Critical Infrastructure Protection: DHS Risk Assessments Inform Owner and Operator Protection Efforts and Departmental Strategic Planning

The nation's critical infrastructure includes cyber and physical assets and systems across 16 different sectors whose security and resilience are vital to the nation. The majority of critical infrastructure is owned and operated by the private sector. Multiple federal entities, including DHS, work with infrastructure owners and operators to assess their risks.

GAO was asked to review DHS's risk assessment practices for critical infrastructure. This report describes:(1) DHS's risk assessment practices in 3 of 16 critical infrastructure sectors and private sector representatives' views on the utility of this risk information, and (2) how this risk information influences DHS's strategic planning and private sector outreach.

GAO selected 3 of 16 sectors–Critical Manufacturing; Nuclear Reactors, Materials, and Waste; and Transportation Systems–to examine based on their varied regulatory structures and industries. GAO reviewed DHS guidance related to infrastructure protection, the QHSR and DHS Strategic Plan, and plans for the selected critical infrastructure sectors. GAO interviewed DHS officials responsible for critical infrastructure risk assessments, and the owner and operator representatives who serve as chairs and vice-chairs of coordinating councils for the 3 selected sectors. Information from the 3 sectors is not generalizable to all 16 sectors but provides insight into DHS's risk management practices.

GAO provided a draft of this report to DHS and relevant excerpts to the council representatives interviewed during this review. Technical comments provided were incorporated as appropriate.

The Department of Homeland Security (DHS) primarily conducts assessments for each of the three elements of risk—threat, vulnerability, and consequence—for critical infrastructures from the three sectors GAO reviewed—Critical Manufacturing; Nuclear Reactors, Materials, and Waste; and Transportation Systems. In limited circumstances, DHS generates risk assessments that both incorporate all three elements of risk and cover individual or multiple subsectors.

Threat : DHS's Office of Intelligence and Analysis assesses threats—natural or manmade occurrences, entities, or actions with the potential to cause harm, including terrorist attacks and cyberattacks—and disseminates this information to critical infrastructure owners and operators. For example, the Transportation Security Administration provides threat intelligence to mass transit security directors and others through joint classified briefings.

Vulnerability : DHS officials provide various tools and work directly with owners and operators to assess asset and facility vulnerabilities—physical features or operational attributes that render an asset open to exploitation, including gates, perimeter fences, and computer networks. For example, DHS officials conduct voluntary, asset-specific vulnerability assessments that focus on physical infrastructure during individual site visits.

Consequence : DHS officials also assess consequence— the effect of occurrences like terrorist attacks or hurricanes resulting in losses that impact areas such as public health and safety, and the economy—to better understand the effect of these disruptions on assets.

These assessments help critical infrastructure owners and operators take actions to improve security and mitigate risks. Six private sector representatives told GAO that threat information is the most useful type of risk information because it allows owners and operators to react immediately to improve their security posture. For example, one official from the Transportation Systems sector said that government threat information is credible and is critical in supporting security recommendations to company decision-makers.

DHS uses the results of its risk assessments to inform the department's strategic planning and to guide outreach to infrastructure owners and operators. Critical infrastructure risk information is considered within DHS's strategic planning. Specifically, according to DHS officials, risk information informs the Department's Quadrennial Homeland Security Review (QHSR)—a process that identifies DHS's critical homeland security missions and its strategy for meeting them. DHS also uses risk information to guide outreach to critical infrastructure owners and operators. For example, DHS officials annually prioritize the most critical assets and facilities nationwide and categorize them based on the severity of the estimated consequences of a significant disruption to the asset or facility. DHS officials then use the results to target their assessment outreach to the infrastructure owners and operators categorized as higher risk. DHS officials also told GAO that they use risk information after an incident, such as a natural disaster, to quickly identify and prioritize affected infrastructure owners and operators to help focus their response and recovery assistance outreach.

The nation’s critical infrastructure (CI) includes physical and cyber assets  and systems that are so vital to the United States that their incapacity or  destruction could have a debilitating impact on national security, public  health and safety, or the economy. CI provides the essential services–– such as transportation, water, and energy––that underpin American  society, and protecting CI assets and systems is a national security  priority. The risk environment for CI ranges from natural disasters to  cyberattacks by foreign malicious actors. Additionally, while companies  have increasingly sought to gain efficiencies by connecting their physical  and cyber business systems, the convergence between these systems  creates new opportunities for potential cyber attackers to access these  systems. Because the majority of CI is owned and operated by the private  sector, it is vital that the public and private sectors work together to  protect these assets and systems.

The Department of Homeland Security (DHS) coordinates the overall  federal effort for national CI protection. As part of its CI protection  responsibilities, DHS is to conduct CI risk assessments and integrate  relevant information and analyses to identify priorities for protective and  support measures to be implemented by DHS, other federal agencies,  state and local government agencies and authorities, the private sector,  and other entities.

DHS developed the first version of the National Infrastructure Protection  Plan (NIPP) in 2006 and updated it in 2009 and 2013. The NIPP  describes a voluntary partnership model as the primary means of  coordinating government and private sector efforts to protect CI. It  provides a framework for developing and implementing a coordinated  national effort to protect CI within 16 distinct sectors. The sectors vary in  structure, with some sectors, such as the chemical and nuclear sectors,  having more regulatory oversight governing their respective security  issues in addition to the voluntary partnership model. Other sectors, such  as commercial facilities and critical manufacturing, have less regulatory  oversight, according to DHS officials.

As part of the partnership structure, each sector has a designated Sector- Specific Agency (SSA), a federal department or agency that serves as the  lead coordinator for security and resilience programs and activities for  their respective sector. Each sector also has a government coordinating  council (GCC), consisting of representatives from various levels of  government, and a sector coordinating council (SCC) consisting of owner- operators of these critical assets or members of their respective trade  associations. According to the NIPP, SCCs serve as principal  collaboration points between the government and private sector owners  and operators for CI security and resilience policy coordination and  related sector-specific activities. For example, the NIPP calls for the  individual sector-specific agencies, working with relevant sector  representatives, to develop sector-specific plans to, among other things,  describe how the sector will identify and prioritize its critical assets,  including cyber assets, and define approaches the sector will take to  assess risks and develop programs to protect these assets.

Focusing on cyber infrastructure, DHS’s National Cybersecurity and  Communications Integration Center (NCCIC) provides a central place for  federal and private-sector organizations to coordinate efforts to address  cyber threats and respond to cyber attacks. The NCCIC’s mission is to  reduce the likelihood and severity of incidents that may significantly  compromise the security and resilience of the nation’s critical information  technology and communications networks.

