DHS' updated infrastructure plan emphasizes systems resiliency

The updated National Infrastructure Protection Plan produced by the Homeland Security Department last year puts a greater emphasis on the resiliency of critical systems, particularly information technology systems, than did the older plan, according to a Government Accountability Office evaluation of the plan.

GAO prepared the report for the House Committee on Homeland Security.

The 2009 plan lists new cybersecurity initiatives in key industry sectors falling under the plan, including cross-sector methodologies to identify systems or networks of national importance and the addition of a cybersecurity working group and a public-private program specifically for cybersecurity. The plan also requires exercises to test the security of IT systems as well as specific IT vulnerability assessments by DHS.

Related:

DHS releases critical asset protection plan

GAO report: Critical Infrastructure Protection

The changes reflect the greater importance of resiliency in the updated plan, which puts the resiliency of critical systems on an equal level with the protection of systems, rather than as a subset of protection.

Jerald Levine, director of the DHS Audit Liaison Office, said the changes do not represent a major shift in policy. “Rather, they were intended to increase attention to and raise awareness about resilience as it applies within individual sectors,” he wrote in his response to the GAO report.

DHS was given responsibility for coordinating protection of the nation’s critical infrastructure in the Homeland Security Act of 2002. Because much of the critical infrastructure is in the hands of private industry rather than government, Homeland Security Presidential Directive 7 laid out responsibilities for sector-specific agencies in coordinating protection of infrastructure within those industrial sectors. The DHS Office of Cyber Security and Communications is the agency responsible for the IT and communications sector.

DHS released the first National Infrastructure Protection Plan in 2006, and updated it in January 2009. Agencies produced their first sector-specific plans in 2007; updated versions of the plans are due to be released in mid-2010.

The revised national plan calls for more cross-sector regional planning, as well as providing an updated risk management framework. Part of the framework is resiliency, the ability of a system to resist or bounce back from a disruption, whether caused by natural, accidental or intentional events.

Because the resiliency of critical systems was not specifically listed as a part of risk management in the original plan, “some sector partners thought that approaching risk management through increased resilience was not explicitly accepted and promoted under the NIPP,” GAO found.

Most of the changes in the 2009 plan were minor, but several could have an effect on the development of sector-specific plans, the report said. “These included changes that placed a greater emphasis on regional planning, coordination and information-sharing across sectors; changes in how critical infrastructures are identified and prioritized; developments in risk management to include how threats, vulnerabilities, and consequences are assessed; and a greater emphasis on cyber security and international interdependencies.”

The report noted that GAO had put the protection of government information systems on its high-risk list in 1997. “We consider this area high risk because federal agencies and our nation’s critical infrastructures — such as power distribution, water treatment and supply, telecommunications, national defense, and emergency services — rely extensively on computerized information systems and electronic data to carry out their operations,” the report said. “The security of these systems and data is essential to preventing disruptions in critical operations, fraud, and inappropriate disclosure of sensitive information.”

The plan calls for sector-specific agencies to include goals for cybersecurity within their sectors and explain their approach for identifying cyber assets, systems, networks and functions. It also expands the emphasis on international coordination, instructing agencies to identify foreign critical infrastructure — whether American or foreign owned — of national importance to the United States, and lists the procedures for doing so. The plan lists international organizations that are assisting in the implementation of agreements for critical infrastructure protection, including DHS’s role in a 15-nation effort specific to cyber security.

GAO said that the 2010 IT sector protection plan is expected to describe the sector’s concept of resiliency within its risk management framework, which involves assessing risk, prioritizing risk mitigation strategies, and informing sector-protective programs, research and development efforts.