	Background

As reliance on our nation’s critical infrastructures grows, so do the  potential threats and attacks that could disrupt critical systems and  operations. CIP Policy Has Continued to Evolve

Federal awareness of the importance of securing our nation’s critical  infrastructures has continued to evolve since the mid-1990s. To facilitate private-sector participation, PDD 63 also encouraged the  voluntary creation of information sharing and analysis centers (ISACs) to  serve as mechanisms for gathering, analyzing, and appropriately sanitizing  and disseminating information to and from infrastructure sectors and the  federal government through NIPC. Although improvements have been made in protecting our nation’s  critical infrastructures and continuing efforts are in progress, further  efforts are needed to address the following critical CIP challenges that we  have identified:    developing a comprehensive and coordinated national plan to facilitate  CIP information sharing that clearly delineates the roles and  responsibilities of federal and nonfederal CIP entities, defines interim  objectives and milestones, sets timeframes for achieving objectives, and  establishes performance measures;   developing fully productive information-sharing relationships within the  federal government and among the federal government and state and local  governments and the private sector; improving the federal government’s capabilities to analyze incident, threat,  and vulnerability information obtained from numerous sources and share  appropriate timely, useful warnings and other information concerning  both cyber and physical threats to federal entities, state and local  governments, and the private sector; and   providing appropriate incentives for nonfederal entities to increase  information sharing with the federal government. The  ten trade associations that are members of it fund the Real Estate ISAC. Discusses the importance of the  ISACs and the private infrastructure sectors being involved in government  exercises that demonstrate responses to possible incidents. DHS and the sector-specific agencies have  undertaken a number of efforts to address the public/private partnership  that is called for by federal CIP policy, and they continue to work on their  cooperation and interaction with the ISACs and with each other. Department of the Treasury (Treasury). Challenges to ISAC Establishment and Partnership with the Federal Government

Our discussions with the ISACs and the series of ISAC Council white  papers confirmed that a number of challenges remain to the successful  establishment and operation of ISACs and their partnership with DHS and  other federal agencies. In its recent white papers, the ISAC Council also has identified a number  of barriers to information sharing between the private sector and  government. According to a DHS official, the department is developing a plan  (referred to as a “roadmap”) that documents the current information- sharing relationships among DHS, the ISACs, and other agencies; goals for  improving that information-sharing relationship; and methods for  measuring the progress in the improvement.
Why GAO Did This Study

Critical infrastructure protection (CIP) activities that are called for in federal policy and law are intended to enhance the security of the cyber and physical public and private infrastructures that are essential to our nation's security, economic security, and public health and safety. As our reliance on these infrastructures increases, so do the potential threats and attacks that could disrupt critical systems and operations. Effective information-sharing partnerships between industry sectors and government can contribute to CIP efforts. Federal policy has encouraged the voluntary creation of Information Sharing and Analysis Centers (ISACs) to facilitate the private sector's participation in CIP by serving as mechanisms for gathering and analyzing information and sharing it among the infrastructure sectors and between the private sector and government. This testimony discusses the management and operational structures used by ISACs, federal efforts to interact with and support the ISACs, and challenges to and successful practices for ISACs' establishment, operation, and partnerships with the federal government.

What GAO Found

Federal awareness of the importance of securing the nation's critical infrastructures--and the federal government's strategy to encourage cooperative efforts among state and local governments and the private sector to protect these infrastructures--have been evolving since the mid- 1990s. Federal policy continues to emphasize the importance of the ISACs and their information-sharing functions. In addition, federal policy established specific responsibilities for the Department of Homeland Security (DHS) and other federal agencies involved with the private sector in CIP. The ISACs themselves, although they have similar missions, were developed to serve the unique needs of the sectors they represent, and they operate under different business models and funding mechanisms. According to ISAC representatives and a council that represents many of them, a number of challenges to their successful establishment, operation, and partnership with DHS and other federal agencies remain. These challenges include increasing the percentage of entities within each sector that are members of its ISAC; building trusted relationships and processes to facilitate information sharing; overcoming barriers to information sharing, clarifying the roles and responsibilities of the various government and private sector entities that are involved in protecting critical infrastructures; and funding ISAC operations and activities. According to a DHS official, these issues are being considered, and the department is developing a plan that will document the current information-sharing relationships among DHS, the ISACs, and other agencies; goals for improving those information-sharing relationships; and methods for measuring progress toward these goals.