IOWA CRITICAL INFRASTRUCTURE PROTECTION PLAN

Reviews

Tags

IOWA CRITICAL INFRASTRUCTURE PROTECTION ..., Homeland Security, asset protection, State of Iowa, critical infrastructure protection, Protection Program, critical infrastructure, Infrastructure Protection, Critical Asset, DoD support

Stats

views:: 7
rating:: not rated
reviews:: 0
posted:: 7/14/2009
language:: English
pages:: 0

Public Domain

2009 IOWA CRITICAL INFRASTRUCTURE PROTECTION PLAN Iowa Homeland Security and Emergency Management March 2009 2 | P a g e TABLE OF CONTENTS Introduction ………………………………………………………………………………………………………………….. 4 Executive Summary……………………………………………………………………………………………………….. 5 History of the CAPP……………………………………………………………………………………………………….. 6 Current Capabilities……………………………………………………………………………………………………….. 10 Infrastructure Protection……………………………………………………………………………………………….. 15 Critical Asset Protection Plan…………………………………………………………………………………………. 19 Goals and Objectives……………………………………………………………………………………………………… 22 Evaluation………………………………………………………………………………………………………………………. 27 Acronyms Guide …………………………………………………………………………………………………………….. 28 Appendix A – CI/KR Database Schematic………………………………………………………………………… 29 Appendix B – Risk Management Framework…………………………………………………………………… 30 Resources………………..……………………………………………………………………………………………………… 32 March 2009 3 | P a g e INTRODUCTION The terrorist attacks of September 11th, 2001 fundamentally altered our definitions for what “security” means in the 21st century. Immediately following these attacks, Iowa began to take a comprehensive look at many areas related to what would soon be termed “homeland security”. Iowa has been proactively working to protect the critical infrastructure and interdependencies between systems that Iowa’s citizens so heavily rely on. This plan hinges on a bi‐lateral information flow to provide a unified front for the protection of Iowa’s citizens and its critical infrastructure/key resources (CI/KR). This information flow must include all levels of government agencies as well as our private sector partners according to their priority information needs. The integration of Iowa’s homeland security critical infrastructure protection efforts under the umbrella of the state mitigation efforts will enhance Iowa’s preparedness for any hazard and improve Iowa’s readiness posture. March 2009 4 | P a g e EXECUTIVE SUMMARY The Iowa Critical Infrastructure Protection Plan provides a road map for the implementation of Iowa’s critical sector and asset security program. The plan is broken into the sections that detail the different aspects of this plan. • The “History of the Critical Asset Protection Plan (CAPP)” section details critical asset protection efforts to date, including the first iteration of the CAPP plan published in 2004. The Infrastructure Protection section details the work we’ve done in that area, including the 17 Infrastructure Protection/Key Resource sectors and how they function. Goals and Objectives provide a specific roadmap for the implementation of the next iteration of the Critical Infrastructure Protection Plan (CIP). Iowa has put forth a significant amount of effort towards the development of an Information Sharing Strategy based partly upon the National Information Sharing Strategy released in October 2007. The Evaluation section provides information on the tracking of progress and review and revision schedules. • • • • March 2009 5 | P a g e HISTORY OF THE CRITICAL ASSEST PROTECTION PLAN (CAPP) The catalyst for the original production of Iowa’s CAPP was a directive from Governor Vilsack immediately following the events of September 11, 2001. The ultimate goal of this directive was to determine what critical assets or potential targets existed in the State at that time. In order to carry out this directive, a task force was formed. This task force was comprised of individuals from federal, state and local government entities as well as private sector partners. The recommendations that came forth from this task force founded the CAPP as we know it today. The creation of the National Infrastructure Protection Program (NIPP) validated many of the initiatives that the State of Iowa has been working on for the past few years. In late 2001, Iowa created the CAPP that identified a list of approximately 11,600 assets. The development of this process was a major step forward in the asset protection program for the State. Each asset was scored and ranked using a tool developed by subject matter experts in Iowa called the Critical Asset Assessment Model (CAAM). The initial methodology used to identify the assets deemed “critical” in Iowa involved basic information on areas of criticality and vulnerability that was available at the time. The assets were scored based on these criteria and protection efforts were focused on the 1,000 assets that received the highest CAAM scores. Over the next three years, the list and the CAAM tool were refined and this improved criteria allowed us to streamline the 11,000 assets to approximately 1,500. Iowa also created an interactive geographic information system (GIS) tool that could be manipulated for a wide range of potential scenarios. The GIS tool is a web based application that contains basic asset information such as name, location, critical asset/key resource sector and sub‐sector information, etc. This allows the user to identify sites based on a number of varying fields for use with response agencies, emergency operations centers, planning cells and others. A significant paradigm shift in the critical asset protection program was the evolution to an all hazards approach to threats as opposed to the terrorism viewpoint. This look at outside threat, coupled with at attempt to look at prioritization of assets based on criticality to continuity of operations and continuity of government has allowed us to restructure how we look at critical infrastructure within the state and at bordering state assets as well. With the release of the NIPP, Iowa created the Threat Integration and Infrastructure Protection Program (TIIPP) office in October of 2006. This office is housed with Iowa Homeland Security and Emergency Management Division (HSEMD) of the Iowa Department of Public Defense. March 2009 6 | P a g e There are three main components within the TIIPP: Information Sharing, Critical Infrastructure Protection and Critical Asset Protection. Each of these positions maintains individual but overlapping responsibilities. The Information Sharing component lies with a Homeland Security Specialist. The responsibilities of this position include coordination with the fusion system and sharing of information as it pertains to the critical infrastructure and key resource sectors identified in Iowa. This includes the development of an information sharing process with private sector partners, as well as public sector homeland security partners. The Asset Protection Planner (APP) focuses primarily on the protection of individual assets within the State of Iowa. In addition to interfacing with the assets themselves and providing technical assistance on protective measures and vulnerability assessments, the APP administers