DHS Has Made Changes to NCIPP List Criteria, but Has Not Identified the Impact of These Changes or Validated Its Approach

DHS has made several changes to its criteria for including assets on the  NCIPP list. These changes initially focused on introducing criteria to make  the lists entirely consequence based, with subsequent changes intended  to introduce specialized criteria for some sectors and assets. DHS’s  changes to the NCIPP criteria have changed the composition of the  NCIPP list, which has had an impact on users of the list. However, DHS  does not have a process to identify the impact of these changes on users  nor has it validated its approach for developing the list. In 2009, DHS changed the level 2 criteria to make the NCIPP list entirely  consequence based, a change that brought its approach more into line  with statutory requirements and, consistent with the NIPP risk  management framework, allowed for comparison across sectors. DHS Has Not Identified the Impact of Changes in Criteria on List Users or Validated Its Approach for Developing the List

The changes DHS made to the NCIPP criteria in 2009 and 2010 changed  the number of assets on and the composition of the NCIPP list. While the change to an entirely consequence-based list created a  common approach to identify infrastructure and align the program with the  statute and NIPP, recent and planned criteria changes to accommodate  certain sectors and assets represent a departure from this common  approach, which could hinder DHS’s ability to compare infrastructure  across sectors. Furthermore, DHS has  not validated its approach to developing the list to ensure that it  accurately reflects the nation’s highest-priority critical infrastructure. DHS recognizes that states, in particular, face challenges— such as resource and budgetary constraints—associated with nominating  assets to the NCIPP list, and has taken actions to address these  challenges and reduce the burden on states. DHS officials told us that  they conducted extensive outreach to states and SSAs to encourage  participation in the NCIPP working group including extending the  submission deadlines multiple times, funding an on-site meeting with the  partners, and hosting webinars and conference calls. DHS has taken several steps to minimize the burden on state partners. Pursuant to the 9/11 Commission Act,  which amended title II of the Homeland Security Act, DHS is required to  report annually to the Committee on Homeland Security and  Governmental Affairs of the Senate and the Committee on Homeland  Security of the House of Representatives on, among other things, any  significant challenges in compiling the database or list and, if appropriate,  the extent to which the database or list has been used to allocate federal  funds to prevent, reduce, mitigate, or respond to acts of terrorism.Although DHS was able to compile documents on the database and list  for fiscal years 2008 through 2011 that generally contain the information  on which DHS is to report, officials from DHS and the Office of  Infrastructure Protection told us they were uncertain whether the  documents were delivered to the requisite congressional committees  because they do not have records to indicate that the documents were  delivered. An approach to verify the timely  delivery of required reports to the requisite committees of Congress, such  as documenting or recording the transactions, would better position DHS  to ensure that it is in compliance with its statutory reporting requirements,  thereby providing the committees information needed to perform  oversight. NCIPP program  officials told us they would like to have the NCIPP reviewed to validate  the criteria used to decide which assets and systems should be placed on  the list, but they have not yet submitted a proposal for this review to the  Assistant Secretary for Infrastructure Protection. Recommendations for Executive Action

To better ensure that DHS’s approach to identify and prioritize critical  infrastructure is consistent with the NIPP risk management framework  and that DHS is positioned to provide reasonable assurance that  protection and resiliency efforts and investments are focused on the  nation’s highest-priority critical infrastructure, we recommend that the  Assistant Secretary for Infrastructure Protection, Department of  Homeland Security, take the following action:  commission an independent, external peer review of the program with  clear project objectives for completing this effort. Appendix II: Objectives, Scope, and Methodology

To address our first objective—determine the extent to which DHS  changed its criteria for developing the National Critical Infrastructure  Prioritization Program (NCIPP) list, identified the impact, if any, of these  changes, and validated its approach—we reviewed the Implementing  Recommendations of the 9/11 Commission Act of 2007 (9/11  Commission Act), which, by amending title II of the Homeland Security  Act of 2002, required the Secretary of DHS to establish and maintain a  national database of systems and assets determined to be vital and the  loss, interruption, incapacity, or destruction of which would have a  negative or debilitating effect on the economic security, public health, or  safety of the United States, any state, or any local government, or as  otherwise determined appropriate for inclusion by the Secretary.
Why GAO Did This Study

