Constructing a resilience index for the Enhanced Critical Infrastructure Protection Program

Following recommendations made in Homeland Security Presidential Directive 7, which established a national policy for the identification and increased protection of critical infrastructure and key resources (CIKR) by Federal departments and agencies, the U.S. Department of Homeland Security (DHS) in 2006 developed the Enhanced Critical Infrastructure Protection (ECIP) program. The ECIP program aimed to provide a closer partnership with state, regional, territorial, local, and tribal authorities in fulfilling the national objective to improve CIKR protection. The program was specifically designed to identify protective measures currently in place in CIKR and to inform facility owners/operators of the benefits of new protective measures. The ECIP program also sought to enhance existing relationships between DHS and owners/operators of CIKR and to build relationships where none existed (DHS 2008; DHS 2009). In 2009, DHS and its protective security advisors (PSAs) began assessing CIKR assets using the ECIP program and ultimately produced individual protective measure and vulnerability values through the protective measure and vulnerability indices (PMI/VI). The PMI/VI assess the protective measures posture of individual facilities at their 'weakest link,' allowing for a detailed analysis of the most vulnerable aspects of the facilities (Schneier 2003), while maintaining the ability to produce an overall protective measures picture. The PMI has six main components (physical security, security management, security force, information sharing, protective measures assessments, and dependencies) and focuses on actions taken by a facility to prevent or deter the occurrence of an incident (Argonne National Laboratory 2009). As CIKR continue to be assessed using the PMI/VI and owners/operators better understand how they can prevent or deter incidents, academic research, practitioner emphasis, and public policy formation have increasingly focused on resilience as a necessary component of the risk management framework and infrastructure protection. This shift in focus toward resilience complements the analysis of protective measures by taking into account the three other phases of risk management: mitigation, response, and recovery (Figure 1). Thus, the addition of a robust resilience index (RI) to the established PMI/VI provides vital information to owners/operators throughout the risk management process. Combining a pre-incident focus with a better understanding of resilience, as well as potential consequences from damaged CIKR, allows owners/operators to better understand different ways to decrease risk by (1) increasing physical security measures to prevent an incident, (2) supplementing redundancy to mitigate the effects of an incident, and (3) enhancing emergency action and business continuity planning to increase the effectiveness of recovery procedures. Information provided by the RI methodology is also used by facility owners/operators to better understand how their facilities compare to similar sector/subsector sites and to help them make risk-based decisions. This report provides an overview of the RI methodology developed to estimate resilience and provide resilience comparisons for sectors and subsectors. The information will be used to (1) assist DHS in analyzing existing response and recovery methods and programs at facilities and (2) identify potential ways to increase resilience. The RI methodology is based on principles of Appreciative Inquiry, which is 'the coevolutionary search for the best in people, their organizations, and the relevant world around them' (Cooperrider et al. 2005). Appreciative Inquiry identifies the best of 'what is' and helps to envision 'what might be.' The ECIP program and the RI represent a new model (using Appreciative Inquiry principles) for information sharing between government and industry (Fisher and Petit 2010). A 'dashboard' display, which provides an interactive tool - rather than a static report, presents the results of the RI in a convenient format. Additional resilience measures can be modeled to illustrate how such actions would impact the asset's RI value.