the Buffer Zone Protection Program (BZPP) for sites in Iowa. The APP is also responsible for the implementation of the Automated Critical Asset Management System (ACAMS) as it will be used in Iowa. This system is critical in the identification, assessment and prioritization of assets in Iowa. The Infrastructure Protection Planner (IPP) focuses on the protection of infrastructure as a whole, as opposed to focusing on individual assets. This position works in conjunction with the Critical Asset Protection Planner in the identification, assessment and prioritization of those assets in Iowa identified as priority or critical. Just as the federal Department of Homeland Security released the 17 critical infrastructure/key resource sectors (CI/KR), Iowa is also working with 17 CI/KR sectors for the purpose of infrastructure protection. The seventeen sectors in Iowa vary slightly from the federal sectors by including specific sectors for education and community organizations. This is designed to be scalable so that it can be adjusted based upon further input from security partners and adaptable to updated threat information. The Department of Homeland Security (DHS) has released the sector specific plans for its identified sectors. Using these as a foundation, each of the identified sectors in Iowa is currently in the process of developing a work group that brings together subject matter experts from State and local governments as well as the private sector to make the plans more specific to the State of Iowa and make them a functional part of our homeland security strategy. Many of these sectors have established workgroups. Iowa’s most active sector workgroups include Transportation, Chemical, Water, Banking and Finance, Education, Energy, and Agriculture. These work groups are in the process of reviewing the federal plans and modifying the portions that can apply to the processes in our state. March 2009 7 | P a g e As Iowa began to move forward with the refinement and restructure of the CAPP, it was recognized that the assessment tool that had been used in the development would have to be revisited in order to keep the list accurate. After reviewing multiple site profiling tools, ACAMS was chosen for use with the CAPP. This system includes information received from the site manager or owner and involves the use of local responder agencies as well as subject matter experts as part of the assessment teams. The system creates multiple reports that can be used for planning purposes, including buffer zone protection plans and recommended action plans. DHS and the State of Iowa have identified ACAMS as a priority tool for infrastructure and asset protection efforts throughout Iowa and the United States. The initiatives identified in the NIPP require the involvement of the private sector partners. During 2006, Iowa Homeland Security and Emergency Management began work with the Business Executives for National Security (BENS), the Iowa Business Council, Iowa Department of Public Health and the Iowa Department of Public Safety to form a public/private sector partnership to address homeland security needs within the State by utilizing the skill sets and assets offered by the private sector in a public response effort. The Safeguard Iowa Partnership (SIP) was the result of this combined effort. SIP has been an opportunity to build upon existing relationships between state agencies, local governments, private sector partners such as the Iowa Contingency Planners, the Association of Business and Industry, the Iowa business Council and other partners. SIP’s operating council currently maintains membership from well over 50 companies and agencies statewide. This includes many of the state’s largest employers, small businesses, HSEMD, the Iowa Departments of Public Health and Public Safety, the Iowa Board of Regents, local emergency management, and local law enforcement. Membership in this organization continues to grow on a weekly basis. The operating council decided on four initiatives on which to build during 2007: • • • • Enhance Public Heath/private sector relationships and the development of a communications network for the public and private sectors Establish a seat for private sector partners in the State Emergency Operations Center (SEOC) during disaster situations Develop a resource registry for private sector assets available during a disaster Outreach and expand Safeguard Iowa. This partnership has been a key conduit for the exchange of information and the identification/availability of private sector assets. SIP has engaged in continual process improvement, and updates its strategic goals and objectives on an annual basis. March 2009 8 | P a g e Funding provided by the Homeland Security Grant Program (HSGP) has allowed Iowa to sub‐ grant money to each of its six Homeland Security Regions and Law Enforcement Intelligence Networks (LEIN) for the purpose of implementing the NIPP at the local level. These regions have been given the opportunity to spend funding including the areas of asset identification, asset assessment, asset prioritization, development of public/private relationships, and planning. Funding could also be spent in the area of asset hardening if it resulted from the appropriate NIPP implementation area. Future regional efforts regarding CI/KR may be limited if funding continues its steady decline. Additionally, the Buffer Zone Protection Program (BZPP) has provided funding for identified sites to complete a protection plan and purchase necessary equipment to improve security. Funding has been provided to various sites in Iowa since 2005. Buffer Zone Protection is a fundamental part of any on‐going CI/KR process and will be continued within the program titled “Buffer Zone Protection” as well as with our current efforts outside the Federal program addressing a limited number of sites. Iowa has also been proactive in the area of multi‐state regional collaboration to address infrastructure protection issues, including the completion of a Tri‐State Critical Infrastructure Protection Summit during late 2006 and State of Iowa Infrastructure Protection Summits which were held during the summer of 2007 and spring of 2008. These summits allowed for networking and information exchange with surrounding states. Participants included representation from federal, state, and local governments involved with protection of CI/KR. Additionally, multi‐state Department of Transportation summits were held during 2005‐2008. These summits brought together multiple representatives from surrounding states to discuss homeland security issues relating to transportation. Those present were also able to present ideas on how funding could most effectively be used. Continued networking and collaboration opportunities will be a part of future planning efforts. March 2009 9 | P a g e CURRENT CAPABILITIES The current capabilities in Iowa include, but are not limited to, the following areas: Public/Private Partnerships. Iowa HSEMD has established solid relationships with other private sector organizations that maintain an interest in homeland security issues. These groups include, but are not