Frédéric Petit

Developing an index to assess the resilience of critical infrastructure

In 2009, the US Department of Homeland Security (DHS) began using a targeted questionnaire to produce individual vulnerability/ protective-measure values for high-risk critical infrastructures and key resources. As sites continue to be assessed, the topic of resilience is emerging as a necessary focus in risk management and infrastructure protection. Enhancing the resilience of critical infrastructures requires determining the ability of systems to withstand specific threats and return to normal operations after degradation. Thus, comprehensive consideration of all parts of infrastructure systems, from threats to consequences, is needed. The methodology must generate reproducible results that can support decision-making in risk management, disaster response, and business continuity. Argonne National Laboratory, in collaboration with the DHS Protective Security Coordination Division, has developed a comprehensive methodology that uses uniform and consistent data to develop a resilience index (RI). Using the RI to compare similar facilities can provide vital benefits to owners/operators as well as DHS.

Protective measures and vulnerability indices for the Enhanced Critical Infrastructure Protection Programme

Argonne National Laboratory in partnership with the US Department of Homeland Security (DHS) has developed a methodology to systematically evaluate the protection posture and vulnerability of critical infrastructure and key resources (CIKR). This vulnerability methodology is part of a larger effort by DHS called the Enhanced Critical Infrastructure Protection Programme, which seeks to mitigate vulnerabilities, enhance relationships, and improve information sharing between public and private entities. This methodology was constructed to be used in all CIKR sectors and to provide useful results to owners and operators of US facilities. The vulnerability index is also being used to assist DHS in analysing sector and subsector vulnerabilities, to identify potential ways to reduce vulnerabilities, and to assist in preparing sector risk estimates. The owner/operator also receives an analysis of the data collected for a specific asset, which gives an indication of the assets strengths and weaknesses with regard to security.

Critical Infrastructure Protection and Resilience—Integrating Interdependencies

Throughout the world, there is strong recognition that critical infrastructure security and resilience need to be improved. Enhancing the protection and resilience of critical infrastructure has emerged as an urgent goal—a goal made more challenging by the complexity of these systems and their inherent interdependencies. Consideration of critical infrastructure interdependencies, as well as their integration into risk management and business continuity processes, is an important element of U.S Presidential Policy Directive 21 on Critical Infrastructure Security and Resilience (PPD–21), the Canada-United States Action Plan for Critical Infrastructure, and the European Program for Critical Infrastructure Protection. Several international standards also require the consideration of interdependencies between organizations and the effect on their risk management and business continuity practices. All of these documents, from the strategic level through the operational standards, involve the consideration of interdependencies that can exist among infrastructure, how they are managed, and how they affect business continuity, security, and resilience management. A “system of systems” approach can help establish the appropriate scope of an interdependency analysis, as well as the specific assets and/or subsystems for which resilience-related information should be collected.