As  an SSA, DHS has direct responsibility for leading, integrating, and  coordinating efforts of sector partners to protect 11 CIKR sectors. DHS Has Incorporated Changes into the 2009 NIPP that Reflect Stakeholder Input and Sectors’ Experience Protecting Critical Infrastructure and an Increased Emphasis on Risk Management

DHS incorporated changes in the 2009 NIPP—including a greater  emphasis on CIKR regional planning and updates to DHS’s overall risk  management framework—that NIPP PMO officials said are based on  stakeholder input and sectors’ experiences performing critical  infrastructure protection. DHS  discussed the need for regional coordination in the 2006 NIPP and  encouraged stakeholders to address CIKR protection across sectors within  and across geographic regions. By contrast, the 2009 NIPP called for  regional coordination through the formation of a consortium of  representatives from multiple regional organizations. Tier 1 or Tier 2 assets are those that if destroyed or disrupted  could cause significant casualties, major economic losses, or widespread  and long-term disruptions to national well-being and governance capacity. DHS also provided a detailed discussion of risk management  methodologies in the 2009 NIPP, as compared to the 2006 NIPP. Whereas  the 2006 NIPP listed the baseline criteria—minimum requirements—for  conducting risk analyses to ensure they are credible and comparable, the  2009 NIPP includes the use of a common risk assessment approach,  including the core criteria—updated requirements—for threat,  vulnerability, and consequence analyses designed to allow the comparison  of risk across sectors. The 2009 NIPP also  highlights DHS’s role in a 15-nation effort specific to cyber security. DHS Guidance Calls for SSAs to Develop Plans and Reports That Consider Specific Issues in the 2009 NIPP

Following the publication of the 2009 NIPP, DHS issued guidance to the  SSAs designed to make them aware of the changes to the NIPP and to  discuss the issues DHS believed SSAs should consider for increased  attention when developing their SSPs and SARs. Fourteen of 18 SSA representatives generally described the process they  plan to use to incorporate these changes, which for the most part mirrored  DHS’s process for revising the NIPP. DHS Increased Its Emphasis on Resiliency in the 2009 NIPP and Directed SSAs to Address Resiliency in Their Sector Plans

Although DHS revised the NIPP to increase the use of the term resilience  and to highlight it as an important concept paired with protection, the 2009  NIPP uses much of the same language as the 2006 NIPP to describe  resiliency concepts and strategies. More importantly, whereas the 2006 NIPP  primarily treated resiliency as a subset of protection, the 2009 NIPP  generally referred to resiliency alongside protection. For example, whereas the Managing Risk  chapter of the 2006 NIPP has a section entitled “Characteristics of  Effective Protection Programs,” the same chapter in the 2009 NIPP has a  section entitled, “Characteristics of Effective Protection Programs and  Resiliency Strategies.”
In addition, in contrast to the 2006 NIPP, the 2009 NIPP referred to  resiliency alongside protection in the introductory section of the  document. Whereas the introduction to the 2006 NIPP states that it  “…provides the mechanisms for…enhancing information-sharing  mechanisms and protective measures within and across CI/KR sectors…,”  the introduction to the 2009 NIPP states that it “…provides the  mechanisms for…enhancing information-sharing mechanisms and  protection and resiliency within and across CIKR sectors.”  Also, in  comparison to the 2006 NIPP, the 2009 version of the NIPP discusses  resiliency more often in the “Authorities, Roles and Responsibilities”  chapter of the document. NIPP PMO officials told us that changes related to resiliency in the 2009  NIPP were not intended to represent a major shift in policy; rather they  were intended to increase attention to and raise awareness about  resiliency as it applies within individual sectors. For example, in the 2009 guidance set forth  in Chapter 5, SSAs are advised that in sectors for which infrastructure  resiliency is as or more important than physical security or hardening,  their SSA chapter on “Protection Program Implementation” should focus  on describing the resiliency measures and strategies being used by the  sector. Agency Comments

We requested comments on a draft of this report from the Secretary of  Homeland Security. DHS said that the more explicit emphasis on resilience in  the 2009 NIPP is expected to encourage more system-based sector and  cross-sector activities that address a broader spectrum of risks. Appendix II: Discussions of Resiliency in 2007 Sector-specific Plans

