The ISACs and the ISAC Council identified challenges that would  require federal action. DHS Has Not Developed an Overall Information Sharing Plan

Although DHS has taken a number of actions to develop relationships with  the private sector and enhance information sharing capabilities, it has not  developed a plan that describes how it will carry out its  information-sharing responsibilities and/or how it will address the many  identified challenges that exist in building a public/private  information-sharing partnership. This official indicated that a specific time frame for completing  the plan had not yet been established but that DHS intends to develop a  time frame this summer. Rather, the  department plans to develop policies and procedures to ensure effective  coordination and sharing of ISAC-provided information among the  appropriate DHS components. Key contributors to this report are listed in appendix V.

GAO’s April 21, 2004, Testimony

Critical infrastructure protection  (CIP) activities that are called for  in federal policy and law are  intended to enhance the security of  the cyber and physical public and  private infrastructures that are  essential to our nation’s security,  economic security, and public  health and safety. Effective  information-sharing partnerships  between industry sectors and  government can contribute to CIP  efforts. Federal awareness of the importance of securing the nation’s critical  infrastructures—and the federal government’s strategy to encourage  cooperative efforts among state and local governments and the private  sector to protect these infrastructures—have been evolving since the mid- 1990s. Federal policy has encouraged the  voluntary creation of Information  Sharing and Analysis Centers  (ISACs) to facilitate the private  sector’s participation in CIP by  serving as mechanisms for  gathering and analyzing  information and sharing it among  the infrastructure sectors and  between the private sector and  government. These  challenges include increasing the percentage of entities within each sector  that are members of its ISAC; building trusted relationships and processes to  facilitate information sharing; overcoming barriers to information sharing,  clarifying the roles and responsibilities of the various government and  private sector entities that are involved in protecting critical infrastructures;  and funding ISAC operations and activities. Subsequent federal CIP  policy, including several national strategies, has continued to emphasize  the importance of the ISACs and their information-sharing functions.Further, CIP policy has established specific responsibilities for the  Department of Homeland Security (DHS) and other federal agencies with  respect to public/private collaboration to help protect private  infrastructure sectors. DHS Actions to Improve Information-Sharing Relationships

specific agencies to implement the public/private partnership called for by  federal CIP policy.
Why GAO Did This Study

Critical infrastructure protection (CIP) activities called for in federal policy and law are intended to enhance the security of the public and private infrastructures that are essential to our nation's security, economic security, and public health and safety. Effective information-sharing partnerships between industry sectors and government can contribute to CIP efforts. Federal policy has encouraged the voluntary creation of information sharing and analysis centers (ISAC) to facilitate infrastructure sector participation in CIP information sharing efforts. GAO was asked to identify actions that the Department of Homeland Security (DHS) could take to improve the effectiveness of CIP information-sharing efforts.

What GAO Found

Federal awareness of the importance of securing the nation's critical infrastructures--and the federal government's strategy to encourage cooperative efforts among state and local governments and the private sector to protect these infrastructures--have been evolving since the mid-1990s. Federal policy continues to emphasize the importance of the ISACs and their information-sharing functions. In addition, federal policy established specific responsibilities for DHS and other federal agencies involved with the CIP sectors. The ISACs have identified challenges requiring further federal action, including building trusted relationships; developing processes to facilitate information sharing; overcoming barriers to information sharing; clarifying the roles and responsibilities of the various government and private-sector entities that are involved in protecting critical infrastructures; and funding ISAC operations and activities. A lthough DHS has taken a number of actions to implement the public/private partnership called for by federal CIP policy, it has not yet developed a plan that describes how it will carry out its information-sharing responsibilities and relationships. Such a plan could encourage improved information sharing among the ISACs, other CIP entities, and the department by clarifying the roles and responsibilities of all the entities involved and clearly articulating actions to address the challenges that remain. DHS officials indicated that they intend to develop an information-sharing plan, but no specific time frame for completing the plan has been established. The department also lacks policies and procedures to ensure effective coordination and sharing of ISAC-provided information among the appropriate components within the department. Developing policies and procedures would help ensure that information is effectively and efficiently shared among its components and with other government and private-sector CIP entities.