Among these are electric power generation and distribution, drinking water, communications and information systems, oil and gas production and distribution, transportation systems, and banking and finance. DHS's 2009 National Infrastructure Protection Plan defined resilience as "the ability to resist, absorb, recover from, or successfully adapt to adversity or a change in conditions." Reducing the potential risks associated with the loss of critical infrastructure resulting from a terrorist, natural hazard, or technological disaster (hereinafter referred to collectively as all-hazard events) is a key element in the nation's homeland security strategy and a topic of continued interest in Congress. In January 2006, the Critical Infrastructure Task Force of the Homeland Security Council published a report that concluded:
Given the diverse spectrum of potential threats [to the nation's critical infrastructure], coupled with the reality that resources are limited, policies and strategies focusing on achieving resilience would be more robust than current guidance, which focuses primarily on protection. The Task Force also argued that owners and operators of critical infrastructure could make a better business case for investing in resilience, measured in terms of the amount of time and effort needed to restore operations, than trying to justify investments to increase protection or reduce vulnerabilities, which, according to the Task Force, are more difficult to quantify. Resilience, on the other hand, according to Jackson, offers a way to reduce the consequences should an attack prevail and offers to broaden the range of ways to reduce risks. In a September 2009 report, the National Infrastructure Advisory Council (NIAC) found the "current policy framework fundamentally sound but could be improved to better reflect principles of resilience.…" The report also recommended that DHS: expand programs to allow funding for programmatic and grant funding of resilience efforts; encourage each sector to set resiliency goals; and assist in building resilience in the next generation of infrastructure. DHS Response

			G.W. Bush Administration

Early high level government policy documents rarely mentioned resilience. Neither the first National Homeland Security Strategy (2002) nor Homeland Security Presidential Directive 7 (2003) mention resilience at all. However, the NIPP still considered resiliency to be part of a protective strategy. Two of the four objectives under that goal were (1) protect critical infrastructure (prevent high consequence events by securing critical assets, systems, networks, or function from attacks or disruptions), and (2) make critical infrastructure resilient (enhance the ability of critical infrastructure systems, networks, and functions to withstand and rapidly recover from damage and disruption and adapt to changing conditions). One can also argue that the department programs to help owner/operators of critical infrastructure identify threats, assess the vulnerability of their assets and operations to those threats, and assess the possible consequences from those threats, are necessary before one can identify and implement protective or resilient options for reducing those risks. These latter components contribute to the development of a Resiliency Index, similar to the protective Measure Indexes. Recovery refers to the ability to return to normal operations as quickly and efficiently as possible. FEMA Grants

The Federal Emergency Management Agency (FEMA) administers a number of grant programs. These grants can support public expenditures for overtime personnel costs associated with protecting critical infrastructure assets. The risk assessment and security plan are to consider, among other items, efforts to provide redundant or back-up assets that would enable the transportation system to continue to operate in the event of an attack or incident. Such a requirement would relate to resilience. Eligible recipients include private sector facility owners/operators along with state and local governments and public entities. Program Summary

DHS can be thought of as having always contributed to community resilience in its efforts to improve the ability of communities to respond and recover from incidents through grants and various assistance programs. This has been furthered by more recent emphasis given to mitigation of risks before as well as after an incident. More recently, those efforts have taken into consideration more specifically resilience-oriented risk reduction options. However, the National Infrastructure Advisory Council cautioned that it is not clear that market incentives are sufficient to drive such investments. Congress may choose to continue its oversight of the progress being made in the area of metrics.
In 2006, the Critical Infrastructure Task Force of the Homeland Security Advisory Council initiated a public policy debate arguing that the government's critical infrastructure policies were focused too much on protecting assets from terrorist attacks and not focused enough on improving the resilience of assets against a variety of threats. According to the Task Force, such a defensive posture was "brittle." Not all possible targets could be protected and adversaries could find ways to defeat defenses, still leaving the nation having to deal with the consequences. The Task Force advocated that greater encouragement for resilience would broaden the range of risk reduction options and should be the overarching policy framework for reducing risks associated with all threats to critical infrastructure. Others in the homeland security community agreed.
Critical infrastructure are those assets the loss of which would result in great harm to the nation's security, economy, health and safety, and morale. They include assets necessary to generate and distribute such basic goods and services such as electricity, drinking water, telecommunications, banking and finance, etc. Resilience refers to the ability of a system to resist, absorb, recover from, or successfully adapt to a change in environment or conditions. The Task Force argued that government policies encouraged employing greater defenses such as surveillance equipment, guards, etc., around these assets but did less to encourage efforts that would allow assets to continue operating at some level, or quickly return to full operation, if attacked. Such efforts might include increasing redundancies (such as having multiple backup power generation capability) or designing more robust systems for the future (such as using more hardened concrete for stronger fixed facilities).
In 2008, as part of its oversight function, the House Committee on Homeland Security held a series of hearings addressing resilience. At those hearings, the Department of Homeland Security (DHS) argued that government policies and actions did encourage resilience as well as protection. Even so, subsequent policy documents made greater reference to resilience. At first those references were relatively superficial, but later they became more substantive. Policy has evolved to the point that resilience and protection of critical infrastructure assets are recognized as distinct options to be equally considered when seeking to reduce the risks associated with potential attacks on critical infrastructures.
As policy has evolved, programs have also evolved somewhat, to support efforts at improving critical infrastructure resiliency. The Office of Infrastructure Protection within the DHS conducts risk assessments at the asset and regional level that now include a resilience index along with a protection index. The program allows asset owners/operators to compare their level of resilience to other similar assets and allows them to analyze how certain improvements might contribute to better resilience. Also, the DHS Science and Technology Directorate supports some resilience-oriented research and development projects. In addition to projects developing better technologies to aid in response and recovery, the Directorate also supports projects that are developing technologies for structures to withstand blasts or large physical displacements or systems which can self-heal after being damaged.
The Federal Emergency Management Agency within DHS provides grants, primarily to state and local governments or public authorities, that largely support resilience by improving the ability to respond to and recover from incidents. Mitigation grants, which allow communities to reduce the potential consequences of an incident before it happens, offer limited support for improving the resilience of critical infrastructures. There is relatively little direct government support or incentives for private sector owners/operators to implement resilience-oriented (or protective-oriented) measures. It is not clear if market incentives are sufficient to drive such investments. Congress may choose to consider the adequacy of private investments in resilience, whether the private market provides sufficient incentives, and options for government action if markets do not.