Various laws and directives guide DHS’s role in critical infrastructure protection, including the Homeland Security Act of 2002, as amended, the Homeland Security Presidential Directive/HSPD-7, and most recently, Presidential Policy Directive/PPD-21, which was issued on February 12, 2013. Consistent with HSPD-7, which directed DHS to establish uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across CI sectors, 18 CI sectors were established. PPD-21, among other things, purports to refine and clarify critical infrastructure-related functions, roles, and responsibilities across the federal government, and enhance overall coordination and collaboration. Pursuant to PPD-21, which expressly revoked HSPD-7, 2 of the 18 sectors were incorporated into existing sectors, thereby reducing the number of CI sectors from 18 to 16 (app. I lists the CI sectors and their SSAs). PPD-21 directs DHS to, among other things, coordinate the overall federal effort to promote the security and resilience of the nation’s critical infrastructure. PPD-21 also recognizes that DHS, in carrying out its responsibilities under the Homeland Security Act, evaluates national capabilities, opportunities, and challenges in protecting critical infrastructure; analyzes threats to, vulnerabilities of, and potential consequences from all hazards on critical infrastructure; identifies security and resilience functions that are necessary for effective public-private engagement with all critical infrastructure sectors; and integrates and coordinates federal cross-sector security and resilience activities and identify and analyze key interdependencies among critical infrastructure sectors. Within DHS, NPPD’s IP is responsible for various activities intended to enhance CI protection and resilience across a number of sectors. While other entities may possess and exercise regulatory authority over CI to address security, such as for the chemical, transportation, and nuclear sectors, IP generally relies on voluntary efforts to secure CI because, in general, DHS has limited authority to directly regulate CI. In carrying out its responsibilities, IP leads and coordinates national programs and policies on critical infrastructure issues and, among other things, conducts and facilitates security surveys and vulnerability assessments to help CI owners and operators and state, local, tribal, and territorial partners understand and address risks. In so doing, IP is responsible for working with public and private sector CI partners in the 16 sectors and leads the coordinated national effort to mitigate risk to the nation’s CI through the development and implementation of CI protection and resilience programs. IP’s Protective Security Coordination Division (PSCD) provides programs and initiatives to enhance CI protection and resilience and reduce risk associated with all-hazards incidents. In so doing, PSCD works with CI owners and operators and state and local responders to (1) assess vulnerabilities, interdependencies, capabilities, and incident consequences; (2) develop, implement, and provide national coordination for protective programs; and (3) facilitate CI response to and recovery from incidents. Related to these efforts, PSCD has deployed 91 PSAs in 50 states and Puerto Rico, with deployment locations based on population density and major concentrations of CI. In these locations, PSAs are to act as the links between state, local, tribal, and territorial organizations and DHS infrastructure mission partners in the private sector and are to assist with ongoing state and local CI security efforts. PSAs are also to support the development of the national risk picture by conducting vulnerability and security assessments to identify security gaps and potential vulnerabilities in the nation’s most critical infrastructures. In addition, PSAs are to share vulnerability information and protective measure suggestions with local partners and asset owners and operators. As discussed earlier, DHS developed the RRAP to assess vulnerability and risk associated with dependent and interdependent infrastructure clusters and systems in specific geographic areas. RRAP projects are intended to evaluate CI on a regional level to identify facilities and sectors that are dependent on one another, or interdependent. RRAP projects also identify situations where failures at facilities or sectors would lead to failures at other facilities or sectors, characteristics that make facilities and regions within the study resilient to disruptions, and resilience vulnerabilities that could promote or foster disruptions. According to DHS officials, the sectors selected to be studied as part of a RRAP project may vary based on priorities of IP and the state(s) where the RRAP occurs, that is, the “sector” focus can be narrow or broad, depending on the concerns of the state. For example, a transportation sector RRAP project in one state focused only on bridges, while another RRAP project in another state examined lifeline sectors. The region or area covered by the RRAP project can also vary substantially. For example, the size of the “region” under study in a RRAP project in Colorado covered a few square miles within a city. Conversely, another RRAP covered an entire industry spread across a large state and yet another RRAP is looking at infrastructure that crosses 12 states. Accordingly, RRAP projects have been conducted in various locations throughout the country covering a wide variety of CI sectors and regions. These RRAP projects