limited to, Safeguard Iowa Partnership, Iowa Contingency Planners, Iowa Business Council, Association of Business and Industry and American Society of Industrial Security, Infragard and its sister organizations of Transgard and Ag‐gard, the newly developed banking and finance chapter of Infragard and those key resource/critical infrastructure partners involved in the development of state sector specific plans. Within SIP, as described in the history of the CAPP, several developments have been completed and are in place. These include: • • • • A prototype of the Business Resource Registry has been developed to store the business resources using a secure website. Resolution of legal issues regarding the use of private sector assets during emergencies have been reviewed and identified. A training plan for private‐sector representatives working in the State Emergency Operations Center has been developed in coordination with HSEMD. Sector Leads and key Homeland Security partners have access to the Health Alert Network (HAN) and the Homeland Security Information Network (HSIN) – the identified notification and information sharing systems for public and private partners. 10 private sector volunteers have been recruited to serve on the Logistical Support Response Team. Private sector partners have participated in state exercises and have been involved in response to multiple disasters. Developed outreach materials on public/private partnerships including but not limited to brochure, web site, partnership packet and PowerPoint presentation. Training program on a regional basis in support of CI/KR efforts. • • • • The Asset Database. The Iowa Asset Database (IAD) is currently housed within ACAMS. The IAD maintains a list of identified assets in the state of Iowa. This list is currently in need of update but serves as a foundation on which we can build as we move forward with our identified asset profiling system. The current IAD maintains a list of approximately 1,500 assets. March 2009 10 | P a g e Tier I and Tier II data as received from the Department of Homeland Security. DHS has provided states with an opportunity to view those assets deemed critical by the federal government. These assets are identified by Sector Coordinating Councils (SCCs) using specific criteria as identified by each sector’s Sector Specific Agency (SSA). This makes the federally identified Tier I and Tier II facilities much different than those identified in the state’s initial CAPP. Tier I and Tier II data is used as a significant portion of the formula for distribution of Homeland Security funding. The Automated Critical Asset Management System. As previously described, this is the profiling tool that has been chosen for use with the Critical asset protection program in Iowa as well as the critical infrastructure protection program. A cooperative alliance has been formed with the LEIN regions in Iowa for the implementation of this tool and the completion of input into the system. At this time, 37 persons have been trained to use the ACAMS tool. This training also included the Protected Critical Infrastructure Information (PCII) Act and how information that is placed into the ACAMS tool will be protected. The implementation procedures are currently being developed and two personnel from the State of Iowa have completed the train‐the‐trainer program for ACAMS. This system will allow a consistent method for identification, assessment and prioritization of Iowa’s assets that is necessary for proper planning to take place in order to protect Iowa’s assets. Iowa recognizes that there are other systems being utilized by DHS, many of which are specific to certain sectors. These include the Chemical Facilities Anti‐Terrorism Standards Act (CFATS) and Food and Agriculture Sector Criticality Assessment Tool (FASCAT). Though these systems are currently in various stages of development, they are not uniform to the asset protection program. State and Federal Methods for Protection of Information ‐ It was immediately recognized that as information is collected from, or voluntarily submitted by, our public and private sector partners as it pertains to vulnerabilities or risks, it had to be protected. Iowa Administrative Code 22.7 addresses the protection of information in the State of Iowa. Specifically, paragraph 46 provides for the protection of the “critical asset protection plan or any part of the plan prepared pursuant to section 29C.8 and any information held by the emergency management division that was supplied to the division by a public or private agency or aorganisation and used in the development of the critical asset protection plan”. The protections provided in this portion of Iowa Code and those protections provided with PCII as discussed in the previous section will continued to be monitored for necessary adaptations as the program develops. March 2009 11 | P a g e Homeland Security Information Network (HSIN) – HSIN will be used as a backbone for Iowa’s communication with its sector CI/KR partners. This system has been promoted since 2006 in Iowa, and HSEMD has taken the lead in the development of the Iowa Emergency Management, Iowa Homeland Security, SIP, Iowa Law Enforcement and Iowa Mutual Aid Compact portals within the federal HSIN. These sites are used for posting and sharing of information within the various communities. The Iowa Health Alert Network (HAN) – The Iowa HAN is a system that is managed by the Iowa Department of Public Health. This system functions as an alert network for a variety of emergency response agencies statewide and also as an information exchange mechanism for Iowa Department of Public Health. For purposes of the NIPP, the HAN is used for alert notification through HSEMD. This system provides basic information to the critical infrastructure/key resource sector leads, Law enforcement partners, Emergency Management partners and others to provide basic information of a real time event and where additional information on the event can be located. This system is used in conjunction with HSIN as an information sharing tool. Fusion Alert System ‐ Local Law Enforcement, as well as County Emergency Management, will be assisting in coordinating the setup and use of the Fusion Alerting System. The alerting system will utilize your cellular phone text messaging as well as regular e‐mail. Law Enforcement, as well as public safety, will also be approached to be involved with the system. While the system is utilized for prevention of domestic and international terrorism, it will also serve additional purposes for alerting in times of emergency, major crime, and disaster preparedness. The Fusion Alerting System currently has over eighteen hundred (1,800) contacts that are entered into the system. This connectivity between Law Enforcement and the Public and Private Shareholders will be utilized in the future to keep the information sharing strong between all parties. Secure Communications Systems – It was recognized early on that not all information could be shared with all partners. In fact, some of the information that we would be receiving and sharing with the Homeland Security