Under the NIPP, the sector-specific agencies, in coordination with their  respective government and private sector councils, are responsible for  developing individual protection plans for their sectors that, among other  things, (1) define the security roles and responsibilities of members of the  sector, (2) establish the methods that members will use to interact and  share information related to protection of critical infrastructure, (3)  describe how the sector will identify its critical assets, and (4) identify the  approaches the sector will take to assess risks and develop programs to  protect these assets. Sectors Have Established Government and Sector Councils, Which are Generally Representative of their Sectors; Council Activities Have Varied Depending on Their Maturity and Other Characteristics

All of the sectors have established government councils, and voluntary  private sector councils under the NIPP model have been formed for all  sectors except transportation systems. Because some of the councils are newer than others, council activities  vary based on the council’s maturity and other characteristics, with some  younger councils focusing on establishing council charters, while more  mature councils focused on developing protection strategies. For example, prior to the  development of the NIPP, DHS and the Department of Agriculture had (1)  established a government coordinating council for the agriculture and  food sector to coordinate efforts to protect against agroterrorism, and (2)  helped the agriculture and food sector establish a private sector council to  facilitate the flow of alerts, plans, and other information. This provides the councils opportunities to build the  relationships needed to help ensure critical infrastructure protection  efforts are comprehensive. However, these representatives also most commonly identified several key  factors that posed challenges to forming some of the councils, including  (1) difficulty establishing partnerships with DHS because of issues  including high turnover of its staff and DHS staff who lacked knowledge  about the sector to which they were assigned, (2) hesitancy to provide  sensitive information or industry vulnerabilities to the government due to  concerns that the information might be publicly disclosed, and (3) lack of  long-standing working relationships within the sector or with federal  agencies. In addition, according to government and  sector council representatives, sectors in which the industries have been  highly regulated by the federal government—such as the banking and  finance sector as well as the commercial nuclear sector—were already  used to dealing with the federal government on many issues. Continuity of government staff is a key  ingredient in developing trusted relationships with the private sector. In this report, we assessed the status of DHS efforts to  implement the protected critical infrastructure information (PCII)  program created pursuant to the Homeland Security Act. To date,  the level of collaboration between sector-specific agencies and the sector  councils in developing the sector-specific plans has varied—ranging from  soliciting stakeholder comments on a draft to jointly developing the plan. Despite these differences, according to DHS Infrastructure  Protection officials, all the sectors submitted their plans to DHS by the  December 2006 deadline and DHS and other stakeholders are in the  process of reviewing them. DHS Needs to Fulfill Key Cybersecurity Responsibilities and Address Challenges and GAO Recommendations

To some extent, all sectors depend on cyber infrastructure to operate,  such as using computers to control access at nuclear facilities. Moreover, in 2006, we reported that DHS had begun  a variety of initiatives to fulfill its responsibility to develop an integrated  public/private plan for Internet recovery, but that these efforts were not  complete or comprehensive. The Assistant Secretary has set priorities that include (1)  preparing for and deterring attacks by encouraging entities, through  implementation of the sector specific plans, to systematically assess their  network vulnerabilities and take steps to fix them, (2) responding to cyber  attacks of potentially national significance by leveraging operational  expertise and building situational awareness and incident response  capabilities of the government and private sector; and (3) building  awareness about the responsibilities for securing networks across the  public and private sectors. While DHS has made progress in addressing some of these  recommendations many things remain to be done. Concluding Observations

Critical infrastructure protection is vital to our national security, economic  vitality, and public health. Yet a decade after focusing on improving our  ability to protect our key assets and resources, progress has been mixed,  as Katrina demonstrated. DHS has moved out by issuing the National  Infrastructure Protection Plan as a guiding framework for a national effort,  and is providing contractor, technical, and analytical support to sectors,  among other things, to encourage progress. Thus, fulfilling its statutory responsibilities for ensuring the nation’s  critical infrastructure is protected will be a long-term commitment for  DHS.
Why GAO Did This Study

As Hurricane Katrina so forcefully demonstrated, the nation's critical infrastructures--both physical and cyber--have been vulnerable to a wide variety of threats. Because about 85 percent of the nation's critical infrastructure is owned by the private sector, it is vital that the public and private sectors work together to protect these assets. The Department of Homeland Security (DHS) is responsible for coordinating a national protection strategy including formation of government and private sector councils as a collaborating tool. The councils, among other things, are to identify their most critical assets, assess the risks they face, and identify protective measures, in sector-specific plans that comply with DHS's National Infrastructure Protection Plan (NIPP). This testimony is based primarily on GAO's October 2006 sector council report and a body of work on cyber critical infrastructure protection. Specifically, it addresses (1) the extent to which these councils have been established, (2) key facilitating factors and challenges affecting the formation of the council, (3) key facilitating factors and challenges encountered in developing sector plans, and (4) the status of DHS's efforts to fulfill key cybersecurity responsibilities. GAO has made previous recommendations, particularly in the area of cybersecurity that have not been fully implemented. Continued monitoring will determine whether further recommendations are warranted.

What GAO Found

To better coordinate infrastructure protection efforts as called for in the NIPP, all 17 critical infrastructure sectors have established their respective government councils, and nearly all sectors have initiated their voluntary private sector councils. But council progress has varied due to their characteristics and level of maturity. For example, the public health and healthcare sector is quite diverse and collaboration has been difficult as a result; on the other hand, the nuclear sector is quite homogenous and has a long history of collaboration. As a result, council activities have ranged from getting organized to refining infrastructure protection strategies. Ten sectors, such as banking and finance, had formed councils prior to development of the NIPP and had collaborated on plans for economic reasons, while others had formed councils more recently. As a result, the more mature councils could focus on strategic issues, such as recovering after disasters, while the newer councils were focusing on getting organized. Council members reported mixed views on what factors facilitated or challenged their actions. For example, long-standing working relationships with regulatory agencies and within sectors were frequently cited as the most helpful factor. Challenges most frequently cited included the lack of an effective relationship with DHS as well as private sector hesitancy to share information on vulnerabilities with the government or within the sector for fear the information would be released and open to competitors. GAO's past work has shown that a lack of trust in DHS and fear that sensitive information would be released are recurring barriers to the private sector's sharing information with the federal government, and GAO has made recommendations to help address these barriers. DHS has generally concurred with these recommendations and is in the process of implementing them. All the sectors met the December 2006 deadline to submit their sector-specific plans to DHS, although the level of collaboration between the sector and government councils on the plans, which the NIPP recognizes as critical to establishing relationships between the government and private sectors, varied by sector. Issuing the NIPP and completing sector plans are only first steps to ensure critical infrastructure is protected. Moving forward to implement sector plans and make progress will require continued commitment and oversight. While DHS has initiatives under way to fulfill its many cybersecurity responsibilities, major tasks remain to be done. These include assessing and reducing cyber threats and vulnerabilities and coordinating incident response and recovery planning efforts. Effective leadership by the Assistant Secretary for Cyber Security and Telecommunications is essential to DHS fulfilling its key responsibilities, addressing the challenges, and implementing recommendations.