Federal awareness of the importance of securing our nation’s critical infrastructures, which underpin our society, economy, and national security, has been evolving since the mid-1990’s. Over the years, a variety of working groups has been formed, special reports have been written, federal policies issued, and organizations created to address the issues that have been raised. In October 1997, the President’s Commission on Critical Infrastructure Protection issued its report, describing the potentially devastating implications of poor information security from a national perspective. The report recommended several measures to achieve a higher level of CIP, including infrastructure protection through industry cooperation and information sharing, a national organization structure, a revised program of research and development, a broad program of awareness and education, and reconsideration of laws related to infrastructure protection. The report stated that a comprehensive effort would need to “include a system of surveillance, assessment, early warning, and response mechanisms to mitigate the potential for cyberthreats.” The financial services sector was highlighted as one of several critical infrastructures that were vital to our nation’s economic security. In 1998, the President issued Presidential Decision Directive 63 (PDD 63), which established CIP as a national goal and described a strategy for cooperative efforts by government and the private sector to protect the physical and cyber-based systems essential to the minimum operations of the economy and the government. PDD 63 called for a range of actions intended to improve federal agencies’ security programs, improve the nation’s ability to detect and respond to serious computer-based and physical attacks, and establish a partnership between the government and the private sector. The directive called on the federal government to serve as a model of how infrastructure assurance is best achieved and designated lead agencies to work with private-sector and government organizations. To accomplish its goals, PDD 63 established and designated organizations to provide central coordination and support, including the Critical Infrastructure Assurance Office (CIAO), an interagency office housed in the Department of Commerce, which was established to develop a national plan for CIP on the basis of infrastructure plans developed by the private sector and federal agencies; the National Infrastructure Protection Center (NIPC), an organization within the FBI, which was expanded to address national-level threat assessment, warning, vulnerability, and law enforcement investigation and response; and the National Infrastructure Assurance Council, which was established to enhance the partnership of the public and private sectors in protecting our critical infrastructures. To ensure coverage of critical sectors, PDD 63 also identified eight private- sector infrastructures, including banking and finance, and five special functions. For each of the infrastuctures and functions, the directive designated lead federal agencies, known as sector liaisons, to work with their counterparts in the private sector, known as sector coordinators. For example, Treasury is responsible for working with the financial services sector, and the Department of Energy is responsible for working with the electrical power industry. Similarly, regarding special function areas, the Department of Defense is responsible for national defense, and the Department of State is responsible for foreign affairs. PDD 63 called for a range of actitivites intended to establish a partnership between the public and private sectors to ensure the security of our nation’s critical infrastructures. The sector liaison and the sector coordinator were to work with each other to address problems related to CIP for their sector. In particular, PDD 63 stated that they were to (1) develop and implement a vulnerability awareness and education program and (2) contribute to a sectoral National Infrastructure Assurance Plan by assessing the vulnerabilities of the sector to cyber or physical attacks; recommending a plan to eliminate significant vulnerabilities; proposing a system for identifying and preventing major attacks; and developing a plan for alerting, containing, and rebuffing an attack in progress and then, in coordination with the Federal Emergency Management Agency as appropriate, rapidly reconstituting minimum essential capabilities in the aftermath of an attack. PDD 63 also stated that sector liaisons should identify and assess economic incentives to encourage the desired sector behavior in CIP. Further, to facilitate private-sector participation, it encouraged the voluntary creation of information sharing and analysis centers (ISACs) that could serve as mechanisms for gathering, analyzing, and appropriately sanitizing and disseminating information to and from infrastructure sectors and the federal government through NIPC. In response to PDD 63, a banking and finance sector coordinating committee on CIP, chaired by a sector coordinator, was initiated by the Secretary of the Treasury in October 1998. In addition, the Financial Services ISAC (FS-ISAC) was formed in 1999. In January 2000, the White House issued its National Plan for Information Systems Protection. The national plan provided a vision and a framework for the federal government to prevent, detect, respond to, and protect the nation’s critical cyber-based infrastructure from attack and reduce existing vulnerabilities by complementing and focusing existing federal computer security and information