Due to the cyber-based threats to federal systems and critical  infrastructure, the persistent nature of information security vulnerabilities,  and the associated risks, we continue to designate information security as  a government-wide high-risk area in our most recent biennial report to  Congress, a designation we have made in each report since 1997. In  2003, we expanded this high-risk area to include, the protection of critical  cyber infrastructure. While DHS has made progress in this area,  challenges remain. For example, we reported in November 2015 that  while SSAs had taken actions to mitigate cyber risks for their respective  CI sectors, most SSAs had not developed metrics to measure and report  on the effectiveness of their mitigation activities. We also reported that  DHS needed to assess whether its efforts to share information on cyber  threats, incidents, and countermeasures with federal and non-federal  entities are useful and effective.

Over the last several years, DHS has taken actions to assess  vulnerabilities at CI facilities and within groups of related infrastructure,  regions, and systems. We reported in September 2014 that DHS offices  and components had conducted or required thousands of vulnerability  assessments of CI from October 2010 to September 2013, and that DHS  needed to enhance integration and coordination of these efforts. DHS  concurred with the six recommendations in our report, including our  recommendation that it take steps to better coordinate vulnerability assessments both within DHS and other CI partners, as appropriate. DHS  has taken steps to address this particular recommendation, which are  discussed later in this report.

Given the importance of CI to the nation’s economy and well-being, you  requested that we review DHS’s efforts to assess risks to CI. This report  addresses the following questions:  1.  What are DHS’s risk assessment practices in selected CI sectors and  what are private sector representatives’ views on the utility of this risk  information?  2.  How, if at all, does CI risk information influence DHS’s strategic  planning and private sector outreach?

To address our first objective, we reviewed agency documents and  interviewed relevant officials to identify DHS’s physical and cyber risk  assessment practices for 3 of the 16 CI sectors: Critical Manufacturing;  Nuclear Reactors, Materials, and Waste; and Transportation Systems.  We selected these three sectors because they were sectors for which  DHS serves as the SSA or the co-SSA. DHS’s Office of Infrastructure  Protection is the lead component within DHS for the Critical  Manufacturing and nuclear sectors, and DHS shares SSA responsibilities  with the Department of Transportation for the Transportation Systems  sector. These three sectors also have varying levels of federal regulation.  Specifically, we chose the Critical Manufacturing sector because  according to DHS, the majority of the assets in this sector are privately  owned and operated by companies that have minimal interaction with the  federal government and other regulatory entities and includes the  manufacturing industries that are the most crucial for the continuity of  other critical sectors and has significant national economic implications.  Additionally, we selected the nuclear sector because all of the facilities in  the sector are subject to federal security requirements, which allowed us  to observe how a regulatory environment may affect DHS’s provision of  risk information to CI owners and operators. We also included the  Transportation Systems sector because portions of it are regulated and  DHS regularly conducts sector-wide complete risk assessments for this  sector. The information gathered from these three selected sectors is  not generalizable to all 16 sectors but does provide insight into how  DHS’s risk assessment information is used for a variety of CI. We  reviewed laws and guidance regarding DHS’s roles and responsibilities  relating to physical and cyber CI risk assessment practices including the  Homeland Security Act of 2002, as amended, and Presidential Policy  Directive/PPD-21 (PPD-21). We also examined DHS’s National  Infrastructure Protection Plan, DHS’s Risk Management Fundamentals,  and the National Institute of Standards and Technology (NIST)  Cybersecurity Framework to identify common practices for generating  risk-related information.

To characterize the risk information DHS distributed to CI owners and  operators in the three selected sectors, we identified the products and  activities associated with each risk element—threat, vulnerability, and  consequence. Additionally, to identify cybersecurity products and services  distributed by DHS, we reviewed our previous work on DHS’s NCCIC to  categorize NCCIC products and services. We interviewed DHS officials  from the National Protection and Programs Directorate (NPPD), the Office  of Policy, the Office of Intelligence and Analysis (I&A), and the  Transportation Security Administration (TSA) to discuss DHS’s roles and  responsibilities related to assessing risks for CI. We also interviewed the  SCC chair and vice-chair from each of the three selected sectors to  determine how DHS risk assessment information may be used by owners  and operators, for a total of six SCC representatives. The information  gathered from interviews with these private sector representatives is not  generalizable to each of their respective sectors but provides insights into  how the asset owners use risk information provided by DHS.

To address our second objective, we reviewed and analyzed DHS  planning products, such as the Quadrennial Homeland Security Review  (QHSR) and strategic plans for the individual CI sectors, to determine  which documents included elements that capture CI risk data for strategic  decision-making purposes. We examined DHS policies and guidance  related to administering risk assessments and obtained information from  NPPD officials to determine how DHS may use risk information when  prioritizing outreach activities within the three selected sectors. We also  reviewed our past work on DHS strategic planning and DHS’s actions to  address open recommendations and interviewed DHS’s Office of Policy  to discuss the next iteration of the QHSR due to be released in fiscal year  2018.

We conducted this performance audit from July 2016 to October 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Presidential Directives Define DHS’s CI Security Mission

In February 2013, the White House released Presidential Policy Directive  (PPD)-21, Critical Infrastructure Security and Resilience, directing DHS to  coordinate the overall federal effort to promote the security and resilience  of the nation’s CI from all hazards. Within DHS, NPPD has been  delegated the responsibility for the security and resilience of the nation’s CI, and within NPPD, the Office of Infrastructure Protection (IP) leads and  coordinates national programs and policies on CI issues.

Also in February 2013, the President issued Executive Order 13636,  “Improving Critical Infrastructure Cybersecurity,” citing repeated cyber  intrusions into critical infrastructure as demonstrating the need for  improved cybersecurity. Among other things, the order addressed the  need to improve cybersecurity information sharing and collaboratively  develop risk-based standards; stated U.S. policy to increase the volume,  timeliness, and quality of cyber threat information shared with private  sector entities; directed the federal government to develop a technology- neutral cybersecurity framework to help CI owners and operators identify,  assess, and manage cyber risk; and required DHS to use a consultative  process to identify infrastructure in which a cybersecurity incident could  result in catastrophic consequences.

The National Infrastructure Protection Plan Provides a Framework for Managing Risk

The NIPP sets forth a risk management framework and outlines DHS’s  roles and responsibilities regarding CI security and resilience. As shown  in Figure 1, the NIPP risk management framework is a planning  methodology that outlines the process for setting goals and objectives;  identifying assets, systems, and networks; assessing risk; implementing  protective programs and resiliency strategies; and measuring  performance and taking corrective action.

