EMI Higher Education Symposium 5 June 2014 NIPP 2013: Partnering for Critical Infrastructure Security and Resilience EMI Higher Education Symposium 5 June 2014

Strategic Drivers

Critical Infrastructure Today Critical Infrastructure defined: “Assets, systems, and networks, whether physical or virtual, so vital to the United States that their incapacitation or destruction would have a debilitating effect on national security, economic security, national public health or safety, or any combination thereof.” 16 Critical Infrastructure Sectors Government Facilities Healthcare and Public Health Information Technology Nuclear Reactors, Materials and Waste Transportation Systems Water & Wastewater Systems Chemical Commercial Facilities Communications Critical Manufacturing Dams Defense Industrial Base Emergency Services Energy Financial Services Food & Agriculture

Today’s Risk Landscape America remains at risk from a variety of threats including: Acts of Terrorism Cyber Attacks Extreme Weather Pandemics Accidents or Technical Failures NIPP 2013 offers a distributed approach for addressing the diverse and evolving risk environment.

Executive Order 13636: Improving Critical Infrastructure Cybersecurity National Policies President Obama announced two policies related to critical infrastructure security and resilience in February 2013: Presidential Policy Directive 21: Critical Infrastructure Security and Resilience “The Nation's critical infrastructure provides the essential services that underpin American society. Proactive and coordinated efforts are necessary to strengthen and maintain secure, functioning, and resilient critical infrastructure that are vital to public confidence and the Nation's safety, prosperity, and well-being.” – Presidential Policy Directive (PPD) 21 Executive Order 13636: Improving Critical Infrastructure Cybersecurity

Critical Infrastructure Preparedness NIPP 2013 aligns critical infrastructure security and resilience with National preparedness policies. Presidential Policy Directive 8: National Preparedness National Preparedness Mission Areas Strengthens the security and resilience of the United States through systematic preparation for the threats that pose the greatest risk to the security of the Nation. Risk Elements

NIPP 2013 Vision A Nation in which physical and cyber critical infrastructure remain secure and resilient, with vulnerabilities reduced, consequences minimized, threats identified and disrupted, and response and recovery hastened Security: Reducing the risk to critical infrastructure by physical means or defensive cyber measures to intrusions, attacks, or the effects of natural or manmade disasters Resilience: The ability to prepare for and adapt to changing conditions, and withstand and recover rapidly from disruptions

NIPP 2013 Goals Assess and analyze critical infrastructure threats, vulnerabilities and consequences to inform risk management Address multiple threats through sustainable efforts to reduce risk; account for costs and benefits of security investments Enhance critical infrastructure resilience; minimize the adverse consequences of incidents…as well as conduct effective responses… Share actionable and relevant information across the critical infrastructure community to build awareness and enable risk- informed decision making Promote learning and adaptation during and after exercises and incidents

Core Tenets Coordinated and comprehensive risk identification and management Cross-sector dependencies and interdependencies Enhanced information sharing Comparative advantage in risk mitigation Regional and SLTT partnerships Cross-jurisdictional collaboration Security and resilience by design

Evolution from 2009 NIPP Security and Resilience Elevates security and resilience as the primary aim of critical infrastructure homeland security planning efforts Cyber-Physical Integration Integrates cyber and physical security and resilience efforts into an enterprise approach to risk management Partnership Structure Focuses on establishing a process to set critical infrastructure national priorities determined jointly by the public and private sector International Affirms that critical infrastructure security and resilience efforts require international collaboration Risk Management Updates the critical infrastructure risk management framework and addresses alignment to the National Preparedness System, across the prevention, protection, mitigation, response, and recovery mission areas Regional and Local Partnerships Supports execution of the National Plan and achievement of the National Preparedness Goal at both the national and community levels, with focus on leveraging regional collaborative efforts Call to Action Presents a detailed Call to Action with steps that will be undertaken, shaped by each sector’s priorities and in collaboration with critical infrastructure partners, to make progress toward security and resilience

Risk Management Framework Critical Infrastructure Risk Management Framework Information sharing enables partners to benefit from broader knowledge and capabilities to support risk decision-making Risk tolerance and priorities will vary Consider costs and benefits during decision making Integrates information sharing as a core component

Many Stakeholders, Many Strengths Comparative Advantage Engaging in collaborative processes Applying individual expertise Bringing resources to bear Building the collective effort Enhancing overall effectiveness

Partnership Structures National Level Councils Sector Coordinating Councils (SCCs) Government Coordinating Councils (GCCs) State, Local, Tribal, and Territorial Government Coordinating Council (SLTTGCC) Critical Infrastructure Cross Sector Council Federal Senior Leadership Council Regional Consortium Coordinating Council National, Regional, and Local Organizations Public Private Partnerships Regional Partnerships State and Local Councils Non-Governmental Organizations Information Sharing Mechanisms Information Sharing and Analysis Centers (ISACs) Fusion Centers

Call to Action A whole of community approach to advancing the national effort Build on Existing Partnerships Innovate in Managing Risk Focus on Outcomes