Advisor, the Governor’s office, and other agencies with a right or a need to know would be law enforcement sensitive or classified as Secret by federal partners. In order to effectively use this information, a secure room as created within the State Emergency Operations Center. Several secure communications techniques are available for use in the secure room including a secure telecommunications unit (STU), secure facsimile , as well as a secure method for video telecommunications. At this time, Iowa also uses the Homeland March 2009 12 | P a g e Security Information System – Secret (HSIN‐S) for secure e‐mail and has available through the Iowa Army National Guard SIPRNET. DHS Sector Taxonomy ‐ Since DHS must interface with a wide range of infrastructure operators; commercial and industrial owners; and federal, state, and local agencies, it was important to adopt a taxonomy (or structure) that will facilitate effective communication. The federal Sector Taxonomy was designed to categorize various infrastructure elements and defines the mutually exclusive categories to outline all infrastructure types within a given sector. Iowa used the federal taxonomy in the development of its CI/KR sectors. Sector Planning Workgroups – As previously mentioned in the historical information, sector workgroups have been developed for the purpose of developing sector specific plans for the 17 identified CI/KR sites in Iowa. These groups will be using the federal Sector Specific Plans as a foundation for the Iowa plans to build upon. Currently, workgroups have been established for six sectors with the remaining eleven. TIIPP Report – A weekly report has been created for sharing of open source information with Homeland Security colleagues and CI/KR partners. This information is collected from a variety of media and government sources and is shared not only on a statewide basis but has been requested from multiple states as a best practice. CI/KR Mapping Tool – As assets have been identified and asset information collected, it was quickly recognized that a mapping tool would be of great benefit during planning and real time disaster in order to quickly locate assets within the state and identify other potential issues created by an incident. HSEMD in cooperation with the Iowa State University Geographical Information System team, has developed a mapping analysis tool for this purpose. This interface allows users to query the CAPP database and select affected assets based upon a broad range of threat scenarios. Depending on the threat or incident, users can query sites using the three distinct inputs: Threat/incident by particular sector; threat/incident by specific organization’s facility or facilities; threat/incident tied to a specific location in Iowa. Future capabilities will include a networking feature that will allow homeland security partners to access information on a web‐based system. Integrated Common Analytical Viewer (ICAV) – ICAV is also an asset mapping tool that is currently being refined. This tool is currently included in the ACAM System for purposes of mapping of assets and analysis. Protective Security Advisor ‐ In 2004, Protective Security Advisors (PSAs) were deployed to provide a local perspective to the national risk picture and serve as DHS on‐site critical March 2009 13 | P a g e infrastructure and vulnerability assessment specialists, and as a vital channel of communication for private sector owners and operators of CI/KR. PSAs also serve as a communications conduit between DHS and the State, territorial, local, and tribal protective security community, to include providing information related to possible threats, protective security best practices, and other issues. When needed, PSAs act as the "on‐ scene" Office of Infrastructure Protection (OIP) representative within State and local emergency operations centers (EOCs) and support officials responsible for special events planning and exercises in their district. Risk Management Framework – The Risk Management Framework is used as the format for the federal sector specific plans. The steps described in the Framework are used as paragraphs in each sector specific plan and this process is also being used in the Iowa specific plans as well. The identification of risk includes the standard formula of threat X vulnerability X consequence. The view of threat by the federal government is almost solely based on identified foreign threat. The threat formula is also not shared with state or local agencies. This viewpoint causes great differences in the identified threats by the Iowa sector workgroups and the federal government’s SSAs. Fusion Advisory Committee – The Fusion Advisory Committee (FAC) was established during 2008 to bring together multiple agencies from federal, state and local government to discuss communication issues as related to CI/KR protection. This group will be utilized to provide advice to a variety of agencies focused on improving bi‐lateral communication between groups. State Funding – The State of Iowa has recognized the importance of critical infrastructure/key resource protection and has funded this initiative during the 2006‐2008 fiscal years. Each year approximately $300,000 of state resources has gone to the development of the TIIPP office and the implementation of the identified initiatives accomplished within the critical infrastructure protection realm. Funding has been used to strengthen capabilities in the areas of information sharing, asset protection and infrastructure protection. This funding has been used to enhance capabilities of not only the TIIPP office but responder agencies and intelligence and information networks statewide. This funding has been invaluable to ensure that CI/KR protection continues to progress while funding received from the Homeland Security Grant Program continues to decline. March 2009 14 | P a g e INFRASTRUCTURE PROTECTION DHS must interface with a wide range of infrastructure operators; commercial and industrial owners; and federal, state, and local agencies, it is important to adopt a taxonomy (or structure) that will facilitate effective communication and planning. In order to categorize various infrastructure elements, DHS and, in turn, HSEMD developed 17 infrastructure protection sectors (See Appendix A). To the extent possible, the terminology used in this taxonomy is representative of each industry. This taxonomy is not intended to provide any qualification or level of criticality or significance. The taxonomy defines the mutually exclusive categories to outline all infrastructure types within a given sector. In selecting a category or categories for a given asset, the general convention is that the most detailed category is used wherever possible. If there is insufficient information to identify an asset at the most detailed level, then a higher level may be used. Some infrastructure assets have several components that fall into different categories of the taxonomy. In these cases, more than one category can be assigned to an asset. The following chart depicts the identified CI/KR Sectors and the identified subsectors in Iowa. These sectors