include one covering the financial district in Chicago; three covering commercial facilities in cities like Minneapolis, Atlanta, and Las Vegas; and one covering energy production facilities managed by the Tennessee Valley Authority. Figure 1 provides a map showing the states where RRAP projects have been completed or are planned. According to DHS officials, the current process for conducting a RRAP project can take from 18 to 24 months from start to finish. The process includes selecting and scoping RRAP projects from proposals; assembling and preparing a RRAP team of federal, state and local training the states via webinar (i.e., stakeholder awareness training); conducting an introductory kickoff (i.e., outreach) meeting; gathering preliminary data and selecting sites to be included in the scheduling meetings with asset owners or operators of the sites; conducting ongoing analyses using data derived from performing the aforementioned vulnerability and security assessments at facilities;conducting stakeholders’ meetings for training purposes and to discuss regional resilience issues; preparing a draft report for state review; incorporating the state’s feedback into a final report; and establishing a process to follow up with stakeholders to, among other things, periodically update their progress making RRAP-related enhancements. The final RRAP report typically includes a description of the key findings of the vulnerabilities in the sector(s) and region under study, including vulnerabilities for individual facilities, a hazard and risk analysis for the region and sector under review, and an analysis of dependencies and interdependencies. Also included in the RRAP report are resilience enhancement options that provide the report recipient suggestions to address key findings and mitigate the indentified vulnerability or weakness, and a list of organizations or funding sources that could provide the state and other stakeholders with support if they choose to implement an identified resilience enhancement option. RRAP reports can provide insights into the resilience of a region and the sector(s) under review and the gaps that could prompt regional disruptions. Another aspect of the program centers on DHS’s efforts to use RRAP projects to build stakeholder relationships and enhance information sharing and coordination among stakeholders in a particular region. For example, one RRAP report stated that fostering relationships between key facilities and supporting infrastructure providers was necessary to improve response to a hazard or incident. Another RRAP project sought to coordinate a partnership of key players and stakeholders (including both public and private sector stakeholders in the sector of focus and local law enforcement) to improve information sharing necessary for responding to a contamination in the food supply system. According to DHS officials, the creation and continuation of these stakeholder relationships is a major benefit of RRAP projects and the RRAP process. DHS officials said it is often the case that regional CI stakeholders were not acquainted and did not understand how their own operations were related to those of other stakeholders until the RRAP was conducted. For fiscal year 2013, as in past fiscal years, the RRAP does not have a budget line item; rather the costs for the program are funded with resources budgeted for DHS’s vulnerability assessment program and for PSAs. DHS officials estimated that the cost to PSCD for the average RRAP project is currently less than $1 million, including IP assessments, contractor support, and travel and administrative costs. The estimate does not include costs incurred for services rendered by other IP branches that participate in RRAP projects, like IP’s National Infrastructure Simulation and Analysis Center (NISAC), which, among other things, develops computerized simulations of the effect of an all- hazards event on particular geographic areas. The estimate also does not include costs incurred by other SSAs, or the states and localities participating in a RRAP project. PSCD has developed criteria that consider various factors when selecting possible locations and sectors for RRAP projects. PSCD uses the criteria to develop lists of RRAP project candidates, and officials use this list to make final project selections. However, PSCD officials do not fully document why certain project candidates are or are not recommended for selection by the IP Assistant Secretary. IP’s approach for identifying and selecting RRAP projects has evolved since the program’s inception in 2009. For fiscal years 2009 and 2010, IP headquarters officials stated that they identified and selected RRAP project locations and sectors based on IP interests and preferences while considering input from primary stakeholders. IP officials told us that they relied heavily on IP’s interests and preferences because they considered RRAP projects conducted during this time frame as pilot projects. For fiscal years 2011 and 2012, IP officials stated that they refined their process for identifying and selecting RRAP projects to incorporate more input from primary stakeholders. For example, IP officials developed a RRAP project template for PSAs and states to use when jointly developing RRAP project proposals. The template included information on regional characteristics and risk, the willingness of state and facility stakeholders to participate, potential outcomes of the RRAP analysis, and planning and logistical considerations.