	Introduction

Analysis of the effects of the terrorist attacks of September 11, 2001, suggests various "lessonslearned" concerning public and private information infrastructures. This report considers these homeland securityissues in the context of critical information infrastructure protection and continuity of operations (COOP) planning. in the future. (44)

		Augment Disaster Recovery Plans

In many respects, the September 11, 2001, attacks established a new standard for disasterrecovery plans - the complete destruction and loss of a building. These same businesses and agencies must now consider whether to augment their disaster recoveryplans to include the movement of people, the rapid acquisition of equipment and furniture, networkconnectivity, adequate workspace, and more. (50)
A corollary to this lesson learned is the need to ensure that recovery procedures are welldocumented and safeguarded. Backing Up Data and Backing Up Applications

A second lesson learned that is related to continuity and disaster planning and practices is theneed to have a comprehensive backup system that captures more than just an organization's datafiles. Organizations that saved only their raw data had tospend a significant amount of time re-creating their applications, organizing the data, andreestablishing user permissions to access the data. (58)
A corollary to the lessons learned regarding comprehensive data storage plans is the need to fully and regularly test backup sites and media. It can also be applied to the structureand location of an organization's operations. According to some industry experts, recovery sites should be located atleast 20-50 miles way from the primary data center. In addition, some observers suggest that humanresources should also be located in more than one spot to reduce the potential for losing a significantportion of one's workforce in a single event. (64)

		Ensure the Ability to Communicate with Internal and External Constituencies

Another lesson learned related to decentralization is the need to ensure the ability to communicate with internal and external constituencies in the event of an emergency. (71)

	Lessons Regarding Redundancy and Planning of Communications

The third category of lessons learned involves the institutionalization of redundancy ininformation infrastructures. (76)

		Use of Generic Replaceable Technology

A related lesson that some organizations have cited as valuable to their ability to rebuild their systems quickly is the use of generic, replaceable technology. (80) Based on the experience ofSeptember 11, 2001, the ability to replace equipmentquickly with easy-to-find products that do not require significant customization is likely to be oneof the factors affecting organizations' future continuity and disaster recovery planning decisions. While not all-inclusive, they emphasize threegeneral approaches: the establishment and practice of comprehensive continuity and recovery plans,the decentralization of operations, and the development of system redundancies to eliminate singlepoints of weakness.
This report assesses the impact of the September 11, 2001 attacks on public and private information infrastructures in the context of critical infrastructure protection, continuity ofoperations (COOP) planning, and homeland security. Analysis of the effects of the terrorist attackssuggests various "lessons learned." These lessons support three general principles. The firstprinciple emphasizes the establishment and practice of comprehensive continuity and recovery plans. One lesson learned in this area is to augment disaster recovery plans . Businesses and agencies, whonow must consider the possibility of complete destruction and loss of a building, may need toaugment their disaster recovery plans to include the movement of people, the rapid acquisition ofequipment and furniture, network connectivity, adequate workspace, and more. A corollary to thislesson learned is the need to assure that recovery procedures are well documented and safeguardedso that they can be fully utilized when necessary. A second lesson is the need to back up data and applications . Without a comprehensive backup system that captures more than just anorganization's data files, a significant amount of time can be lost trying to re-create applications,organize data, and reestablish user access. A corollary to this lesson learned is the need to fully andregularly test backup sites and media to ensure their reliability and functionality.
The second principle focuses on the decentralization of operations and the effectiveness of distributed communications. The lesson of decentralizing operations can be applied to the structureand location of an organization's operations. Industry experts suggest recovery sites be located atleast 20-50 miles away form the primary work site. In addition, some observers suggest that humanresources should also be located in more than one place to reduce the potential for losing asignificant portion of one's workforce in a single event. Another lesson in this area is to ensure theability to communicate with internal and external constituencies . In the event of an emergency, thedemand for information skyrockets. An organization not only needs to communicate with employeesregarding actions and procedures, but also with the citizens and customers to whom it is responsiblefor providing goods and services.
The third principle involves the institutionalization of system redundancies to eliminate single points of weakness. In this context, the lesson of employing redundant service providers is appliedprimarily to telecommunications services. In the event a central switching station is disabled, havingmultiple providers using different infrastructures for access can reduce the possibility of anorganization losing its communications services and being unable to carry out its responsibilities. Another related lesson learned is the use of generic replaceable technology . In the event of acatastrophe, the ability to replace equipment quickly with easy-to-find products that do not requirecomprehensive customization, can contribute significantly to how quickly an organization'soperations can be functional again. This report will not be updated.