vary slightly from those identified by the federal SSAs. Iowa has recognized that education has a significant impact on the majority of citizens in a manner that is not typical of other government agencies. As a result, Education has been identified as a separate sector. This also holds true of Community Organizations such as Red Cross, Salvation Army, and faith March 2009 15 | P a g e based organizations. Though not identified in the federal taxonomy, they are often crucial during a crisis situation. Iowa’s identified sectors are as follows: AGRICULTURE • Crops • Animal • Food Processing • Food Distribution • Agriculture Inputs BANKING AND FINANCE • Banking and Credit • Securities/Commodities/Invest. • Insurance Carriers CHEMICAL • Chemical manufacturing • Hazardous Chem Transport • Hazardous Chem stockpile • Other Haz Chem Facilities COMMERCIAL FACILITIES • Retail Trade • Services Industry • Wholesale Trade • Manufacturing • Entertainment/Amusement DAMS • USACE Dams DEFENCE INDUSTRIAL • Private Facilities (contractors) • Public Facilities EMERGENCY SERVICES • Emergency Medical Services • Fire/HazMat • Specialized Teams • Law Enforcement March 2009 INFORMATION TECHNOLOGY/TELECOMM. • Wired Communication • Wireless Communication • Satellite Communication • Internet • Information Services • Regulatory Organizations EVENT VENUES AND ICONS • Stadiums and Arenas • Icons and Monuments • Other Event Venues EDUCATION • Preschools • K‐12 • Universities • Other Schools POSTAL AND SHIPPING • US Postal • Parcel Courier Services • Freight Delivery • Warehousing WATER • Public Water Supply • Water Waste Treatment Facilities PUBLIC HEALTH AND HEALTH CARE • Environmental Services • Health Care Services • Direct Patient Care • Labs and Pharmaceuticals • Public Health • End of Life 16 | P a g e • Emergency Management ENERGY • Electricity Production/Distribution • Pipelines and Storage • Nuclear • Other Energy/Ethanol/biodiesel GOVERNMENT • Local Government • State Government • Federal Government • Other Government COMMUNITY ORGANIZATIONS • Volunteer Organizations (i.e. Red Cross, Salvation Army) • Civic Groups • Citizens Emergency Response • Faith Based Organizations TRANSPORTATION • Highway • Rail including bridges • Air • Water including locks and dams • Intermodal Facilities By comparison, the federal sectors are slightly different as previously stated. The federal sectors are available in the NIPP and on the DHS website, www.dhs.gov . Assets may fit into one of more of the identified sector or subsector categories. Questions concerning how an asset fits into the taxonomy will be answered on a case by case basis by the infrastructure protection planner or the asset protection planner. In addition to critical infrastructure and key resource assets, the infrastructure protection planner is also involved with Special or Significant Events planning. Each year, Iowa responds to a data call from the DHS in order to identify events in Iowa that may rise to a level of national significance. Data is requested from multiple sources statewide including but not limited to: local emergency management agencies, local law enforcement, private sector event planner agencies, state Department of Public Safety, state Department of Public Health, identified event venue managers and the sector event venue and icon lead. Information that is received is reviewed and those items that may require additional resources or planner are submitted to the DHS. Events at that level are scored and, if appropriate, a federal liaison is assigned to the event. Identification of events of this type also allows pre‐event planning to take place and appropriate protective actions can be taken. Protective actions and protective measures have also been identified in the reaction to an elevated threat level in any of the CI/KR sectors. These have a direct correlation to the Homeland Security Advisory System and protective measures that have been released by the Homeland Infrastructure Threat & Risk Analysis Center (HITRAC). Protocols have been developed for the release of information on a “need to know” or “right to know” basis to those CI/KR partners in real time. Efforts are currently under March 2009 17 | P a g e way in this area to have an established flow of information through a fusion system that will allow a two‐way communication that has not been previously in place from the individual asset to the state fusion center or to other key stakeholders in order to provide timely information on protective actions that must be taken. Information provided by private sector partners and information that has vulnerability implications for both public and private sector partners has been afforded some protection in Iowa through state legislative efforts and the Protected Critical Infrastructure Information (PCII) Act of 2004. PCII includes information that is not customarily in the public domain and is related to the security, protected systems or related proprietary information. Iowa has become PCII accredited and will use PCII in conjunction with ACAMS. March 2009 18 | P a g e CRITICAL ASSET PROTECTION As Iowa began to move forward with the refinement and restructure of its perspective of critical asset protection, it was recognized that the assessment tool that had been used in the development of the initial CAPP would have to be revisited in order to address the requirements of the NIPP. After reviewing multiple site profiling tools, ACAMS was chosen for use with critical infrastructure and asset protection initiatives. The assessment tool allows local first responders and subject matter experts the ability to inventory assets, conduct criticality and vulnerability assessments, prioritize assets and provide detailed information to first responders about the asset. Another step in the refinement process is to amend the previous criteria developed in 2004 to reflect the current configuration of Iowa’s 17 sectors. The 2004 update to the CAPP was based on 15 sectors. We will continue to build on previous accomplishments developed by the sector agency contacts and update the data using more recent guidance released from DHS, such as the federal taxonomy and the federal Tier I and Tier II program. In the future we will share the results of this process with our state and local partners and provide the guidance to our local partners for identification of assets at the regional and local level. With input from state and local partners, a decision was made to move forward with implementing the ACAMS statewide. Iowa established a workgroup to assist with implementing ACAMS. The work group includes representatives from HSEMD, DPS‐Intel, the PSA, the Attorney General’s office, the LEIN regions, the Des Moines Police Department, the Iowa National Guard and local Emergency Management. Discussion during the work group meetings focused around training needs, the best way to roll out ACAMS statewide, and access to sensitive information. It was determined early on in the discussions that the LEIN regions have the capabilities and desire to implement the use of ACAMS across the state. The ACAMS working group had identified challenges to