technology requirements. Subsequent versions of the plan were expected to (1) define the roles of industry and of state and local governments working in partnership with the federal government to protect physical and cyber-based infrastructures from deliberate attack and (2) examine the international aspects of CIP. In October 2001, the President signed Executive Order 13231, establishing the President’s Critical Infrastructure Protection Board to coordinate cyber-related federal efforts and programs associated with protecting our nation’s critical infrastructures. The Special Advisor to the President for Cyberspace Security chairs the board. Executive Order 13231 tasks the board with recommending policies and coordinating programs for protecting CIP-related information systems. The board was intended to coordinate with the Office of Homeland Security in activities related to protection and recovery from attacks against information systems for critical infrastructure, including emergency preparedness communications that were assigned to the Office of Homeland Security by Executive Order 13228, dated October 8, 2001. According to Executive Order 13231, the board recommends policies and coordinates programs for protecting information systems for critical infrastructures, including emergency preparedness communications and the physical assets that support such systems. The Special Advisor reports to the Assistant to the President for National Security Affairs and to the Assistant to the President for Homeland Security. In addition, the Special Advisor, as chair of the board, coordinates with the Assistant to the President for Economic Policy on issues related to private-sector systems and economic effects and with the Director of the Office of Management and Budget (OMB) on issues related to budgets and the security of federal computer systems. Executive Order 13231 reiterated the importance and voluntary nature of the Information Sharing and Analysis Centers (ISACs). Executive Order 13231 also established 10 standing committees to support the board’s work on a wide range of critical infrastructure efforts. The Financial and Banking Information Infrastructure Committee (FBIIC), one of the standing committees, is charged with coordinating federal and state financial regulatory efforts to improve the reliability and security of the U.S. financial system. Chaired by the Department of the Treasury’s Assistant Secretary for Financial Institutions, FBIIC includes representatives from federal and state financial regulatory agencies, including the Commodity Futures Trading Commission, the Conference of State Bank Supervisors, the Federal Deposit Insurance Corporation (FDIC), the Federal Housing Finance Board, the Federal Reserve Bank of New York, the Federal Reserve Board, the National Association of Insurance Commissioners (NAIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), the Office of Federal Housing Enterprise Oversight, the Office of Homeland Security, the Office of Cyberspace Security, the Office of Thrift Supervision (OTS), and the Securities and Exchange Commission (SEC). Consistent with PDD 63, industry representatives worked collaboratively on a Treasury-sponsored working group to develop the sector’s national strategy—Defending America’s Cyberspace: Banking and Finance Sector: The National Strategy for Critical Infrastructure Assurance, Version 1.0. Treasury’s Assistant Secretary for Financial Institutions submitted the industry’s strategy, in May 2002, to the Special Advisor to the President for Cyberspace Security, with the understanding that it would provide an evolving baseline for the sector’s efforts. In July 2002, the President issued the National Strategy for Homeland Security to “mobilize and organize our nation to secure the United States homeland from terrorist attacks.” According to the strategy, the primary objectives of homeland security, in order of priority, are to (1) prevent terrorist attacks within the United States, (2) reduce America’s vulnerability to terrorism, and (3) minimize the damage and recover from attacks that do occur. The strategy identifies two critical components of CIP—critical infrastructure and intelligence and warning—as two of six mission areas. The strategy further states that if terrorists attack one or more pieces of our critical infrastructure, they may disrupt entire systems and significantly damage the nation. In addition, the national strategy continues to identify banking and finance as a critical infrastructure sector, and it adds additional sectors, as shown in table 1. On September 18, 2002, the administration released a draft National Strategy to Secure Cyberspace. The draft was developed by the President’s Critical Infrastructure Protection Board on the basis of input from officials associated with key sectors of the economy that rely on cyberspace, state and local governments, colleges and universities, and others. The draft strategy contains 86 recommendations for home users and small businesses; large private-sector corporations; federal, state, and local governments; critical sectors; and colleges and universities—among others. The draft strategy supplements existing strategies, including the National Strategy for Homeland Security, and states that the strategies’ policy statements and recommendations are subject to Executive Order 13231 and other relevant executive orders related to national security. The draft strategy calls for the continued use of public/private partnerships established through the lead federal agencies and the private-sector coordinators and the ISACs.