Call to Action Build upon Partnership Efforts Set National Focus through Joint Priority Setting Determine Collective Actions through Joint Planning Efforts Empower Local and Regional Partnerships to Build Capacity Nationally Leverage incentives to Advance Security and Resilience Innovate in Managing Risk Enable Risk-Informed Decision-Making through Enhanced Situational Awareness Analyze Infrastructure Dependencies, Interdependencies, and Associated Cascading Effects Rapidly Identify, Assess, and Respond to… Cascading Effects During and Following Incidents Promote Infrastructure, Community, and Regional Recovery Strengthen Coordinated Technical Assistance, Training, and Education Improve Critical Infrastructure Security and Resilience by Advancing R&D Solutions Focus on Outcomes Evaluate Achievement of Goals Learn and Adapt During and After Exercises and Incidents

Call to Action Build upon Partnership Efforts Set National Focus through Joint Priority Setting Determine Collective Actions through Joint Planning Efforts Empower Local and Regional Partnerships to Build Capacity Nationally Leverage incentives to Advance Security and Resilience Innovate in Managing Risk Enable Risk-Informed Decision-Making through Enhanced Situational Awareness Analyze Infrastructure Dependencies, Interdependencies, and Associated Cascading Effects Rapidly Identify, Assess, and Respond to… Cascading Effects During and Following Incidents Promote Infrastructure, Community, and Regional Recovery Strengthen Coordinated Technical Assistance, Training, and Education Improve Critical Infrastructure Security and Resilience by Advancing R&D Solutions Focus on Outcomes Evaluate Achievement of Goals Learn and Adapt During and After Exercises and Incidents

Call to Action Enable Risk Informed Decision Making Through Enhanced Situational Awareness Undertake a partnership-wide review of impediments to information sharing Build upon the functional relationship deliverable from Presidential Policy Directive 21 (PPD-21) Develop streamlined, standardized processes to promote integration and coordination of information sharing Develop interoperability standards to enable more efficient information exchange through defined data standards and requirements

Call to Action Identify, Assess, and Respond to Unanticipated Infrastructure Cascading Effects During and Following Incidents Enhance the capability to rapidly identify and assess cascading effects involving the lifeline functions and contribute to identifying infrastructure priorities—both known and emerging—during response and recovery efforts Enhance the capacity of critical infrastructure partners to work through incident management structures such as the ESFs to mitigate the consequences of disruptions to the lifeline functions

Call to Action Promote Infrastructure, Community, and Regional Recovery Following Incidents Encourage States and localities to consider critical infrastructure challenges in pre-incident recovery planning, post-incident damage assessments, and recovery strategy development Support examination of initiatives to enhance, repair, or replace infrastructure providing lifeline functions during recovery

Call to Action Strengthen Coordinated Development and Delivery of Technical Assistance, Training, and Education Capture, report, and prioritize the technical assistance, training, and education needs of critical infrastructure partners Examine current Federal technical assistance, training, and education programs to ensure that they support the national priorities and the risk management activities described in NIPP 2013 Leverage a wider network of partners to deliver training and education programs to better serve recipients and reach a wider audience while conserving resources Partner with academia to establish and update critical infrastructure curricula that help to train critical infrastructure professionals

Call to Action Improve Critical Infrastructure Security and Resilience by Advancing Research and Development Solutions Promote R&D to enable the secure and resilient design and construction of critical infrastructure and more secure accompanying cyber technology Enhance modeling capabilities to determine potential impacts on critical infrastructure of an incident or threat scenario, as well as cascading effects on other sectors Facilitate initiatives to incentivize cybersecurity investments and the adoption of critical infrastructure design features that strengthen all- hazards security and resilience Prioritize efforts to support the strategic guidance issued by DHS

Call to Action Learn and Adapt During and After Exercises and Incidents Develop and conduct exercises through participatory processes to suit diverse needs and purposes Design exercises to reflect lessons learned and test corrective actions from previous exercises and incidents, address both physical and cyber threats and vulnerabilities, and evaluate the transition from steady state to incident response and recovery efforts Share lessons learned and corrective actions from exercises and incidents and rapidly incorporate them into technical assistance, training, and education programs

Build Upon Partnership Efforts Innovate in Managing Risk What You Can Do Build Upon Partnership Efforts Innovate in Managing Risk Focus on Outcomes Understand the critical infrastructure landscape and how to partner with owners and operators Provide support for assessing criticality and managing risk Rigorous study of exercises and incidents Bring private sector into linkages with Emergency Management and Law Enforcement communities Incorporate critical infrastructure perspectives into traditional emergency management curricula Establishment/awareness of regional consortia with diverse stakeholders Connect cyber/physical stakeholders Encourage systems approach to understanding dependencies and interdependencies Connect to the NICC/NCCIC Adopt the Cybersecurity Framework

Resources and Training Visit www.dhs.gov/nipp for links to the full NIPP 2013 and the NIPP Supplements and critical infrastructure training: NIPP Supplements Connecting to the NICC and NCCIC Executing a Critical Infrastructure Risk Management Approach Incorporating Resilience into Critical Infrastructure Projects NPPD Resources to Support Vulnerability Assessments Critical Infrastructure Partnership Courses IS 913 Achieving Results through Critical Infrastructure Partnership and Collaboration IS 921 Implementing Critical Infrastructure Protection Programs and CI TOOLKIT Security Awareness Series Courses IS 906 Workplace Security IS 907 Active Shooter IS 912 Retail Security Awareness IS 914 Surveillance Awareness: What you can do IS 915 Protecting Critical Infrastructure Against Insider Threat IS 916 Critical Infrastructure Security: Theft and Diversion – What You Can Do