According to the NIPP, the risk management framework is also  intended to inform how decision makers take actions to manage risk,  which according to DHS, is influenced by the nature and magnitude of a  threat, the vulnerabilities to that threat, and the consequences that could  result, as shown in figure 2. Other DHS offices with  CI risk assessment responsibilities include DHS’s Office of Intelligence  and Analysis, U.S. Coast Guard, and TSA. For our three selected sectors, DHS’s Sector Outreach and  Programs Division (SOPD), within the Office of Infrastructure Protection,  serves as the SSA for the Critical Manufacturing and nuclear sectors. According to DHS officials, these assessments help critical infrastructure  owners and operators take actions to improve security and mitigate risks. In limited circumstances, DHS generates risk  assessments that collectively incorporate all three elements of risk which  selected SCC representatives found of limited use for their sectors’  infrastructure protection efforts due to the amount of time it takes to  finalize the assessment data, the inclusion of risk scenarios that are not  likely to occur, and the results not being applicable to individual assets. Examples of Threat Information the  Department of Homeland Security  Provides to Critical Infrastructure Owners  and Operators  Classified Threat Briefings:  Officials from  the Office of Intelligence and Analysis and the  sector-specific agencies participate in  briefings at regular intervals with critical  infrastructure owners and operators to share  threat information gathered from intelligence  sources. Incident-Specific Outreach: The Nuclear  Reactors, Materials and Waste sector-specific  agency hosts incident-specific meetings and  calls for sector stakeholders. According to one SCC representative, threat information is the one  element of risk that adds the most value because it allows owners and  operators to react immediately to improve their security posture to  mitigate the effects of any potential hazards. These assessments focus on  physical infrastructure and are generally asset-specific and conducted  during site visits at individual assets. Selected Private Sector Representatives View Asset-Specific  Vulnerability Assessments As Useful  Sector Coordinating Council representatives from two of the three  selected sectors stated that DHS’s vulnerability assessment efforts were  useful for determining vulnerabilities for individual CI owners and  operators, but their opinions varied concerning the usefulness of  aggregating sector-wide data and sharing broadly among private sector  stakeholders. Also,  OCIA analyzes consequence from incidents, and models past events to  better understand the effect of these disruptions on assets and predict  consequences of future events. For  example, the Transportation Systems Sector Security Risk Assessment is  TSA’s annual report to Congress on transportation security. For example, TSA officials told us that they believe the Transportation  Systems Sector Security Risk Assessment data gathering methodology for identifying risk inputs adds the most value in the assessment process  for CI owners and operators in the Transportation Systems sector. DHS Uses CI Risk Information to Inform Strategic Planning and Guide Outreach to Owners and Operators

DHS uses CI risk information in multiple ways, including informing  strategic planning and developing analytic products, and at the  component level to guide its day-to-day owner and operator outreach and  incident response. The  QHSR is DHS’s process for updating the national homeland security  strategy, identifying critical homeland security missions, and assessing  the organizational alignment of DHS with the homeland security strategy  and missions. The HSNRC  assesses natural hazards such as floods, and manmade hazards such as  terrorism. PSAs use the National Critical Infrastructure  Prioritization Program (NCIPP) list––which prioritizes CI assets into  different levels according to their criticality––to inform their outreach to  owners and operators. SSA officials developed a tool to  help Critical Manufacturing sector owners and operators develop their  own continuity plans––including templates, tabletop exercises, and a self- directed risk assessment for private sector owners and operators to use. DHS Facilitates Sharing of Cross-Sector Risk Information through Coordinating Councils and Planning Documents

As part of DHS’s responsibility described in the NIPP, DHS created the  Critical Infrastructure Partnership Advisory Council (CIPAC), a forum for  stakeholders including government officials and asset owners and  operators, to facilitate planning and information sharing. Agency and Third Party Comments

We provided a draft of this product to DHS for review and comment. We  also provided draft excerpts of this product to the selected sector  coordinating council representatives we interviewed, who provided  technical comments that we also incorporated as appropriate. Key contributors to this report are listed in appendix V.