In October 2012, Hurricane Sandy caused widespread damage across multiple states and affected millions of people. Threats to critical infrastructure are not limited to natural disasters, as demonstrated by the terrorist attacks of September 11, 2001. Originally developed by DHS in 2006, and consistent with the Implementing Recommendations of the 9/11 Commission Act of 2007, the NCIPP identifies and prioritizes nationally significant critical infrastructure each year. However, Members of Congress and some state officials have raised questions about changes DHS has made to its approach for creating the list and the impact of these changes.
GAO was asked to review DHS management of the program. GAO assessed the extent to which DHS has (1) changed its criteria for developing the list, identified the impact, if any, of these changes, and validated its approach, (2) worked with states and SSAs to develop the list, and (3) reported to Congress on the NCIPP. GAO, among other things, reviewed laws, DHS policies and procedures; analyzed the lists from 2007 through 2012; and interviewed DHS, SSA, and state homeland security officials selected based on their involvement with the program and geographic diversity. The interviews are not generalizable but provide insights.

What GAO Found

The Department of Homeland Security (DHS) has made several changes to its criteria for including assets on the National Critical Infrastructure Prioritization Program (NCIPP) list of the nation's highest-priority infrastructure, but has not identified the impact of these changes or validated its approach. In 2009, DHS changed the criteria to make the list entirely consequence based--that is, based on the effect of an event on public health and safety, and economic, psychological, and government mission impacts. Subsequent changes introduced specialized criteria for some sectors and assets. For example, infrastructure that has received a specific, credible threat, but otherwise does not meet NCIPP criteria, may be included on the list. DHS's changes to the NCIPP criteria have changed the composition of the NCIPP list, which has had an impact on users of the list, such as the Federal Emergency Management Agency. However, DHS has not reviewed the impact of changes on users nor validated its approach to developing the list. While the change to an entirely consequence-based list created a common approach to identify infrastructure and align the program with applicable laws and the National Infrastructure Protection Plan, recent criteria changes to accommodate certain sectors and assets represent a departure from this common approach, which could hinder DHS's ability to compare infrastructure across sectors. Program officials noted they would like to validate the NCIPP, but they have not yet submitted a proposal to DHS management. An independent peer review--a best practice in risk management--would better position DHS to reasonably assure that the NCIPP list identifies the nation's highest-priority infrastructure.
To develop the list, DHS has consulted with both states and sector specific agencies (SSA)--federal agencies responsible for protection and resiliency efforts among individual critical infrastructure sectors, such as energy, transportation, and dams. Since changing the NCIPP criteria in 2009, DHS has taken proactive steps to help states nominate assets to the list. These steps include providing on-site assistance, minimizing changes to the criteria, conducting outreach to encourage participation in an NCIPP working group (which includes SSAs), and providing explanations of why nominated assets do not make the list. DHS recognizes that states, in particular, face challenges--such as resource and budgetary constraints--associated with nominating assets, and has taken actions to address these challenges and reduce the burden on states.
GAO could not verify that DHS is meeting statutory requirements to report annually to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives on the NCIPP list. DHS officials prepared documents that generally contained information consistent with statutory reporting requirements, but they were uncertain whether they had been delivered to the committees because they do not have records to verify they were delivered. An approach to verify the delivery of the required reports, such as documenting or recording the transactions, would better position DHS to ensure that it is in compliance with its statutory reporting requirements and that it provides the committees with the information needed to perform oversight of the program.

What GAO Recommends

GAO recommends that DHS commission an external peer review and develop an approach to verify that the annual reports are provided to the requisite committees of Congress. DHS concurred with the recommendations.