This appendix discusses how the Sector-specific Agencies (SSAs)  addressed resiliency in their 2007 Sector-specific Plans (SSPs) and how  the SSAs will address resiliency in their 2010 SSPs. Since the Department of Homeland Security  (DHS) does not expect these plans to be released until 2010, we contacted  representatives of the 18 SSAs to gather information on their plans to  adhere to DHS’s revised SSP guidance.
Why GAO Did This Study

According to the Department of Homeland Security (DHS), there are thousands of facilities in the United States that if destroyed by a disaster could cause casualties, economic losses, or disruptions to national security. The Homeland Security Act of 2002 gave DHS responsibility for leading and coordinating the nation's effort to protect critical infrastructure and key resources (CIKR). Homeland Security Presidential Directive 7 (HSPD-7) defined responsibilities for DHS and certain federal agencies--known as sector-specific agencies (SSAs)--that represent 18 industry sectors, such as energy. In accordance with the Homeland Security Act and HSPD-7, DHS issued the National Infrastructure Protection Plan (NIPP) in June 2006 to provide the approach for integrating the nation's CIKR. GAO was asked to study DHS's January 2009 revisions to the NIPP in light of a debate over whether DHS has emphasized protection--to deter threats, mitigate vulnerabilities, or minimize the consequences of disasters---rather than resilience---to resist, absorb, or successfully adapt, respond to, or recover from disasters. This report discusses (1) how the 2009 NIPP changed compared to the 2006 NIPP and (2) how DHS and SSAs addressed resiliency as part of their planning efforts. GAO compared the 2006 and 2009 NIPPs, analyzed documents, including NIPP Implementation Guides and sector- specific plans, and interviewed DHS and SSA officials from all 18 sectors about their process to identify potential revisions to the NIPP and address resiliency.

What GAO Found

Compared to the 2006 NIPP, DHS's 2009 update to the NIPP incorporated various changes, including a greater emphasis on regional CIKR protection planning and updates to DHS's overall risk management framework, such as instructions for sectors to develop metrics to gauge how well programs reduced the risk to their sector. For example, in the 2006 NIPP, DHS encouraged stakeholders to address CIKR across sectors within and across geographic regions; by contrast, the 2009 NIPP called for regional coordination through the formation of a consortium of representatives from multiple regional organizations. DHS also enhanced its discussion of risk management methodologies in the 2009 NIPP. The 2006 NIPP listed the minimum requirements for conducting risk analyses, while the 2009 NIPP includes the use of a common risk assessment approach, including the core criteria for these analyses to allow the comparison of risk across sectors. DHS officials said that the changes highlighted in the 2009 NIPP were the result of knowledge gained and issues raised during discussions with partners and outside organizations like GAO. DHS has also issued guidance for SSAs to consider revisions to the NIPP when updating their sector-specific plans (SSPs). Fourteen of 18 SSA representatives that responded to our query said they used a process similar to DHS's to incorporate NIPP changes into their SSPs. They reported that they intend to discuss the expectations for the SSP with DHS, draft the SSP based on their knowledge of their sectors, and obtain input and feedback from stakeholders. DHS increased its emphasis on resiliency in the 2009 NIPP by discussing it with the same level of importance as protection. While the 2009 NIPP uses much of the same language as the 2006 NIPP to describe resiliency, the 2006 NIPP primarily treated resiliency as a subset of protection while the 2009 NIPP generally referred to resiliency alongside protection. For example, while the Managing Risk chapter of the 2006 NIPP has a section entitled "Characteristics of Effective Protection Programs," the same chapter in the 2009 NIPP has a section entitled, "Characteristics of Effective Protection Programs and Resiliency Strategies." DHS officials stated that these changes are not a major shift in policy; rather they are intended to raise awareness about resiliency as it applies within individual sectors. Furthermore, they stated that there is a greater emphasis on resilience in the 2009 NIPP to encourage more sector and cross-sector activities to address a broader spectrum of risks, such as cyber security. DHS officials also used guidance to encourage SSAs to devote more attention to resiliency. For example, in the 2009 guidance, SSAs are advised that in sectors where infrastructure resiliency is as or more important than physical security, they should focus on describing the resiliency measures and strategies being used by the sector. The 2010 updates to the SSPs are due to be released by DHS in mid-2010 and all sector representatives who responded to our questions said they will address the issue as is appropriate for their sectors. In commenting on a draft of this report, DHS reiterated its process for updating the NIPP and its views on resiliency.