Appendix I: Selected Risk Information Products and Activities Distributed by the Department of Homeland Security

The following tables highlight threat, vulnerability and consequence  products and activities developed by the Department of Homeland  Security for the purpose of providing risk information to critical  infrastructure owners and operators.
Why GAO Did This Study

The nation's critical infrastructure includes cyber and physical assets and systems across 16 different sectors whose security and resilience are vital to the nation. The majority of critical infrastructure is owned and operated by the private sector. Multiple federal entities, including DHS, work with infrastructure owners and operators to assess their risks.
GAO was asked to review DHS's risk assessment practices for critical infrastructure. This report describes:(1) DHS's risk assessment practices in 3 of 16 critical infrastructure sectors and private sector representatives' views on the utility of this risk information, and (2) how this risk information influences DHS's strategic planning and private sector outreach.
GAO selected 3 of 16 sectors–Critical Manufacturing; Nuclear Reactors, Materials, and Waste; and Transportation Systems–to examine based on their varied regulatory structures and industries. GAO reviewed DHS guidance related to infrastructure protection, the QHSR and DHS Strategic Plan, and plans for the selected critical infrastructure sectors. GAO interviewed DHS officials responsible for critical infrastructure risk assessments, and the owner and operator representatives who serve as chairs and vice-chairs of coordinating councils for the 3 selected sectors. Information from the 3 sectors is not generalizable to all 16 sectors but provides insight into DHS's risk management practices.
GAO provided a draft of this report to DHS and relevant excerpts to the council representatives interviewed during this review. Technical comments provided were incorporated as appropriate.

What GAO Found

The Department of Homeland Security (DHS) primarily conducts assessments for each of the three elements of risk—threat, vulnerability, and consequence—for critical infrastructures from the three sectors GAO reviewed—Critical Manufacturing; Nuclear Reactors, Materials, and Waste; and Transportation Systems. In limited circumstances, DHS generates risk assessments that both incorporate all three elements of risk and cover individual or multiple subsectors.
Threat : DHS's Office of Intelligence and Analysis assesses threats—natural or manmade occurrences, entities, or actions with the potential to cause harm, including terrorist attacks and cyberattacks—and disseminates this information to critical infrastructure owners and operators. For example, the Transportation Security Administration provides threat intelligence to mass transit security directors and others through joint classified briefings.
Vulnerability : DHS officials provide various tools and work directly with owners and operators to assess asset and facility vulnerabilities—physical features or operational attributes that render an asset open to exploitation, including gates, perimeter fences, and computer networks. For example, DHS officials conduct voluntary, asset-specific vulnerability assessments that focus on physical infrastructure during individual site visits.
Consequence : DHS officials also assess consequence— the effect of occurrences like terrorist attacks or hurricanes resulting in losses that impact areas such as public health and safety, and the economy—to better understand the effect of these disruptions on assets.
These assessments help critical infrastructure owners and operators take actions to improve security and mitigate risks. Six private sector representatives told GAO that threat information is the most useful type of risk information because it allows owners and operators to react immediately to improve their security posture. For example, one official from the Transportation Systems sector said that government threat information is credible and is critical in supporting security recommendations to company decision-makers.
DHS uses the results of its risk assessments to inform the department's strategic planning and to guide outreach to infrastructure owners and operators. Critical infrastructure risk information is considered within DHS's strategic planning. Specifically, according to DHS officials, risk information informs the Department's Quadrennial Homeland Security Review (QHSR)—a process that identifies DHS's critical homeland security missions and its strategy for meeting them. DHS also uses risk information to guide outreach to critical infrastructure owners and operators. For example, DHS officials annually prioritize the most critical assets and facilities nationwide and categorize them based on the severity of the estimated consequences of a significant disruption to the asset or facility. DHS officials then use the results to target their assessment outreach to the infrastructure owners and operators categorized as higher risk. DHS officials also told GAO that they use risk information after an incident, such as a natural disaster, to quickly identify and prioritize affected infrastructure owners and operators to help focus their response and recovery assistance outreach.