The risk management framework calls for public and private CI partners  to conduct risk assessments to understand the most likely and severe  incidents that could affect their operations and communities, and use this  information to support planning and resource allocation in a coordinated  manner. According to the NIPP, the risk management framework is also  intended to inform how decision makers take actions to manage risk,  which according to DHS, is influenced by the nature and magnitude of a  threat, the vulnerabilities to that threat, and the consequences that could  result, as shown in figure 2.

Multiple DHS Offices Are Involved in CI Risk Assessment Activities

Multiple DHS offices conduct or assist with risk assessments for CI,  including the Office of Cybersecurity and Communications (CS&C), Office  of Infrastructure Protection, and Office of Cyber and Infrastructure  Analysis (OCIA). The Office of Infrastructure Protection and CS&C both  use voluntary programs to introduce risk-related tools intended to identify  gaps in infrastructure security. These include voluntary security surveys  and vulnerability assessments carried out by DHS’s Protective Security  Advisors (PSA) and Cyber Security Advisors (CSA). PSAs are CI  protection and security specialists responsible for assisting asset owners  and operators with protection strategies of physical assets, and CSAs are  cybersecurity specialists responsible for helping to bolster owners’ and  operators’ cyber assessment capabilities. Both types of advisors use  their respective assessment tools to work with CI stakeholders to develop  measures intended to make assets more resilient. Other DHS offices with  CI risk assessment responsibilities include DHS’s Office of Intelligence  and Analysis, U.S. Coast Guard, and TSA.

PPD-21 and the NIPP also call for other federal departments and  agencies to play a key role in CI security and resilience activities in their  capacity as SSAs. In general, an SSA is a federal department or agency  responsible for, among other things, supporting the security and  resilience programs and related activities of designated CI sectors. DHS is designated as the SSA or co-SSA for 10 of the 16 CI sectors, and has  assigned its SSA duties to multiple entities including the Office of  Infrastructure Protection, TSA, Coast Guard, and Federal Protective  Service. For our three selected sectors, DHS’s Sector Outreach and  Programs Division (SOPD), within the Office of Infrastructure Protection,  serves as the SSA for the Critical Manufacturing and nuclear sectors.  DHS’s TSA and the U.S. Department of Transportation serve as co-SSAs  for the Transportation Systems sector. Other federal agencies or  departments external to DHS serve as the SSAs for the remaining 6  sectors for which DHS is not designated as the SSA or co-SSA. Figure 3  provides descriptions of the 16 sectors, identifies the SSA of each sector,  and highlights the three selected sectors.

Risk Assessment Activities Vary Based on Sector’s Regulatory Environment

For some sectors, assets or operations are regulated by federal or state  regulatory agencies that possess unique insight into the risk mitigation  strategies of the CI they oversee. These regulators, who may not serve  as the designated SSA for the sector, help establish safety and security  protocols for the industries they regulate and ensure sector resilience  through the policymaking and oversight processes. For example, the  Nuclear Regulatory Commission, in its role as the regulatory agency for  the nuclear sector, conducts threat assessments to help protect against  acts of radiological sabotage and to prevent the theft of special nuclear  material. Additionally, pursuant to the Maritime Transportation Security  Act of 2002, DHS must use risk management in specific aspects of its  homeland security efforts. For example, the Coast Guard and other port  security stakeholders are required to carry out certain risk-based tasks,  including assessing risks and developing security plans for ports,  facilities, and vessels.

NIST Framework Provides Voluntary Cybersecurity Guidance

DHS is also involved in promoting and supporting the adoption of the  NIST Framework for Improving Critical Infrastructure Cybersecurity. In  accordance with requirements in Executive Order 13636, as discussed  above, this framework provides voluntary standards and procedures for  CI organizations to follow to better manage and reduce cybersecurity risk,  and is designed to foster communication among CI stakeholders about  cybersecurity management.

In December 2015, we reported that SSAs and NIST had promoted and  supported adoption of the cybersecurity framework in the CI sectors.  For example, in February 2014, DHS established the Critical  Infrastructure Cyber Community Voluntary Program to encourage  adoption of the framework and has undertaken multiple efforts as part of  this program. These include developing guidance and tools that are intended to help sector entities use the framework. We also reported that  DHS did not have metrics to measure the success of these program  efforts, and recommended that DHS develop metrics to understand the  effectiveness of their promotion activities. DHS concurred, and in  December 2016 DHS officials stated that they plan to continue to work  with SSA partners and NIST to determine how to develop measurement  activities and collect information on the voluntary program’s outreach and  its effectiveness in promoting and supporting the cybersecurity  framework. We are currently conducting a review that will identify actions  taken by relevant federal entities including NIST, DHS, and other SSAs to  promote the adoption of the cybersecurity framework. We will continue to  monitor the voluntary program’s outreach as well as DHS’s efforts to  measure its effectiveness in promoting and supporting the cybersecurity  framework.

Efforts to Increase Operational Efficiency among CI Assets Result in Physical and Cyber Security Convergence and Expand the Potential for Cyberattacks

The convergence of physical and cyber security is a major challenge for  owners and operators of CI as more physical processes and systems are  connected to Internet-enabled networks to improve operational efficiency,  according to DHS officials. For example, facilities may make use of  automated building control systems to control certain processes or  functions, such as security, lighting, or heating, ventilation, and air  conditioning (HVAC). These control systems increase efficiency and  optimize operational performance by reducing the need for manual  controls and adjustments. Building control systems and the devices  within them are often configured with connections to the Internet. These  Internet connections allow the systems to be accessed remotely for  control and monitoring and, for example, to receive software patches and  updates. Figure 4 illustrates how a facility’s HVAC and security systems  are managed through a building automation system and operated over a  control network. In this example, the information systems and networks  are protected by a firewall—a cybersecurity countermeasure—while the  control network and its devices have direct Internet connectivity without  going through a firewall, potentially allowing a cyber-attacker to control  the building’s electronic door locks.

Broader examples of these types of networked systems include electrical  grids and water distribution systems, as well as control systems that  operate chemical manufacturing processes, monitor natural gas pipelines,  and control petroleum refineries. Depending on the cyberattack, there is  potential to cause a disruption to specific infrastructure operations and a  possibility that such an event could lead to cascading effects within the  sector or to other sectors in the economy. According to a 2015 DHS  report on cyber-physical infrastructure risks, greater connectivity among  technologies that connect cyber systems to physical systems expands the  potential for cyberattack by malicious actors. The growing convergence of  these systems mean that exploited cyber vulnerabilities can result in  physical consequences, as well.

