The Homeland Security Act, as well as other statutes, provide legal authority for both cross-sector and sector-specific protection and resiliency programs. For example, the purpose of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 is to improve the ability of the United States to prevent, prepare for, and respond to acts of bioterrorism and other public health emergencies, and the Pandemic and All-Hazards Preparedness Act of 2006 addresses public health security and all-hazards preparedness and response. Also, the Cyber Security Research and Development Act of 2002 authorized funding for the National Institute of Standards and Technology and the National Science Foundation to facilitate increased research and development for computer and network security and to support research fellowships and training. CIKR protection issues are also covered under various presidential directives, including HSPD-5 and HSPD-8. HSPD-5 calls for coordination among all levels of government as well as between the government and the private sector for domestic incident management, and HSPD-8 establishes policies to strengthen national preparedness to prevent, detect, respond to, and recover from threatened domestic terrorist attacks and other emergencies. These separate authorities and directives are tied together as part of the national approach for CIKR protection through the unifying framework established in HSPD-7. The NIPP outlines the roles and responsibilities of DHS and its partners— including other federal agencies, state, local, territorial, and tribal governments, and private companies. Within the NIPP framework, DHS is responsible for leading and coordinating the overall national effort to enhance protection via 18 CIKR sectors. HSPD-7 and the NIPP assign responsibility for CIKR sectors to SSAs. As an SSA, DHS has direct responsibility for leading, integrating, and coordinating efforts of sector partners to protect 11 of the 18 CIKR sectors. The remaining sectors are coordinated by 8 other federal agencies. Table 1 lists the SSAs and their sectors. The DHS’s Office of Infrastructure Protection (IP), located in the National Protection and Programs Directorate, is responsible for working with public- and private-sector CIKR partners and leads the coordinated national effort to mitigate risk to the nation’s CIKR through the development and implementation of the CIKR protection program. Using a sector partnership model, IP’s Partnership and Outreach Division (POD) works with owners and operators of the nation’s CIKR to develop, facilitate, and sustain strategic relationships and information sharing, including the sharing of best practices. The POD also works with public and private partners to coordinate efforts to establish and operate various councils intended to protect CIKR and provide CIKR functions to strengthen incident response. These councils include the aforementioned SCCs, which coordinate sectorwide CIKR activities and initiatives among private sector owners, operators, and trade associations in each of the 18 sectors, and the GCCs that represent federal, state, and local government and tribal interests to support the effort of SCCs to develop collaborative strategies for CIKR protection for each of the 18 sectors. The partnership model also includes various cross-sector councils, including the CIKR Cross-Sector Council, which addresses cross-sector issues and interdependencies among SCCs; the NIPP Federal Senior Leadership Council, which focuses on enhanced communication and coordination between and among federal departments and agencies responsible for implementing the NIPP and HSPD-7; and the State, Local, Tribal, and Territorial Government Coordinating Council, which promotes coordination across state and local jurisdictions. The model also includes a Regional Consortium Coordinating Council, which bring together representatives of regional partnerships, groupings, and governance bodies to foster coordination among CIKR partners within and across geographical areas and sectors. Figure 1 illustrates the sector partnership model and the interrelationships among the various councils, sectors, and asset owners and operators. IP’s Protective Security Coordination Division (PSCD) also operates the Protective Security Advisor Program, which deploys critical infrastructure protection and security specialists, called PSAs, to local communities throughout the country. Established in 2004, the program has 93 PSAs serving in 74 districts in 50 states and Puerto Rico, with deployment locations based on population density and major concentrations of CIKR throughout the United States. PSAs lead IP’s efforts in these locations and act as the link between state, local, tribal, and territorial organizations and DHS infrastructure mission partners. PSAs are to assist with ongoing state and local CIKR security efforts by establishing and maintaining relationships with state Homeland Security Advisors, State Critical Infrastructure Protection stakeholders, and other state, local, tribal, territorial and private-sector organizations. PSAs are to support the development of the national risk