These activities and capabilities are supported by an array of physical assets, functions, information, people, and systems, forming what has been called the nation's critical infrastructures. The reader who is not interested in the evolution of this policy and the organizational structures that have evolved to implement it can proceed to the " Policy Implementation " and/or " Issues and Discussion " sections of this report. Its tasks were to: report to the President the scope and nature of the vulnerabilities and threats to the nation's critical infrastructures (focusing primarily on cyber threats); recommend a comprehensive national policy and implementation plan for protecting critical infrastructures; determine legal and policy issues raised by proposals to increase protections; and propose statutory and regulatory changes necessary to effect recommendations. That review led to a Presidential Decision Directive released in May 1998. Presidential Decision Directive No. 63 (PDD-63) set as a national goal the ability to protect the nation's critical infrastructure from intentional attacks (both physical and cyber) by the year 2003. The PDD also called for a National Infrastructure Assurance Plan. After September 11, its focus included both cyber and physical security. All groups within the Council established during previous Administrations were abolished. E.O. PDD-63 focused on cybersecurity. Among the responsibilities assigned the IA/IP Directorate were
to access, receive, analyze, and integrate information from a variety of sources in order to identify and assess the nature and scope of the terrorist threat; to carry out comprehensive assessments of the vulnerabilities of key resources and critical infrastructure of the United States, including risk assessments to determine risks posed by particular types of attacks; to integrate relevant information, analyses, and vulnerability assessments in order to identify priorities for protective and support measures; to develop a comprehensive national plan for securing key resources and critical infrastructures; to administer the Homeland Security Advisory System; to work with the intelligence community to establish collection priorities; and to establish a secure communication system for receiving and disseminating information. ISACs were formed around two primary models. Congress continues to debate these issues primarily in the context of cybersecurity. Since much of what is considered to be critical infrastructure is owned and operated by the private sector, critical infrastructure protection relies to a large extent on the ability of the private sector and the federal government to share information.
The nation's health, wealth, and security rely on the production and distribution of certain goods and services. The array of physical assets, functions, and systems across which these goods and services move are called critical infrastructures (e.g., electricity, the power plants that generate it, and the electric grid upon which it is distributed).
The national security community has been concerned for some time about the vulnerability of critical infrastructure to both physical and cyberattack. In May 1998, President Clinton released Presidential Decision Directive No. 63. The Directive set up groups within the federal government to develop and implement plans that would protect government-operated infrastructures and called for a dialogue between government and the private sector to develop a National Infrastructure Assurance Plan that would protect all of the nation's critical infrastructures by the year 2003. While the Directive called for both physical and cyber protection from both man-made and natural events, implementation focused on cyber protection against man-made cyber events (i.e., computer hackers). Following the destruction and disruptions caused by the September 11 terrorist attacks in 2001, the nation directed increased attention toward physical protection of critical infrastructures. Over the intervening years, policy, programs, and legislation related to physical security of critical infrastructure have stabilized to a large extent. However, current legislative activity has refocused on cybersecurity of critical infrastructure.
This report discusses in more detail the evolution of a national critical infrastructure policy and the institutional structures established to implement it. The report highlights two primary issues confronting Congress going forward, both in the context of cybersecurity: information sharing and regulation.