DHS Primarily Assesses the Three Elements of Risk Separately for CI, and Private Sector Representatives from Selected Sectors Report Threat Information Most Valuable

DHS primarily assesses the three elements of risk–threat, vulnerability,  and consequence–separately for individual CI assets and sectors.  According to DHS officials, these assessments help critical infrastructure  owners and operators take actions to improve security and mitigate risks.  However, according to SCC representatives from three selected sectors,  timely and actionable threat assessment data is the most useful type of  risk information. In limited circumstances, DHS generates risk  assessments that collectively incorporate all three elements of risk which  selected SCC representatives found of limited use for their sectors’  infrastructure protection efforts due to the amount of time it takes to  finalize the assessment data, the inclusion of risk scenarios that are not  likely to occur, and the results not being applicable to individual assets.

DHS Shares Threat Assessment Information with CI Owners and Operators

Threat Information Products Help Make Critical Infrastructure in  Selected Sectors More Secure and Resilient  DHS’s Office of Intelligence and Analysis (I&A) compiles information from  a variety of classified and unclassified sources to develop threat-related  analytic products for each of the 16 CI sectors. I&A’s threat assessment  efforts include classified briefings intended to help CI owners and  operators manage risks to their individual operations and assets, and to  determine effective strategies to make them more secure and resilient.  DHS typically shares these products via its Homeland Security  Information Network for Critical Infrastructure (HSIN-CI) platform. I&A  also partners with sector-specific agencies to engage asset owners and  operators directly during biweekly classified threat briefings to share  threat data. During these meetings, both I&A officials and CI owners and  operators take this opportunity to identify potential threat-related risks that  may inform future I&A threat products.

The Homeland Security Information  Network–Critical Infrastructure (HSIN-CI)  HSIN-CI is the Department of Homeland  Security’s (DHS) information sharing platform  and collaboration tool for critical infrastructure  stakeholders. It is the primary system through  which private sector owners and operators,  DHS, and other federal, state, and local  government agencies collaborate to protect  CI. According to DHS, it is an unclassified,  web-based communications system for  sharing sensitive but unclassified information.  Users can access protection alerts,  information bulletins, incident reports,  situational updates, and analyses. Users can  also engage in secure discussions with sector  peer groups. Other features include CI  protection training, planning and  preparedness information, and a document  library.

Similarly, TSA’s Office of Intelligence (TSA-OI) receives intelligence  information regarding threats to transportation-related assets and  disseminates it to industry officials with transportation responsibilities, as  well as to other federal, state, and local officials. TSA-OI disseminates  security information through products including reports, assessments, and  briefings. For example, TSA-OI, in conjunction with I&A and the Federal  Bureau of Investigation, provides intelligence and security information to  mass transit and passenger rail security directors, law enforcement chiefs  in major metropolitan areas, and Amtrak officials through joint classified  intelligence and analysis briefings. Although it is not an intelligence  generator, TSA-OI receives and assesses intelligence from within and  outside of the intelligence community to determine its relevance to  transportation security. Sources of information outside the intelligence  community include other DHS components, law enforcement agencies,  and owners and operators of transportation systems. TSA-OI also  reviews suspicious activity reporting by Transportation Security Officers,  Behavior Detection Officers, and Federal Air Marshals.

DHS officials from IP and TSA told us that they also share threat  information within their respective sectors. For example, as the Critical  Manufacturing SSA, IP disseminates threat information to sector  stakeholders daily. Officials from IP also hold quarterly threat briefings to  alert stakeholders of relevant threats. TSA likewise shares transportation  security related information, including details on threats, vulnerabilities,  and suspicious activities, with Transportation Systems sector  stakeholders through unclassified or classified products and briefings. For  example, TSA provides Transportation Intelligence Notes to  transportation security partners to offer additional information or analysis  on a specific topic and also provides situational awareness of ongoing or  recent incidents. Table 1 in appendix I summarizes DHS threat  assessment activities and products provided to the three selected  sectors.

Examples of Threat Information the  Department of Homeland Security  Provides to Critical Infrastructure Owners  and Operators  Classified Threat Briefings:  Officials from  the Office of Intelligence and Analysis and the  sector-specific agencies participate in  briefings at regular intervals with critical  infrastructure owners and operators to share  threat information gathered from intelligence  sources.  Incident-Specific Outreach: The Nuclear  Reactors, Materials and Waste sector-specific  agency hosts incident-specific meetings and  calls for sector stakeholders.  Daily Threat Briefings: DHS publishes a  daily e-mail that contains threat information  intended to provide situational awareness  from a variety of sources including the Federal  Emergency Management Agency,  Department of Justice, and other stakeholders  as appropriate. According to DHS, these  emails are distributed to more than 140  recipients in the Critical Manufacturing sector.

NCCIC Established to Share Cyber Threat Information  According to DHS, the NCCIC is a 24x7 cyber situational awareness,  incident response, and management center. The center shares  information among public and private sector partners to build awareness  of cyber vulnerabilities, incidents, and mitigation strategies and its  partners include other government agencies, the private sector, and  international entities. The NCCIC works with the private sector by  integrating (both physically and virtually) CI owners and operators into the  center’s operations so that, during an incident, threat information can be  aggregated and communicated between government and appropriate  private sector partners in an efficient manner. The NCCIC manages  several programs that provide data used in developing 43 products and  services in support of its 11 statutorily required cybersecurity functions.  The programs include monitoring network traffic entering and exiting  federal agency networks and analyzing computer network vulnerabilities  and threats. The products and services are provided to its customers in  the private sector; federal, state, local, tribal, and territorial government  entities; and other partner organizations. For example, the NCCIC issues  indicator bulletins, which can contain information related to cyber threat  indicators, defensive measures, and cybersecurity risks and incidents. A  list of these products and services is summarized in table 5 in appendix II.  As of September 2017, 199 private sector CI owners and operators had  as-needed access to NCCIC through their participation in the Cyber  Information Sharing and Collaboration Program (CISCP).

The National Cybersecurity and  Communications Integration Center  (NCCIC)  The Department of Homeland Security’s  (DHS) NCCIC serves as a central location  where partners involved in cybersecurity and  communications protection coordinate and  synchronize their efforts. NCCIC's partners  include other government agencies, the  private sector, and international entities.  According the DHS, working closely with its  partners, NCCIC analyzes cybersecurity and  communications information, shares timely  and actionable information, and coordinates  response, mitigation, and recovery efforts.  The NCCIC is made up of four branches:   NCCIC Operations and Integration;  United States Computer Emergency  Readiness Team;  Industrial Control Systems Cyber Emergency  Response Team; and  National Coordinating Center for  Communications.