picture by conducting vulnerability and security assessments to identify security gaps and potential vulnerabilities in the nation’s most critical infrastructures. PSAs also are to share vulnerability information and protective measure suggestions with local partners and asset owners and operators. In addition, PSAs are to coordinate training for private-and public-sector officials in the communities in which they are located; support incident management; and serve as a channel of communication for state, local, tribal, and territorial officials and asset owners and operators seeking to communicate with DHS. “Despite ongoing vigilance and efforts to protect this country and its citizens, major accidents and disasters, as well as deliberate attacks, will occur. The challenge is to build the capacity of American society to be resilient in the face of disruptions, disasters, and other crises. Our vision is a Nation that understands the hazards and risks we face; is prepared for disasters; can withstand the disruptions disasters may cause; can sustain social trust, economic, and other functions under adverse conditions; can manage itself effectively during a crisis; can recover quickly and effectively; and can adapt to conditions that have changed as a result of the event.” The report also articulates that one of the goals for this mission is to “Rapidly Recover.” The two objectives associated with this goal are to (1) enhance recovery capabilities: establish and maintain nationwide capabilities for recovery from major disasters and (2) ensure continuity of essential services and functions: improve capabilities of families, communities, private-sector organizations, and all levels of government to sustain essential services and functions. Consistent with recent changes to the NIPP, DHS has begun to increase its emphasis on resiliency in the various programs it uses to assess vulnerability and risk at and among CIKR facilities so that it can help asset owners and operators identify resiliency characteristics of their facilities and provide suggested actions, called options for consideration, to help them mitigate gaps that have been identified. However, DHS has not developed an approach to measure owners’ and operators’ actions to address resiliency gaps identified as a result of these assessments. DHS has also begun to train PSAs about resiliency and how it applies to asset owners and operators, but it has not updated guidance that discusses PSAs’ roles and responsibilities to explicitly include resiliency and resiliency strategies. In March 2010 we reported that DHS has increased its emphasis on resiliency in the 2009 NIPP by, among other things, generally pairing it with the concept of protection. We further stated that DHS has encouraged SSAs to emphasize resiliency in guidance provided to them in updating their sector-specific plans. Consistent with these efforts, DHS has also taken action to develop or enhance the programs it uses to work with asset owners and operators to bring a stronger focus to resiliency. In 2009 DHS developed the RRAP to assess vulnerability and risk associated with resiliency. The RRAP is an analysis of groups of related infrastructure, regions, and systems in major metropolitan areas. The RRAP evaluates CIKR on a regional level to examine vulnerabilities, threats, and potential consequences from an all-hazards perspective to identify dependencies, interdependencies, cascading effects, resiliency characteristics, and gaps. In conducting the RRAP, DHS does an analysis of a region’s CIKR and protection and prevention capabilities and focuses on (1) integrating vulnerability and capability assessments and infrastructure protection planning efforts; (2) identifying security gaps and corresponding options for considerations to improve prevention, protection, and resiliency; (3) analyzing system recovery capabilities and providing options to secure operability during long-term recovery; and (4) assessing state and regional resiliency, mutual aid, coordination, and interoperable communication capabilities. RRAP assessments are to be conducted by DHS officials, including PSAs, in collaboration with SSAs: other federal officials; state, local, tribal, and territorial officials; and the private sector depending upon the sectors and facilities selected as well as a resiliency subject matter expert(s) deployed by the state’s homeland security agency. The results of the RRAP are to be used to enhance the overall security posture of the facilities, surrounding communities, and the geographic region covered by the project and are shared with the state. According to DHS officials, the results of specific asset-level assessments conducted as part of the RRAP are made available to asset owners and operators and other partners (as appropriate), but the final analysis and report is delivered to the state where the RRAP was conducted. One of the assessment tools DHS developed for the RRAP analysis is a “resiliency assessment builder,” which contains a series of questions designed to help officials identify resiliency issues associated with facilities included in the RRAP.