	Introduction

The Homeland Security Act of 2002 and other Administration documents have assigned the Department of Homeland Security specific duties associated with coordinating the nation's efforts to protect its critical infrastructure. Many of these duties were delegated to the Information Analysis and Infrastructure Protection Directorate. Therefore, this report also discusses to some extent the Directorate's role in coordinating and/or integrating these activities. A Generic Model for Assessing and Integrating Threat, Vulnerability, and Risk

Many models/methodologies have been developed by which threats, vulnerabilities, and consequences are assessed and then used to inform the cost-effective allocation of resources to reduce risks. The elements are performed, more or less, in the following sequence:
Assessments
identify assets and identify which are most critical identify, characterize, and assess threats assess the vulnerability of critical assets to specific threats determine the risk (i.e., the expected consequences of specific types of attacks on specific assets)
Using Assessments to Identify and Prioritize Risk Reduction Activities
identify and characterize ways to reduce those risks prioritize risk reduction activities based on a risk reduction strategy

			Assessments

				Identifying Assets and Determining Criticality

The infrastructure of a facility, a company, or an economic sector, consists of an array of assets which are necessary for the production and/or delivery of a good or service. "Likelihood" is defined as "a function of: the attractiveness of the target to the adversary [based on the adversary's intent and the target's perceived value to the adversary], degree of threat [based on adversary's capabilities], and degree of vulnerability of the asset." Decision makers would have to come to a consensus on which risk reduction strategy to use to set priorities. Directorate's Internal Activity

While it has been developing the NIPP, the Directorate has been engaged in its own risk management activities. The Assistant Secretary for Infrastructure Protection, Robert Stephan, in July 2006, wrote that DHS had a list of more than 600 high-priority sites that it uses to focus its efforts. The risk management process described in the National Infrastructure Protection Plan (NIPP) contains all of the elements described above. The General Threat Environment will be updated as needed based on Specific Threat Information. It is unlikely that earlier risk management activities benefitted from this analysis. Expanding on this, the Directorate should be able to tell Congress what criteria it has used to select assets of national importance, the basic strategy it uses to determine which assets warrant additional protective measures, by how much these measures could reduce the risk to the nation, and how much these additional measures might cost. Department of Homeland Security. June 2006.
The Homeland Security Act of 2002 (P.L. 107-296) and other Administration documents have assigned the Department of Homeland Security specific duties associated with coordinating the nation's efforts to protect its critical infrastructure, including using a risk management approach to set priorities. Many of these duties have been delegated to what is now called the National Protection and Programs Directorate.
Risk assessment involves the integration of threat, vulnerability, and consequence information. Risk management involves deciding which risk reduction measures to take based on an agreed upon risk reduction strategy. Many models/methodologies have been developed by which threats, vulnerabilities, and consequences are integrated to determine risks and then used to inform the allocation of resources to reduce those risks. For the most part, these methodologies consist of the following elements, performed, more or less, in the following order.
identify assets and identify which are most critical identify, characterize, and assess threats assess the vulnerability of critical assets to specific threats determine the risk (i.e., the expected consequences of specific types of attacks on specific assets) identify ways to reduce those risks prioritize risk reduction measures based on a strategy
Beginning in 2003, the Department of Homeland Security has been accumulating a list of infrastructure assets (specific sites and facilities). From this list the Department selects high-priority assets that it judges to be critical from a national point of view, based on the potential consequences associated with their loss. The Department intends to assess the vulnerability of all the high-priority assets it has identified. Department officials have described, in very general terms, that these vulnerability and consequence assessments are used to determine the risk each asset poses to the nation. This risk assessment is then used to prioritize subsequent additional protection activities. While these statements allude to some of the steps mentioned above, they do so only in a most general way. With its release of the National Infrastructure Protection Plan in June 2006, the Department has laid out a much more detailed discussion of the risk management methodology it intends to use (or is using). The Department's efforts, to date, still raise several questions, ranging from the process and criteria used to populate its lists of assets, its prioritization strategy, and the extent to which the Department is coordinating its efforts with the intelligence community and other agencies both internal and external to the Department. This report will be updated as needed.