Protected Critical Infrastructure Information (PCII) Program Briefing to the FGDC HSWG Washington, DC September 21, 2006 Emily R. Hickey Sr. Communications Officer PCII Program Office

Overview The PCII Program Benefits of Participation Operational Processes Accreditation Program Growth and New Initiatives How to Participate in the PCII Program

The Protected Critical Infrastructure Information (PCII) Program The PCII Program is an important tool to encourage industry to share their sensitive critical infrastructure information Established under the CII Act of 2002, the PCII Program protects voluntarily submitted critical infrastructure information from: Freedom of Information Act (FOIA) State and local sunshine laws Civil litigation proceedings PCII  Information cannot be used for regulatory purposes

Examples of Critical Infrastructure Information (CII) Information defined by the CII Act includes: Threats ― Actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of a critical asset Vulnerabilities ― Ability to resist threats, including assessments or estimates of vulnerability Operational experience ― Any past operational problem or planned or past solution including repair, recovery, or extent of incapacitation

PCII Program Office Mission The Program Office’s mission is to receive, validate, facilitate access to, and safeguard PCII Facilitate Access Receive Validate

Benefits of Participation The PCII Program can: Facilitate new information sharing without compromising sensitive business information Strengthen existing public/private partnerships by adding protection to private sector’s information Enhance and increase Federal, State and local government entity access to critical infrastructure information

Operational Processes Process for Submitting CII for PCII Protection Private sector, State or local government entities, and Information Sharing and Analysis Organizations (ISAO) may voluntarily submit information that meets the definition of CII as defined in the Act. Information may be submitted to the Program Office by mail, fax, courier, or electronically through a secure Web portal at www.dhs.gov/pcii, and must include: Express Statement requesting protection Certification Statement User Access to PCII Once validated, PCII can be shared in various ways with authorized users: Hand delivery E-mail password protected file

Qualifications for PCII Status To qualify for protection under the PCII Program, critical infrastructure information must: Be voluntarily submitted to and validated by the PCII Program Office Not otherwise be required by DHS Not be customarily in the public domain

Validation Process for PCII Submissions from: Private Industry Information Sharing and Analysis Organizations (ISAO) State/local governments PCII Program Office: Checks for Express Statement Verifies receipt of required certification Reviews submitted information Determines if information meets definition of CII Meets criteria? YES NO Destroy material or return it to submitter Makes available to authorized users

Standard Access Policy To be an Authorized User, the following requirements must be met: PCII Training (Federal, State and local employees and their contractors) Contract Modification (Federal, State and local contractors) Non-Disclosure Agreement (non-Federal employees) Must be assigned homeland security duties (Federal, State and local government employees and their contractors) Must have a need to know the specific information (Federal, State and local government employees and their contractors) Any Federal, State or local government Authorized User within an accredited entity may receive PCII

Purpose of Accreditation Ensures that all participating government entities: Understand the handling, use, dissemination and safeguarding of PCII Have the necessary resources for operating a PCII Program Promotes consistent application of uniform minimum standards and requirements by all participating entities Ensures timely access to PCII Provides ongoing guidance to participating government entities with respect to handling, using, disseminating and safeguarding PCII

PCII Safeguards PCII Program safeguards and Accreditation Program ensure that all submitted information is: Accessed only by authorized and trained individuals, or those who receive submitter consent to view the PCII Used appropriately, based on guidance set forth in the CII Act and the PCII Program Final Rule Stored, handled, and disseminated using methods approved by the PCII Program Office

Program Growth Aggressive outreach has led to increased program participation The PCII Program Office has publicized the Program at various conferences to reach out to individual industry sectors The Program Office has enlisted the support of other DHS programs to advocate the benefits of PCII Program protections The Program Office has hosted discussions with private sector and government representatives to determine the best approach to information sharing Over the past year, private sector submissions of critical infrastructure information have quadrupled

States/local Entities Program Growth The PCII Program Office has accredited, or is in the process of accrediting, numerous Federal, State and local entities. Federal Entities States/local Entities Food and Drug Administration’s Center for Food Safety and Applied Nutrition (Accredited) Department of Agriculture (In Process) Nuclear Regulatory Commission (In Process) Department of Defense (In Process) Maryland (Accredited) Arizona (Accredited) Massachusetts (Accredited) California (Accredited) Michigan (In Process) New York (In Process) Ohio (In Process) District of Columbia (In Process) Indianapolis, Indiana (In Process) Seattle, Washington (In Process)

Program Initiatives within DHS Increase in submissions through collaborative efforts with identified users of CII in DHS, including: National Cyber Security Division’s United States Computer Emergency Readiness Team Secure Portal Submissions Capability Risk Management Division’s (RMD) Risk Assessment Methodology for Critical Asset Protection (RAMCAP) Program RMD’s Chemical Comprehensive Review RMD’s Site Assistance Visits (SAVs) and Buffer Zone Plans (BZPs) RMD’s Constellation/Automated Critical Asset Management System (ACAMS)

Contact the Program Office to discuss the process further How to Participate Questions to consider to determine if your entity would benefit from becoming an accredited entity of the PCII Program: What are your entity's information needs? What private sector companies hold this information? Is there private sector information that you are not receiving because of FOIA concerns? Do you or might you have a need to access PCII received by the Program Office? Contact the Program Office to discuss the process further

Contact Information PCII Program Office Department of Homeland Security 245 Murray Lane, SW Building 410 Washington, DC 20528-0001 202-360-3023 www.dhs.gov/pcii pcii-info@dhs.gov