the initial roll out of ACAMS statewide. Initially ACAMS training was offered on a limited basis and each state was only offered 3 to 5 seats per training site. To resolve this issue Iowa requested to host ACAMS training in the State. In October of 2007 the State of Iowa was granted their request and as a host state was guaranteed 20 of the 40 training slots. As a result of the training there were 12 LEIN region personnel, one Iowa National Guard representative, one Department of Public Safety representative, and two representatives from State universities trained. Prior to the training in October a few other people in the state attended training outside the State of Iowa. The table below shows the current number of people trained in Iowa (January 2009). March 2009 19 | P a g e LOCATION OR AGENCY LEIN Region 1 LEIN Region 2 LEIN Region 3 LEIN Region 4 LEIN Region 5 LEIN Region 6 Department of Public Safety State Universities Iowa Homeland Security and Emergency Management Iowa National Guard Total NUMBER OF PEOPLE TRAINED 6 3 4 5 7 2 2 2 3 3 37 This was a step in the right direction, but additional training is needed to effectively implement the use of ACAMS at the local level. The same issue has been discussed at the federal level and to assist States in this effort the Department of Homeland Security – Infrastructure Information Collection Division developed curriculum for a pilot ACAMS train‐the‐trainer program. The pilot was finalized in November of 2007. Iowa requested and was offered two training seats for the ACAMS train‐the‐trainer in December 2007. As of January 2009, Iowa has 5 state and federal ACAMS trainers. ACAMS trainers with Iowa Homeland Security are currently conducting ACAMS courses across the state. As of January 2009, three trainings have been held. Iowa Homeland Security also holds a seat on the State and Local Tribal Territorial Government Coordinating Council ACAMS workgroup. This group provides guidance and direction to the DHS program office on ACAMS program implementation. March 2009 20 | P a g e Assets meeting the minimum criteria to be considered critical will be assessed using teams made up of law enforcement, fire/explosive ordinance disposal experts and other subject matter experts. The criteria will be determined in a collaborative effort between the LEIN regions and other state and local agencies. The assessments may also be initiated in response to identified threats or other federal, state, and local priorities. It is recommended the LEIN regions focus their efforts on populating the Asset Management Questionnaire within ACAMS. This will establish the initial buy‐in from the private asset holder and assist in determining if the asset requires an in‐depth site assessment. Once the criticality/vulnerability assessment is completed on assets the resulting data will provide a way to prioritize assets by sector at a state, regional, and local level. This would provide another source of information for decision makers in determining where funding and additional resources are needed. Over time the changes to an asset’s protection measures and reduction in threat would affect the criticality/vulnerability score; the addition of assets to the database could also impact the criticality of a particular asset. Each year Iowa is asked to review the Tier I and Tier II data as previously discussed in the Current Capabilities section and provide input on assets located within the state that fit the Tiered criteria. This involved coordination and networking with sector leads to acquire necessary information to appropriately respond to a DHS data call. This year, DHS has changed this process and now is working to develop a series of “Lists”. Iowa willl support this effort. The following lists are now being developed to help identify asets across the United States: A. B. C. D. Tier I Tier II Sector Specific State Specific Information to support the development of these lists and response to DHS data calls concerning asset protection changes annually and Iowa adjusts to those changes. On an annual basis the state and local partners involved in asset/infrastructure protection efforts will need to revise their process to address current trends and needs. March 2009 21 | P a g e GOAL 1: Strengthen the Lines of Communication between Federal, State, Local, and Private Sector Agencies to Improve Iowa’s Information Sharing Infrastructure. Objective 1: Develop or enhance information exchange methods while complying with regulatory, statutory, privacy‐related, and other issues that may govern the sharing of information. IS 1.1.A: Provide access to classified/unclassified information and communications for authorized State and local officials. IS 1.1.B: Adhere to predefined information classification, security clearances and need‐to‐know parameters when disseminating information and intelligence. IS 1.1.C: Structure dissemination and information sharing mechanisms so that private sector entities receive accurate, timely and unclassified information that is updated frequently and is consistent with their formal intelligence requirements. IS 1.1.D: Prevent, report and/or address inappropriate disclosures of information and/or intelligence to include those regulated by the PCII Guidance. IS 1.1.E: Provide training on the use and sharing of PCII to responder and emergency management agencies with a right to know or a need to know. Objective 2: Provide platforms to enable the private sector to interact and share information on critical infrastructure and key resources with governmental organizations. IS 1.2.A: Utilize law enforcement, fire fighters, bomb teams and other subject matter experts to populate the ACAM Sytem with accurate CI/KR protection information available to all ACAMS trained security partners with a right to know or a need to know. IS 1.2.B: Define our information sharing environment and tactical real time information with our public and private sector partners. IS 1.2.C: Use public and private sector CI/KR partners to develop a better understanding of priority information needs for CI/KR stakeholders. Objective 3: Share information and/or intelligence between Federal, State, local, tribal levels and private sector by using clearly defined mechanisms and processes. March 2009 22 | P a g e IS 1.3.A: Provide a weekly report integrating Iowa‐specific intelligence and open‐source information, and share this with partners. IS 1.3.B: Establish alternative, supplemental and backup mechanisms for routing information and/or intelligence to the necessary agencies. IS 1.3.C: Process and distribute open‐source information and sanitized law enforcement information. IS 1.3.D: Provide access to protection and preparedness resources, shared applications, TIPP research and analyses, real‐time collaboration and coordinated information gathering and timely dissemination. IS 1.3.E: Monitor HSIN‐CI, RISS‐ATIX, HSIN‐Iowa, CWIN and other information sharing systems to cull information for analysis and dissemination to partners in Iowa. IS 1.3.F: Provide security planning resources and tools in the TIIPP resource library. IS 1.3.G: Provide real‐time situation reporting