IP’s Protective Security Coordination Division (PSCD) also operates the  Protective Security Advisor Program, which deploys critical infrastructure  protection and security specialists, called PSAs, to local communities  throughout the country. DHS Efforts to Incorporate Resiliency into Programs Used to Work with Asset Owners and Operators Is Evolving but Program Management Could Be Strengthened

Consistent with recent changes to the NIPP, DHS has begun to increase its  emphasis on resiliency in the various programs it uses to assess  vulnerability and risk at and among CIKR facilities so that it can help asset  owners and operators identify resiliency characteristics of their facilities  and provide suggested actions, called options for consideration, to help  them mitigate gaps that have been identified. However, DHS has not  developed an approach to measure owners’ and operators’ actions to  address resiliency gaps identified as a result of these assessments. The RRAP is an analysis of groups of related  infrastructure, regions, and systems in major metropolitan areas. DHS Has Made Training on Resiliency Available to PSAs, but Guidelines on PSA Roles and Responsibilities Do Not Reflect DHS’s Growing Emphasis on Resiliency

DHS uses PSAs to provide assistance to asset owners and operators on  CIKR protection strategies. However, the guidance does not articulate the role  of PSAs with regard to resiliency issues, or how PSAs are to promote  resiliency strategies and practices to asset owners and operators. DHS Could Better Position Itself to Disseminate Information about Resiliency Practices with Asset Owners and Operators within and across Sectors

DHS’s efforts to emphasize resiliency in the programs and tools it uses to  work with asset owners and operators also creates an opportunity for DHS  to better position itself to disseminate information about resiliency  practices to asset owners and operators within and across sectors. DHS Shares Information on Vulnerabilities and Protective Measures on a Case-by-Case Basis

According to the NIPP, its effective implementation is predicated on active  participation by government and private-sector partners in meaningful,  multidirectional information sharing. DHS Is Uniquely Positioned to Disseminate Information about Resiliency Practices but Faces Barriers

Senior IP officials told us that they have considered ways to disseminate  information that DHS currently collects or plans to collect with regard to  resiliency. However, they have not explored the feasibility of developing  an approach for doing so. Senior IP officials explained that given the  voluntary nature of the CIKR partnership, DHS should not be viewed as  identifying or promoting practices, particularly best practices, which could  be construed to be standards or requirements. For  example, the energy sector, which includes oil refineries, is inherently  different than the government facilities sector, which includes government  office buildings. These actions continue to evolve and could be  improved if DHS were to strengthen program management by developing  measures to assess the extent to which asset owners and operators are  taking actions to address resiliency gaps identified during vulnerability  assessments; and updating PSA guidelines to articulate PSA roles and  responsibilities with regard to resiliency during their interactions with  asset owners and operators. Related to its efforts to develop or update its programs designed to assess  vulnerability at asset owners’ and operators’ individual facilities and  groups of facilities, DHS has considered how it can disseminate  information on resiliency practices it gathers or plans to gather with asset  owners and operators within and across sectors. Nonetheless, as the primary federal agency responsible  for coordinating and enhancing the protection and resiliency of critical  infrastructure across the spectrum of CIKR sectors, DHS is uniquely  positioned to disseminate this information. By determining the feasibility  of overcoming barriers and developing an approach for disseminating  resiliency information, DHS could better position itself to help asset  owners and operators consider and adopt resiliency strategies, and  provide them with information on potential security investments, based on  the practices and experiences of their peers within the CIKR community,  both within and across sectors. Recommendations for Executive Action

To better ensure that DHS’s efforts to incorporate resiliency into its  overall CIKR protection efforts are effective and completed in a timely and  consistent fashion, we recommend that the Assistant Secretary for  Infrastructure Protection take the following two actions:    develop performance measures to assess the extent to which asset  owners and operators are taking actions to resolve resiliency gaps  identified during the various vulnerability assessments; and   update PSA guidance that discusses the role PSAs play during  interactions with asset owners and operators with regard to resiliency,  which could include how PSAs work with them to emphasize how  resiliency strategies could help them mitigate vulnerabilities and  strengthen their security posture and provide suggestions for  enhancing resiliency at particular facilities. The Department of Homeland Security’s (DHS) Critical Infrastructure  Protection Cost-Benefit Report. October 23, 2009.
Why GAO Did This Study

