Most Sector Plans We Reviewed Met NIPP and DHS Sector- Specific Plan Guidance, but Varied Depending on Their Maturity and How They Define Their Assets

The nine sector-specific plans we reviewed generally met NIPP  requirements and DHS’s sector-specific plan guidance; however, the extent  to which the plans met this guidance, and therefore their usefulness in  enabling DHS to identify gaps and interdependencies across the sectors,  varied depending on the maturity of the sector and on how the sector  defines its assets, systems, and functions. In addition to these NIPP risk management plan elements outlined above  and according to DHS’s sector-specific plan guidance, the plans are also to  address the sectors’ efforts to (1) implement a research and development  program for critical infrastructure protection and (2) establish a structure  for managing and coordinating the responsibilities of the federal  departments and agencies—otherwise known as sector-specific  agencies—identified in HSPD-7 as responsible for critical-infrastructure  protection activities specified for the 17 sectors. For example, all of the  plans described the threat analyses that the sector conducts, but only one  of the plans described any incentives used to encourage voluntary risk  assessments, as required by the NIPP. The plans also varied in how comprehensively they addressed their  physical, human, and cyber assets, systems, and functions because sectors  reported having differing views on the extent to which they were  dependent on each of these assets, systems, and functions. According to  DHS’s sector-specific plan guidance, a comprehensive identification of  such assets is important because it provides the foundation on which to  conduct risk analysis and identify the appropriate mix of protective  programs and actions that will most effectively reduce the risk to the  nation’s infrastructure. Yet, only one of the plans—drinking water and  water treatment—specifically included all three categories of assets. Given the disparity in the plans,  it is unclear the extent to which DHS will be able to use them to identify  gaps and interdependencies across the sectors in order to plan future  protective measures. DHS officials said that to make this determination,  they will need to review the sectors’ annual progress reports, due in this  month, that are to provide additional information on plan implementation  as well as identify sector priorities. Council Representatives Disagreed on the Value of the Plans and the Review Process

Representatives of 10 of 32 councils said the plans were valuable because  they gave their sectors a common language and framework to bring the  disparate members of the sector together to better collaborate as they  move forward with protection efforts. However, representatives of 8 of the 32 councils said the plans were not  useful to their sectors because (1) the plans did not represent a true  partnership between the federal and private sectors or were not  meaningful to all the industries represented by the sector or (2) the sector  had already taken significant protection actions, thus, developing the plan  did not add value. The remaining council representatives did not offer  views on this issue. Representatives of 11 of 32 councils said the review process associated  with the plans was lengthy. Long-standing Relationships Continue to Facilitate Councils, but Some Council Representatives Reported Information- Sharing Challenges

Nine of 32 sector representatives said that their preexisting relationships  with stakeholders helped in establishing and maintaining their sector  councils, and two noted that establishing the councils had improved  relationships. We also reported previously that long-standing  relationships were a facilitating factor in council formation and that   10 sectors had formed either a government council or sector council that  addressed critical infrastructure protection issues prior to DHS’s  development of the NIPP. This is important because previously,  meetings between the private sector and the government had to be open to  the public, hampering the private sector’s willingness to share information. Conversely, seven sector council representatives reported difficulty in  achieving and maintaining sector council membership, thus limiting the  ability of the councils to effectively represent the sector. Eleven of the 32 council representatives reported continuing challenges  with sharing information between the federal government and the private  sector. For example, six council representatives expressed concerns about  the viability of two of DHS’s main information-sharing tools—the  Homeland Security Information Network (HSIN) or the Protected Critical  Infrastructure Information (PCII) program. 3. 9. 15. 17.
Why GAO Did This Study

As Hurricane Katrina so forcefully demonstrated, the nation's critical infrastructures--both physical and cyber--have been vulnerable to a wide variety of threats. Because about 85 percent of the nation's critical infrastructure is privately owned, it is vital that public and private stakeholders work together to protect these assets. The Department of Homeland Security (DHS) is responsible for coordinating a national protection strategy and has promoted the formation of government and private councils for the 17 infrastructure sectors as a collaborating tool. The councils, among other things, are to identify their most critical assets, assess the risks they face, and identify protective measures in sector-specific plans that comply with DHS's National Infrastructure Protection Plan (NIPP). This testimony is based primarily on GAO's July 2007 report on the sector-specific plans and the sector councils. Specifically, it addresses (1) the extent to which the sector-specific plans meet requirements, (2) the council members' views on the value of the plans and DHS's review process, and (3) the key success factors and challenges that the representatives encountered in establishing and maintaining their councils. In conducting the previous work, GAO reviewed 9 of the 17 draft plans and conducted interviews with government and private sector representatives of the 32 councils, 17 government and 15 private sector.

What GAO Found

Although the nine sector-specific plans GAO reviewed generally met NIPP requirements and DHS's sector-specific plan guidance, eight did not describe any incentives the sector would use to encourage owners to conduct voluntary risk assessments, as required by the NIPP. Most of the plans included the required elements of the NIPP risk management framework. However, the plans varied in how comprehensively they addressed not only their physical assets, systems, and functions, but also their human and cyber assets, systems and functions, a requirement in the NIPP, because the sectors had differing views on the extent to which they were dependent on each of these assets. A comprehensive identification of all three categories of assets is important, according to DHS plan guidance, because it provides the foundation on which to conduct risk analyses and identify appropriate protective actions. Given the disparity in the plans, it is unclear the extent to which DHS will be able to use them to identify security gaps and critical interdependencies across the sectors. DHS officials said that to determine this, they will need to review the sectors' annual reports. Representatives of the government and sector coordinating councils had differing views regarding the value of sector-specific plans and DHS's review of those plans. While 10 of the 32 council representatives GAO interviewed reported that they saw the plans as being useful for their sectors, representatives of eight councils disagreed because they believed the plans either did not represent a partnership among the necessary key stakeholders, especially the private sector or were not valuable because the sector had already progressed beyond the plan. In addition, representatives of 11 of the 32 councils felt the review process was too lengthy, but 8 thought the review process worked well. The remaining council representatives did not offer views on these issues. As GAO reported previously, representatives continued to report that their sector councils had preexisting relationships that helped them establish and maintain their sector councils. However, seven of the 32 representatives reported continuing difficulty achieving and maintaining sector council membership, thus limiting the ability of the councils to effectively represent the sector. Eleven council representatives reported continuing difficulties sharing information between the public and private sectors as a challenge, and six council representatives expressed concerns about the viability of the information system DHS intends to rely on to share information about critical infrastructure issues with the sectors or the effectiveness of the Protected Critical Infrastructure Information program--a program that established procedures for the receipt, care, and storage of information submitted to DHS. GAO has outstanding recommendations addressing this issue, with which DHS generally agreed and is in the process of implementing.