In February 2017, we reported that the NCCIC had taken steps to perform  each of its 11 statutorily required cybersecurity functions, such as being a  federal civilian interface for sharing cybersecurity-related information with  federal and nonfederal entities. However, we recommended nine  actions to DHS for enhancing the effectiveness and efficiency of the  NCCIC, including determining the applicability of the implementing  principles and establishing metrics and methods for evaluating  performance. DHS concurred with our recommendations and we will  monitor DHS’s progress toward addressing them.

Selected Private Sector Representatives Reported Threat Data as  Most Useful Risk Information  SCC representatives we spoke to from the three selected sectors cited  threat assessment data as generally the most useful risk information for  CI owners and operators. Each of these six representatives indicated that  threat information must be distributed rapidly to owners and operators in  order to maintain its value and utility. Three of the six representatives  reported that DHS generally provides threat information in a timely  manner. For example, SCC representatives from the nuclear sector told  us that timely threat information from DHS was helpful in clarifying  erroneous reports circulating about the terror attacks in Belgium being  aimed at nuclear sites in that region. According to these SCC  representatives, working with DHS to gather credible information in a  timely fashion was very valuable to their sector because it allowed owners  and operators within their sector to determine whether they needed to  implement certain protocols to ensure that they were not vulnerable to  similar attacks. The remaining three representatives told us that delays in  receiving threat information from DHS decreased the value of this  information. For example, one representative noted that he believes  DHS’s process for vetting threat information before it is shared with his  sector prevents the agency from disseminating valuable threat  information in a timely manner. Another representative shared an  example where the threats referenced in one of the products distributed  by DHS had already been identified and addressed. However, the sixth  representative emphasized that despite delays in receiving information  from DHS, government threat information is very credible and a major  resource often used by security managers proposing security upgrades to  their respective chief executive officers. This representative also  highlighted the significance of TSA’s adoption of industry-defined  intelligence priorities as directly supporting training and awareness  initiatives to create opportunities for prevention.

The NIPP establishes that the government is to provide the private sector  with access to timely and actionable information in response to  developing threats and crises. Similarly, the sector-specific plans from  each of three selected sectors emphasize reliance upon timely and  actionable threat information. For example, the 2015 Transportation  System’s sector-specific plan discusses the importance of an effective  and efficient process for receiving, analyzing, and disseminating pertinent  and timely threat information and states that effective protection or  response to a potential hazard relies on providing the stakeholders at  greatest risk with real-time or near real-time alerts of emerging or  breaking events.

According to one SCC representative, threat information is the one  element of risk that adds the most value because it allows owners and  operators to react immediately to improve their security posture to  mitigate the effects of any potential hazards. The representative added  that specific products like TSA-OI’s annual country-specific threat  assessments are particularly useful because a number of companies  within his sector have business interests outside the U.S. and these  reports help them stay abreast of potential threats abroad.

Three of the six SCC representatives we interviewed reported that  information regarding cybersecurity threats has become increasingly  important. One SCC representative from the Critical Manufacturing sector  stated that many of the security managers within his sector are physical  security experts who are now facing more and more questions related to  cybersecurity threats as a result of the cyber and physical security  convergence their companies are experiencing. Therefore, the Critical  Manufacturing sector worked with federal partners to increase access to  the NCCIC, FBI, and U.S. Secret Service for additional cybersecurity  support and also began promoting the sector’s awareness and use of the  NIST framework.

DHS Conducts Voluntary Physical and Cyber Vulnerability Assessments for CI

Infrastructure Survey Tool  The Infrastructure Survey Tool (IST) is one of  the Department of Homeland Security’s (DHS)  voluntary vulnerability assessment tools  available to Critical Infrastructure owners and  operators. It is a web-based security survey  conducted by a Protective Security Advisor in  coordination with facility owners and operators  to identify the overall security and resilience of  a facility. The survey contains more than 100  questions used to gather information on such  things as physical security, security forces,  security management, information sharing,  and protective measures. The IST results  inform owners and operators of potential  vulnerabilities facing their asset or system and  recommend measures to mitigate those  vulnerabilities. Facility owners access results  and preview the effects of proposed mitigation  measures through the interactive IST  Dashboard.

NPPD helps CI owners and operators develop capabilities to mitigate  vulnerabilities by conducting voluntary physical vulnerability assessments  primarily by using PSAs to conduct voluntary vulnerability assessments in  coordination with owners and operators. These assessments focus on  physical infrastructure and are generally asset-specific and conducted  during site visits at individual assets. They are used to identify security  vulnerabilities and identify potential risk mitigation strategies for owners  and operators to address over time. One tool PSAs use in conducting CI  assessments is the Infrastructure Survey Tool to assess facilities that  agree to voluntarily participate. According to NPPD officials, vulnerability  assessments take longer to develop than threat assessments, and the  vulnerabilities identified are typically more static than threats, which are  constantly evolving. PSAs store the collected assessment data on DHS’s  Infrastructure Protection Gateway, an information sharing platform  intended for use by DHS and its homeland security partners, including CI  owners and operators, for access to infrastructure protection tools and  information in support of incident preparedness and response efforts.  Table 2 in appendix I summarizes the physical vulnerability assessments  DHS conducts for the three selected sectors.

In September 2014, we reported that the vulnerability assessment tools  and methods that different DHS offices and components used varied with  respect to the areas of vulnerability assessed. For example, we found  that while all of the assessment tools we reviewed considered perimeter  security, approximately half of these tools (6 of 10) included an  assessment of cybersecurity. We also found that DHS had not  established guidance on what areas should be included in a vulnerability  assessment. We recommended, among other things, that DHS review its  vulnerability assessments to identify the most important areas of  vulnerability to be assessed, and establish guidance. DHS agreed with  our recommendation and in July 2016 reported that IP had taken steps to  collect and evaluate information on the various vulnerability assessment  tools and methods used by DHS offices and components. More  specifically, IP identified six security areas to incorporate into DHS  assessment tools and methods. DHS reported in August 2016 that DHS  offices and components received guidance for the areas and the specified  levels of detail to be incorporated into existing assessment tools.

