued an updated version of its National Infrastructure Protection Plan (NIPP). The NIPP is intended to provide the framework for a coordinated national approach to addressing the full range of physical, cyber, and human threats and vulnerabilities that pose risks to the nation’s critical infrastructures. The NIPP relies on a sector partnership model as the primary means of coordinating government and private-sector critical infrastructure protection efforts. Under this model, each sector has both a government council and a private sector council to address sector-specific planning and coordination. The government and private-sector councils are to work in tandem to create the context, framework, and support for the coordination and information-sharing activities required to implement and sustain each sector’s infrastructure protection efforts. The council framework allows for the involvement of representatives from all levels of government and the private sector, to facilitate collaboration and information-sharing in order to assess events accurately, formulate risk assessments, and determine appropriate protective measures.