to the Governor, the Homeland Security Advisor and the State Administrative Agent on a consistent basis. GOAL 2: Utilize a Risk Reduction Formula to Assess, Mitigate and minimize vulnerabilities in Iowa’s Critical Assets and Critical Asset Sectors. Objective 2.1: Strengthen collaboration within and between Iowa’s critical infrastructure sectors and collaboratively identify ways to strengthen sectors from disruption or loss. IS 2.1.A: Develop sector‐specific plans and threat‐specific protection measures to be put into place during transitions of the Homeland Security Threat Level. IS 2.1.B: Identify sector representatives in Iowa in conjunction with the National Infrastructure Protection Program. IS 2.1.C: Ensure that cyber‐security is incorporated into our critical infrastructure/key resource protection efforts. March 2009 23 | P a g e IS 2.1.D: Conduct interdependency studies between sectors to identify security gaps, and use information collected in these studies to harden assts or fill gaps and correct identified vulnerabilities. IS 2.1.E: Participate in significant national, regional and local awareness programs to encourage appropriate management and security our CI/KR sectors. Objective 2.2: Assess, mitigate and reduce vulnerabilities in Iowa’s critical assets. IS 2.2.A: Manage the BZPP to ensure the protection of specific critical sites in Iowa. IS 2.2.B: Develop a unified approach to CI/KR identification, risk determination, mitigation planning, and prioritized security investment, and exercising preparedness among all relevant stakeholders within their jurisdictions. IS 2.2.C: Provide information to critical asset owners in the development of plans to protect identified sites. IS 2.2.D: Form national, State, regional, local and/or tribal perspectives to enable prioritized protection and restoration of critical public services, facilities, utilities and processes within the jurisdiction. IS 2.2.E: Identify special events occurring in the state and provide available resources (i.e. planning, training, exercise and equipment) to appropriate entities involved. IS 2.2.F: Provide fusion center with necessary tools to analyze threat information and provide real‐time threat information to CI/KR stakeholders as well as Fusion System partners with a right to know or a need to know. GOAL 3: Integrate the TIIPP across the Spectrum of Iowa’s Homeland Security and Emergency Management Programs. Objective 3.1: Develop and keep current management and administrative tools necessary to ensure that the TIIPP can function. IS 3.1.A: Apply for homeland security grants to address CI/KR protection efforts per DHS and Federal Emergency Management Agency (FEMA) guidance. March 2009 24 | P a g e IS 3.1.B: Conduct an annual review of the NIPP and Standard Operating Procedures (SOP) to ensure efficiency and effectiveness in functionality. IS 3.1.C: Ensure that funding priorities are addressed and that resources are allocated efficiently and effectively to achieve the CI/KR protection mission in accordance with relevant plans and strategies. IS 3.1.D: Develop a sustainment policy for the TIIPP. IS 3.1.E: Update Iowa Code and Regulations as required to ensure information privacy. Objective 3.2: Develop partnerships between the TIIPP and other homeland security and emergency management agencies. IS 3.2.A: Integrate the PSA into Iowa’s infrastructure protection efforts. IS 3.2.B: Act as a conduit for requests for federal assistance when the threat or incident situation exceeds the capabilities of public and private sector security partners at local or regional jurisdictional levels. IS 3.2.C: Work with DHS to integrate assessment or site visit information collected by PSAs into ACAMS as appropriate. GOAL 4: Develop effective tools for risk analysis to determine level of criticality in sites and sectors and prioritize critical infrastructure. Objective 4.1: Conduct assessments of the factors of risk and utilize these to assess critical infrastructure. IS 4.1.A: Conduct and validate consequence assessments of priority CI/KR as identified by the ACAMS asset management questionnaire process. IS 4.1.B: Conduct detailed threat assessments on high‐consequence assets, systems, networks and functions. IS 4.1.C: Conduct detailed vulnerability assessments on high‐consequence assets, systems, networks and functions. IS 4.1.D: Utilizing a threat‐based approach, prioritize high‐risk CI/KR for consideration of protective measures. March 2009 25 | P a g e Objective 4.2: Ensure that risk methodologies are accurate and account for the full spectrum of threats facing Iowa. IS 4.2.A: Continually review and update Iowa’s critical asset data, including the Tier I and Tier II information to ensure that the data is accurate. IS 4.2.B: Review existing and new risk assessment methodologies to determine compatibility with the NIPP baseline criteria. IS 4.2.C: Adjust to changing DHS environment as leadership changes within our county and within DHS. March 2009 26 | P a g e EVALUATION The Threat Information and Infrastructure Protection Program Implementation Plan will be evaluated and reviewed on an annual basis, starting from the date of publication. Progress will be measured against the performance criteria as identified in this plan, and corrections to the implementation strategy will be made as appropriate. Iowa’s CIP will be evaluated through a number of methods. 1. The CIP will be reviewed for content and construct validity on an annual basis from the date of publication. Updates will be document and updated “revisions” will be made to the document based upon the changing criteria under which the program operates. 2. The CIP will be tested by utilizing Homeland Security Exercise Evaluation Program (HSEEP) compliant exercises that are based upon tabletop, functional and full‐scale criteria. Initially, there will need to be discussions and demonstrations to ensure the exercises are used as an evaluation tool and not just a training tool. 3. The CIP will be utilized when Iowa is facing an actual event disaster situation. Information collected under this program will be used to help with risk reduction in an all hazards environment, not just terror related events/incidents. Within the after action, this plan will be reviewed for its ability to support the response and recovery efforts as much as it is reviewed in support of the prevention and protection elements. March 2009 27 | P a g e ACRONYMS GUIDE ACAMS APP BENS BZPP CAAM CAPP CFATS CI/KR CIP DHS EOC FAC FASCAT FEMA GIS HAN HITRAC HSEEP HSEMD HSGP HSIN IAD ICAV IPP LEIN NIPP OIP PCII PSA SCC SEOC SSA SIP SOP STU TIIPP March 2009 Automated Critical Asset Management System Asset Protection Planner Business Executives for National Security Buffer Zone Protection Program Critical Asset Assessment Model Critical Asset Protection Plan Chemical Facilities Anti‐Terrorism Standards Act Critical Infrastructure/Key Resource Critical Infrastructure Protection Plan Department of Homeland Security Emergency Operations Center Fusion Advisory Committee Food and Agriculture Sector Criticality Assessment Tool Federal Emergency Management Agency Geographic Information