As a result of addressing this recommendation, we believe that DHS is  better positioned to collect and analyze assessment data to enable  comparisons and determine priorities between and across CI sectors.  DHS is also taking additional steps to address related recommendations  from our September 2014 report that remain open. For example, we  recommended that DHS develop and implement ways it can facilitate  data sharing and coordination of vulnerability assessments to minimize  the risk of potential duplication or gaps in coverage. As of September  2017, in response to this recommendation, DHS officials reported they  were coordinating with stakeholders and developing features in an online  portal to better facilitate information vulnerability assessment data  sharing. We will continue to monitor the status of DHS’s efforts to address  these recommendations.

In addition, in July 2017, DHS officials reported that they were finalizing a  strategy intended to identify ways that vulnerability assessment data can  be used by not only CI owners and operators but DHS and other  government stakeholders to improve their own decision-making.  According to these officials, DHS held workshops with over 120  stakeholders from NPPD as well as senior officials from other designated  sector-specific agencies and federal departments who identified the need  for DHS to provide more vulnerability assessment data related to lifeline  facilities—such as water and wastewater treatment plants and train  stations. They also noted that stakeholders recommended that DHS use  the vulnerability assessment data it collects to conduct trend analysis in  specific CI sectors and geographic regions.

The Cyber Resilience Review   The Cyber Resilience Review is one of the  Department of Homeland Security’s (DHS)  cyber vulnerability assessments available to  critical infrastructure owners and operators. It  is a voluntary, nontechnical assessment to  evaluate an organization’s operational  resilience and cybersecurity practices. It may  be conducted as a self-assessment or as an  on-site assessment facilitated by DHS  cybersecurity Cyber Security Advisors. It  assesses enterprise programs and practices  across 10 domains: asset management,  controls management, configuration and  change management, vulnerability  management, incident management, service  continuity management, risk management,  external dependency management, training  and awareness, and situational awareness.

DHS Offers Voluntary Cyber Vulnerability Assessments for CI  Owners and Operators  The Office of Cybersecurity and Communications (CS&C) offers CI  owners and operators a suite of voluntary vulnerability assessments  aimed at securing their cyber systems. For example, CS&C’s Industrial  Control Systems Cyber Emergency Response Team (ICS-CERT) is  responsible for taking steps to help mitigate vulnerabilities to computer- based systems that are used to monitor and control industrial processes.  CS&C also maintains the National Cybersecurity Assessment and  Technical Services team which offers cybersecurity scanning and testing  services that identify vulnerabilities within stakeholder networks and  provides risk analysis and remediation recommendations. The CSA  program also provides cyber assessment services for CI owners and  operators through on-site vulnerability assessments for cyber systems.  CSAs offer the Cyber Infrastructure Survey Tool, an assessment of  essential cybersecurity practices instituted by critical infrastructure  organizations to protect their critical IT services as well as the Cyber  Resilience Review which evaluates an organization’s operational  resilience and cybersecurity practices. A summary of DHS’s critical  infrastructure cyber vulnerability assessment efforts can be found in table  3 in appendix I.

Selected Private Sector Representatives View Asset-Specific  Vulnerability Assessments As Useful  Sector Coordinating Council representatives from two of the three  selected sectors stated that DHS’s vulnerability assessment efforts were  useful for determining vulnerabilities for individual CI owners and  operators, but their opinions varied concerning the usefulness of  aggregating sector-wide data and sharing broadly among private sector  stakeholders. For example, one SCC representative told us that the risk  scores associated with individual vulnerability assessments are of value  to the CI owners and operators of the infrastructure for which that  assessment was administered. However, this representative also  mentioned that these scores have limited value beyond the individual  asset because risks differ greatly between companies, rendering sector- wide or regional vulnerability assessments less useful. Another SCC  representative told us that because the membership of their respective  sectors is so broad and diverse, it is difficult for members to discern the  value of high-level aggregated vulnerability data––especially from  organizations with very different business models. However, another SCC  representative indicated that DHS could offer aggregated vulnerability  assessment data to all CI stakeholders for the purpose of developing  broader situational awareness.

DHS Conducts Consequence Assessments as Part of Its Infrastructure Survey Tool

While DHS’s IST is used to assess vulnerabilities for CI, the tool also  includes a consequence module intended to allow DHS to assess facility  criticality in terms of potential loss of life and economic impact. Also,  OCIA analyzes consequence from incidents, and models past events to  better understand the effect of these disruptions on assets and predict  consequences of future events. Table 4 in appendix I describes the DHS  components and corresponding products and activities associated with  consequence assessments.

DHS officials we spoke with stated that consequence information is  important to owners and operators. These officials added that DHS needs  to demonstrate that potential losses can be avoided by owners’ and  operators’ investment in risk mitigation, thereby reducing the overall  consequence of a potential incident on the CI owner’s operations and the  nation. Three of the six SCC representatives we interviewed shared that  consequence information was not useful. For example, one SCC  representative noted that consequence information is not very useful for  owners and operators because timely threat information combined with  knowledge of an asset’s vulnerabilities put owners and operators in a  better position to mitigate potential incidents and, subsequently, any  associated consequences. DHS officials acknowledged that a range of  perspectives concerning the usefulness of consequence information  exists and stated that these differences reflect the array of owner and  operator views about how to use risk information for different risk  management decisions.

DHS Conducts Complete Risk Assessments for CI Sectors on a Limited Basis

Within DHS, NPPD, TSA, and the Coast Guard are responsible for  developing complete risk assessments, which can be conducted for an  entire CI sector or multiple sub-sectors within a CI sector. Both TSA and  the Coast Guard regularly conduct complete risk assessments within the  Transportation Systems sector. However, according to a senior OCIA  official, NPPD receives very few requests for complete risk assessments.  Our review of available assessment documentation found that among our  three selected sectors, DHS has conducted complete risk assessments  for the Transportation Systems sector but not the other two sectors. For  example, the Transportation Systems Sector Security Risk Assessment is  TSA’s annual report to Congress on transportation security. It assesses  risk by establishing risk scores for various attack scenarios within the  sector, including for domestic aviation; examines risks to individual  transportation modes; and compares them to risks within and across  modes. Table 6 in appendix III describes the assessment in more detail.

Also within the Transportation Systems sector, the Coast Guard’s  Maritime Security Risk Analysis Model (MSRAM) serves as the primary  tool for assessing and managing security risks for all of the vessels,  barges, and facilities regulated by the Coast Guard under the Maritime  Transportation Security Act of 2002. Since its development and  implementation in 2005, MSRAM has provided the Coast Guard with a  standardized way of assessing risk to maritime infrastructure, referred to  in the analysis model as targets that can include chemical facilities, oil  refineries, hazardous cargo vessels, passenger ferries, and cruise ship  terminals. For example, a scenario related to cruise ships identified using  this analysis model could include a boat bomb or an attack by a hijacked  vessel. MSRAM is designed to allow comparison between different  targets at the local, regional, and national levels with the goal of reducing  risk by prioritizing security activities and resources.