According to the Department of Homeland Security (DHS), protecting and ensuring the resiliency (the ability to resist, absorb, recover from, or successfully adapt to adversity or changing conditions) of critical infrastructure and key resources (CIKR) is essential to the nation's security. By law, DHS is to lead and coordinate efforts to protect several thousand CIKR assets deemed vital to the nation's security, public health, and economy. In 2006, DHS created the National Infrastructure Protection Plan (NIPP) to outline the approach for integrating CIKR and increased its emphasis on resiliency in its 2009 update. GAO was asked to assess the extent to which DHS (1) has incorporated resiliency into the programs it uses to work with asset owners and operators and (2) is positioned to disseminate information it gathers on resiliency practices to asset owners and operators. GAO reviewed DHS documents, such as the NIPP, and interviewed DHS officials and 15 owners and operators of assets selected on the basis of geographic diversity. The results of these interviews are not generalizable but provide insights.

What GAO Found

DHS's efforts to incorporate resiliency into the programs it uses to work with asset owners and operators is evolving but program management could be strengthened. Specifically, DHS is developing or updating programs to assess vulnerability and risk at CIKR facilities and within groups of related infrastructure, regions, and systems to place greater emphasis on resiliency. However, DHS has not taken commensurate efforts to measure asset owners' and operators' actions to address resiliency gaps. DHS operates its Protective Security Advisor Program, which deploys critical infrastructure protection and security specialists, called Protective Security Advisors (PSA), to assist asset owners and operators on CIKR protection strategies, and has provided guidelines to PSAs on key job tasks such as how to establish relationships between asset owners and operators and DHS, federal, state, and local officials. DHS has provided training to PSAs on resiliency topics, but has not updated PSA guidelines to articulate the role of PSAs with regard to resiliency issues, or how PSAs are to promote resiliency strategies and practices to asset owners and operators. A senior DHS official described plans to update PSA guidelines and the intent to outline this plan in October 2010, but did not provide information on what changes would be made to articulate PSA roles and responsibility with regard to resiliency. By developing measures to assess the extent to which asset owners and operators are addressing resiliency gaps and updating PSA guidance, DHS would be better positioned to manage its efforts to help asset owners and operators enhance their resiliency. DHS faces barriers disseminating information about resiliency practices across the spectrum of asset owners and operators. DHS shares information on potential protective measures with asset owners and operators and others including state and local officials (generally on a case-by-case basis) after it has completed vulnerability assessments at CIKR facilities. DHS officials told GAO that they have considered ways to disseminate information that they collect or plan to collect with regard to resiliency. However, DHS faces barriers sharing information about resiliency strategies. For example, given the voluntary nature of the CIKR partnership, DHS officials stated that DHS should not be viewed as identifying and promoting practices which could be construed by CIKR partners to be standards. Also, according to DHS officials, the need for and the emphasis on resiliency can vary across different types of facilities depending on the nature of the facility. For example, an oil refinery is inherently different than a government office building. DHS's efforts to emphasize resiliency when developing or updating the programs it uses to work with owners and operators creates an opportunity for DHS to position itself to disseminate information about resiliency practices within and across the spectrum of asset owners and operators. By determining the feasibility of overcoming barriers and developing an approach for disseminating information on resiliency practices within and across sectors, DHS could better position itself to help asset owners and operators consider and adopt resiliency strategies.

What GAO Recommends

GAO recommends that DHS develop resiliency performance measures, update PSA guidelines, and determine the feasibility of developing an approach to disseminate resiliency information. DHS is taking action to implement two recommendations and is internally considering the third.