System Iowa Health Alert Network Homeland Infrastructure Threat & Risk Analysis Center Homeland Security Exercise Evaluation Program Iowa Homeland Security and Emergency Management Division Homeland Security Grant Program Homeland Security Information Network Iowa Asset Database Integrated Common Analytical Viewer Infrastructure Protection Planner Law Enforcement Intelligence Network National Infrastructure Protection Plan Office of Infrastructure Protection Protected Critical Infrastructure Information Protective Security Advisor Sector Coordinating Councils State Emergency Operations Center Sector Specific Agency Safeguard Iowa Partnership Standard Operating Procedure Secure Telecommunications Unit Threat Integration and Infrastructure Protection Program 28 | P a g e APPENDIX A STATE OF IOWA CRITICAL INFRASTRUCTURE / KEY RESOURCE DATABASE SCHEMATIC SECTOR AND SUB-SECTOR te Was Wate r Tre atme c nt Fa Foo d Pro cess ing Foo d Dis tribu tion Agri cult ure Inpu ts Crop s Anim al lic Pub Wate r Su pply 17 r Wate Agr Re d Cit ize ns C Or omm ga niz unit ati y on s Civ ic Gr ou ps Em erg Fa en ith cy ba Re se do sp on rga se niz ati on s Cr 16 os s icult ure 1 -Fo od Ba i nk ng t en tm es nv /I es ng iti rs ki od ri e an m ar B m C o /C ce s n ie ra rit su cu In Se d an t di re C sp o rt a tio n Tr an 15 Publi c Healt Health/ h Ca re Enviro nmen tal Hea lth Healt h Car e Supp ort Direc t Patie nt Car e Labs and P harm aceutic als Public Health End of Life 14 13 US Postal Service Parcel Courier Services Freight Delivery Warehousing Postal - Shipping Defe n Indu se stria l s ay ge r id hw s) B ig H am ng D di & lu s ir nc A ck s li ie Lo ai lit R g ci in Fa al od rm te In (In cl ud ilitie er at W s nts Pla ing rt tur po fac ans nu a / l Tr lM ica age ica em tor em h lS Ch sC ica . ou heme, Etc ar d z ies C Ha us kpil cilit do c l Fa zar Sto ica Ha em h zC Ha er Oth i -F n na ce 2 em Ch l ica 3 Retail Tra de ustry Ind Services Wholesale cial Commer Facilities Trade ing ment State of Iowa Manufactur ent/Amuse Entertainm 4 Critical Infrastructure and Key Resource Database Dams USACE Dams 5 12 on cati Ed u Pr e sch ools Priv ate F 6 2 K-1 er Univ Oth c er S ls hoo un ic at io n un ic at m io un In n ic te at rn io et n ts en um a on St dM es an nu ns Ve nt Ico ve rE he Ot /A ms diu s na re 10 In Te for m Te c hn a t le ol ion c o og m y/ m . e En y rg Em Se erge rv nc ice y s sitie s Pub li acil ities (Co ntr c Fa cilit ies acto rs) nd sa ue en s t V on en Ic Ev 11 7 EM Fi re S Sp /H ec AZ ia M liz AT Em ed En er Te ge fo am rc nc em s y M en an t ag em en t La w Government 9 8 El e ici c tr co m m ty Pi p Ot m uc od Pr co m r he eli d ne ire En le ss co m W sa Re at gu io la n to Se ry rv O ic rg es an iza tio ns ti o erg c Nu nd ire is t n/D Sa te lli te e y, W St lea Federal Government ag or gE o uti rib Local Government Other Government r State Government th a e In fo rm iod l/B no ies el This document is subject to change as Sector and Sub Sector characteristics are refined. n March 2009 March 2009 29 | P a g e APPENDIX B MEASURE EFFECTIVE‐ NESS SET SECURITY GOALS IMPLEMENT PROTECTIVE PROGRAMS IDENTIFY ASSETS March 2009 30 | P a g e PRIORITIZE ASSETS SYSTEMS, NETWORKS AND FUNCTIONS ASSESS RISKS RISK MANAGEMENT FRAMEWORK Set Security Goals – The following areas are specific to asset identification, assessment and Prioritization. Immediate goals include the completion of assessments on those assets identified by DHS as Tier II sites. Additionally, assets identified in each of the regions as “critical” by local responder agencies will be among those initially approached and assessed. Identify Assets ‐ Among the current capabilities previously mention is the Critical Asset Protection Program Database. This database contains nearly 1,500 assets previously identified in Iowa as part of the CAPP. These assets have been loaded into the ACAMS tool and will continue to be refined as assessment red teams are identified and begin work with the profiling tool. Systems, Networks, and Functions – The LEIN system is an established framework for information sharing among law enforcement entities. The local LEIN regions will be used to assist HSEMD with the identification, assessment and prioritization of Iowa’s assets. The LEIN regions provide a key function in the information sharing networks. As previously mentioned, ACAM System is an existing profiling tool that will be adapted to Iowa’s needs. The SIP is a network of public and private partners. This partnership has been previously identified in this document as well as the initiatives currently underway. Assess Risks – As the aforementioned Red teams work to streamline the current assets identified in the CAPP and use the ACAMS tool, assets meeting the minimum triggers to be considered critical will be assessed using teams made up of law enforcement, fire/explosive ordinance disposal experts and other subject matter experts. These assessments will be placed into ACAMS and be submitted for PCII protection. Prioritize – The ACAMS tool uses CARVER as well as MSHARRP + V scoring methodologies to assist in the prioritization of identified assets. The tool allows the State to review all assets in a region or sector and identify those with the highest scores or greatest vulnerabilities. Implement Protective Programs – As assets are assessed, recommendations are completed and sites are out‐briefed on potential improvements that can be completed in security. Measure Effectiveness – As training for ACAMS is completed over the upcoming months, each region’s activity will be monitored and evaluated for input into the profiling tool Those regions that have not been effective in entry will receive additional training and assistance in the use of the tool and asset assessments on contacts in their respective area. March 2009 31 | P a g e Resources: Critical Infrastructure Information Act of 2002, U. S. Department of Homeland Security, http://www.dhs.gov/xlibrary/assets/CII_Act.pdf Homeland Security Act of 2002, http://www.dhs.gov/xabout/laws/law_regulation_rule_0011.shtm Homeland Security Presidential Directive 5: Management of Domestic Incidents, February 28, 2003, http://www.dhs.gov/xabout/laws/gc_1214592333605.shtm Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection, December 17, 2003, http://www.dhs.gov/xabout/laws/gc_1214597989952.shtm Homeland Security Presidential Directive 8: National Preparedness December 17, 2003, http://www.dhs.gov/xabout/laws/gc_1215444247124.shtm Iowa Code 2003 Supplement: Section 22.7 Confidential Records, http://www.legis.state.ia.us/IACODE/2003SUPPLEMENT/22/7.html Iowa Homeland Security Strategy, January 2007, www.iowahomelandsecurity.org/Portals/0/AboutUS/FY06Strategy2007Update.pdf National Infrastructure Protection Plan, U.S. Department of Homeland Security, http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf The National Strategy for Homeland Security, July 2002, http://www.dhs.gov/xabout/history/publication_0005.shtm National Strategy for Physical Protection of Critical Infrastructure and Key Assets, February 2003, http://www.dhs.gov/xlibrary/assets/Physical_Strategy.pdf March 2009 32 | P a g e