To prioritize and assess security risks at U.S. ports and facilities, the  Coast Guard uses MSRAM to calculate risk using threat judgments  provided by the Coast Guard Intelligence Coordination Center. The  Center provides threat probabilities for MSRAM based upon judgments  regarding specific intent, capability, and geographic preference of terrorist  organizations to deliver an attack on a specific type of maritime target  class—for example, a boat bomb attack on a ferry terminal. To make  these judgments, Center officials use intelligence reports generated  throughout the broader intelligence community to make qualitative  determinations about certain terrorist organizations and the threat they  pose to the maritime domain. At the sector level, Coast Guard MSRAM  users are required to use the threat probabilities provided by the Center  to ensure that threat information is consistently applied across ports.

MSRAM users at the sector level also assess the vulnerability of targets  within their respective areas of responsibility and assess the  consequences of a successful attack on these targets. Vulnerability and  consequence factors included in the MSRAM assessment can be found in  table 7 in appendix III.

According to one NPPD official, various sector councils have requested  analysis of certain risk elements, such as vulnerabilities or consequences,  as opposed to complete risk assessments. For example, councils have  asked for analysis of vulnerabilities and consequences due to potential  failures within their sector’s respective systems and the potentially  cascading effects of these failures on systems beyond their own span of  control. This official noted that these requests provide the opportunity for  OCIA to develop analytic products that companies within these sectors  can then use as part of the risk assessments they conduct for  themselves, as well as analytic products more broadly related to  homeland security risks.

SCC representatives from our three selected sectors told us that  complete risk assessments are of limited utility for CI owners and  operators because complete assessments take a long time to produce,  often involve risk scenarios that are not likely to occur, or generates  results that are so broad that they may not be applicable to individual  assets. For example, according to one SCC representative, the diversity  among the members of his sector, including size and sophistication of  operations, is the primary reason that conducting a complete risk  assessment for their sector would not be helpful for individual companies.  Similarly, another SCC representative told us that the private sector does  not operationalize information from complete risk assessments because  the assessments do not add practical value and some of the scenarios  evaluated in the assessments are not applicable to many of the  companies within their sector.

TSA and NPPD officials provided explanations of the utility of complete  risk assessments, particularly for government decision-making purposes.  For example, TSA officials told us that they believe the Transportation  Systems Sector Security Risk Assessment data gathering methodology for identifying risk inputs adds the most value in the assessment process  for CI owners and operators in the Transportation Systems sector.  According to these officials, the data gathering process is extensive and  involves a substantial number of industry experts who are brought  together to analyze potential threats, vulnerabilities, and consequences  across the five transportation modes for which TSA is responsible. The  officials added that this elicited risk information allows TSA to better  allocate resources across the multiple transportation modes. According to  one senior OCIA official, NPPD is best suited to execute complete risk  assessments that are intended to focus on broad risks to CI and are not  specific to individual CI assets. For example, NPPD is providing risk  information for the execution of the 2018 Homeland Security National  Risk Characterization (HSNRC), which evaluates the full range of risks  addressed by DHS. This official stated that their office is working with  DHS’s Office of Policy to maximize the value of the insights gained from  the HSNRC effort and using it to inform NPPD decisions about strategy  and policy.

DHS Uses CI Risk Information to Inform Strategic Planning and Guide Outreach to Owners and Operators

DHS uses CI risk information in multiple ways, including informing  strategic planning and developing analytic products, and at the  component level to guide its day-to-day owner and operator outreach and  incident response. DHS is also facilitating risk-based cross-sector  planning and information sharing through sector coordinating councils.

DHS Uses CI Risk Information to Inform Its Strategic Planning and is Taking Actions to Improve Supporting Risk Analysis

According to DHS Office of Policy officials, DHS is using risk information  to inform departmental strategic planning as part of its third QHSR. The  QHSR is DHS’s process for updating the national homeland security  strategy, identifying critical homeland security missions, and assessing  the organizational alignment of DHS with the homeland security strategy  and missions. The results of the QHSR are used in DHS’s Strategic Plan,  which outlines how DHS plans to implement the QHSR homeland security  goals, lists strategies to achieve these goals, and identifies performance  measures to track progress towards these goals. The QHSR incorporates  multiple sources of risk information, including the HSNRC. The HSNRC  assesses natural hazards such as floods, and manmade hazards such as  terrorism. According to Office of Policy and NPPD officials, NPPD  provides a broad range of risk-related inputs to support the  implementation of the HSNRC risk assessment methodology. These  inputs provide DHS officials a better understanding of risks to CI during  strategic planning, according to Office of Policy officials.

Our prior work on DHS’s QHSR found that DHS assessed homeland  security risks for its second QHSR for fiscal years 2014 to 2018 by  considering threats, vulnerabilities, and consequences. We also found  that while the QHSR risk assessment described a wide range of  homeland security challenges and was a valuable step toward using risk  information to prioritize and select risk management activities, DHS did  not document how its various analyses were synthesized to generate  results, thus limiting the reproducibility and defensibility of the results. We  found that without sufficient documentation, the QHSR risk assessment  results could not easily be validated or the assumptions tested, hindering  DHS’s ability to improve future assessments. In addition, the QHSR  described homeland security hazards, but did not rank those hazards or  provide prioritized strategies to address them. We reported that  comparing and prioritizing risks helps identify where risk mitigation is  most needed and helps justify cost-effective risk management options.  Thus, we recommended that future QHSR risk assessment reflect key  elements of successful risk assessment methodologies, including being documented, reproducible, and defensible. We also recommended that  DHS refine its risk assessment methodology so that in future QHSRs it  can compare and prioritize homeland security risks and risk mitigation  strategies. DHS concurred with these recommendations and outlined  steps it planned to address them.

In response to our recommendations, DHS officials described several  steps they have taken to address our recommendations. According to  these officials, the Office of Policy held initial meetings with government  and nongovernment subject matter experts after the release of our report  to refine the HSNRC. Also, according to these officials, a Departmental  Risk Modeling and Analysis Steering Committee (Risk committee) was  convened in June 2016 to review and approve proposed new  methodologies to help identify and prioritize threats and hazards for the  HSNRC. According to NPPD officials, NPPD proposed updates to the  HSNRC process as part of the Risk committee proceedings, such as  changing the scope and detail of the assessment. The Risk committee  evaluated these requests and finalized proposals for use in the third  QHSR, which is scheduled to be released in 2018. We will continue to  monitor the status of DHS’s actions to address our recommendations and  how they are implemented.

DHS’s Office of Infrastructure Protection Uses CI Risk Information to Inform Outreach to Owners and Operators and Incident Response

According to IP officials, PSAs use risk information to guide their outreach  to CI owners and operators. PSAs use the National Critical Infrastructure  Prioritization Program (NCIPP) list––which prioritizes CI assets into  different levels according to their criticality––to inform their outreach to  owners and operators. PSAs and their leadership use the NCIPP list to  prioritize outreach to owners and operators across each level of assets  within their area of jurisdiction for participation in DHS’s voluntary security  survey and vulnerability assessment programs, as shown in figure 5.  Generally, PSAs engage CI owners and operators in the order in the  pyramid shown in figure 5, starting with Level 1.

According to IP officials, PSAs also use risk information to guide incident  response. The officials explained that when an incident occurs, they pull  information from a variety of sources, including the database of assets on  the NCIPP list, to identify CI in the affected area. OCIA officials then  prioritize this information into a list to guide incident response efforts. For example, when Hurricane Hermine approached Georgia in September  2016, PSAs received a list from OCIA that categorized potentially affected  CI assets in the region into priority levels. The PSAs used the list to  prioritize their outreach to the highest priority assets.

Officials from the CSA program, also plan to use risk information to guide  cybersecurity outreach to CI owners and operators. According to CS&C  officials, CSAs are currently able to meet resource demands for outreach  with little or no delay. However, as the CSA program continues to expand,  CSAs plan to use a risk-based methodology to prioritize outreach. This  methodology considers cyber threats, vulnerabilities, and consequences  to determine how and where CSAs are used, according to CS&C officials.

DHS SSA representatives for our three selected sectors also use risk  information to guide their outreach to CI owners and operators. For  example, in response to a physical threat to a nuclear facility in Brussels,  Belgium, nuclear sector SSA officials engaged with private sector  representatives on the SCC and discussed ways to improve their  information-sharing process. In another example, Critical Manufacturing  SSA officials determined that smaller businesses in their sector did not  have business continuity plans. According to these SSA officials, this  was a risk that could disrupt the operations of these small businesses and  other businesses in their supply chain. SSA officials developed a tool to  help Critical Manufacturing sector owners and operators develop their  own continuity plans––including templates, tabletop exercises, and a self- directed risk assessment for private sector owners and operators to use.  According to the Critical Manufacturing sector-specific plan, the expanded  use of business continuity planning will enhance the resilience of the  Critical Manufacturing Sector.

DHS Facilitates Sharing of Cross-Sector Risk Information through Coordinating Councils and Planning Documents

As part of DHS’s responsibility described in the NIPP, DHS created the  Critical Infrastructure Partnership Advisory Council (CIPAC), a forum for  stakeholders including government officials and asset owners and  operators, to facilitate planning and information sharing. CIPAC  membership consists of representatives from the government and sector  coordinating councils—federal, state, and local agency officials, and  private owners and operators, respectively—who work together to  coordinate strategies, activities, and policies across governmental entities  within each of the 16 CI sectors. There is also a Critical Infrastructure  Cross-Sector Council comprised of SCC chairs and vice chairs from each  of the 16 sectors that meets quarterly to discuss, among other things,  details about risks and opportunities to share information across sectors.  Additionally, this Critical Infrastructure Cross-Sector Council provides a  forum for the leaders of the SCCs to provide senior-level, cross-sector  strategic coordination with DHS. The chairperson of the cross-sector  council also communicates with owners and operators across the sectors  as situations arise. For example, the chairperson convened a  teleconference within 24 hours of a recent terror attack in the United  Kingdom to share information and answer questions about potential risks  or lessons learned for CI owners and operators.

In addition, DHS engages private sector owners and operators in cross- sector discussions through sector planning documents. For example, the  2015 sector-specific plans for each of the three sectors we studied  include descriptions of cross-sector interdependencies. These include  summaries of lifeline functions––such as energy, water, communications,  and transportation systems––which are essential to the operations of  most CI partners and communities. During development of the 2015  sector-specific plans the sectors and SSAs also collaborated and  identified emerging risks that spanned across multiple sectors, as shown  in figure 6.

We provided a draft of this product to DHS for review and comment. DHS  provided technical comments, which we incorporated as appropriate.  We  also provided draft excerpts of this product to the selected sector  coordinating council representatives we interviewed, who provided  technical comments that we also incorporated as appropriate.

We are sending copies of this report to interested congressional  committees and the Secretary of Homeland Security. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix V.

Appendix I: Selected Risk Information Products and Activities Distributed by the Department of Homeland Security

The following tables highlight threat, vulnerability and consequence  products and activities developed by the Department of Homeland  Security for the purpose of providing risk information to critical  infrastructure owners and operators.

Appendix II: NCCIC Cybersecurity Products and Services

Table 5 below highlights the cybersecurity products and services that the  National Cybersecurity and Communications Integration Center (NCCIC)  reported providing to its customers in fiscal years 2015 and 2016.

Appendix III: Summary of Department of Homeland Security Complete Risk Assessments for Critical Infrastructure

The following tables highlight complete risk assessments regularly  conducted by the Transportation Security Administration and the U.S.  Coast Guard within the Transportation Systems sector.

Appendix IV: National Critical Infrastructure Prioritization Program Consequence-Based Criteria and Relative Thresholds

Figure 7 below illustrates the Department of Homeland Security’s (DHS)  approach for prioritizing the list of systems and assets that the Secretary  of Homeland Security determines would, if destroyed or disrupted, cause  national or regional catastrophic effects. DHS has prioritized these CI  assets into different levels according to their criticality, to inform their  outreach to owners and operators. Consistent with the National  Infrastructure Protection Plan risk management framework, the criteria for  determining which level each asset is assigned to on the National Critical  Infrastructure Prioritization Program (NCIPP) list are entirely  consequence based thresholds and include fatalities, economic loss,  mass evacuation length, or national security impacts.

Appendix VI: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Ben Atwater (Assistant Director)  and Landis Lindsey (Analyst-in-Charge) managed this audit engagement.  Chuck Bausell, Michele Fejfar, Daniel Glickstein, Tracey King, Steve  Komadina, Tom Lombardi, Kush Malhotra, Gabrielle Matuzsan, and  Claire Peachey made significant contributions to this report.