PD 7: Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection

Similar documents
National Policy and Guiding Principles

THE WHITE HOUSE. Office of the Press Secretary. EMBARGOED UNTIL DELIVERY OF THE PRESIDENT'S February 12, 2013 STATE OF THE UNION ADDRESS

STRENGTHENING THE CYBERSECURITY OF FEDERAL NETWORKS AND CRITICAL INFRASTRUCTURE

Cybersecurity Presidential Policy Directive Frequently Asked Questions. kpmg.com

THE WHITE HOUSE. Office of the Press Secretary EXECUTIVE ORDER

Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

THE WHITE HOUSE Office of the Press Secretary EXECUTIVE ORDER

March 21, 2016 MEMORANDUM FOR THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES. Building National Capabilities for Long-Term Drought Resilience

Executive Order on Coordinating National Resilience to Electromagnetic Pulses

Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Introduction to the National Response Plan and National Incident Management System

Presidential Documents

Emergency Support Function #12 Energy Annex. ESF Coordinator: Support Agencies:

Energy Assurance Plans

THE WHITE HOUSE. Office of the Press Secretary. For Immediate Release September 23, 2014 EXECUTIVE ORDER

COUNTERING IMPROVISED EXPLOSIVE DEVICES

Section One of the Order: The Cybersecurity of Federal Networks.

Mitigation Framework Leadership Group (MitFLG) Charter DRAFT

National Cyber Incident Response - Architectural Concepts

Member of the County or municipal emergency management organization

Critical Infrastructure

CRITICAL INFRASTRUCTURE AND KEY RESOURCES

About Issues in Building the National Strategy for Cybersecurity in Vietnam

STRATEGY ATIONAL. National Strategy. for Critical Infrastructure. Government

Office of Infrastructure Protection Overview

The Federal Council s Basic Strategy. for Critical Infrastructure Protection

300 Riverview Plaza Odysseus Marcopolus, Chief Operating Officer Trenton, NJ POLICY NO: SUPERSEDES: N/A VERSION: 1.0

The Office of Infrastructure Protection

NATIONAL DEFENSE INDUSTRIAL ASSOCIATION Homeland Security Symposium

National Preparedness System (NPS) Kathleen Fox, Acting Assistant Administrator National Preparedness Directorate, FEMA April 27, 2015

National Incident Management System and National Response Plan. Overview

COUNTERING IMPROVISED EXPLOSIVE DEVICES

Statement for the Record

Overview of the Federal Interagency Operational Plans

Critical Infrastructure Resilience

Department of Homeland Security Updates

Quadrennial Homeland Security Review (QHSR) Ensuring Resilience to Disasters

DHS Cybersecurity: Services for State and Local Officials. February 2017

National Infrastructure Protection Plan

The Office of Infrastructure Protection

Overview of NIPP 2013: Partnering for Critical Infrastructure Security and Resilience October 2013

Intelligence Support to Critical Infrastructure Protection Table of Contents

The President s Spectrum Policy Initiative

NATIONAL STRATEGY FOR GLOBAL SUPPLY CHAIN SECURITY

Homeland Security and Geographic Information Systems

GAO CYBERSPACE POLICY. Executive Branch Is Making Progress Implementing 2009 Policy Review Recommendations, but Sustained Leadership Is Needed

79th OREGON LEGISLATIVE ASSEMBLY Regular Session. Senate Bill 90

Emergency Support Function #2 Communications Annex INTRODUCTION. Purpose. Scope. ESF Coordinator: Support Agencies: Primary Agencies:

Introduction brief to the ISCe Satellite and Communications Conference

Electricity Sub-Sector Coordinating Council Charter FINAL DISCUSSION DRAFT 7/9/2013

Final Draft/Pre-Decisional/Do Not Cite. Forging a Common Understanding for Critical Infrastructure. Shared Narrative

21ST OSCE ECONOMIC AND ENVIRONMENTAL FORUM

The Office of Infrastructure Protection

Building A Disaster Resilient Quebec

Critical Infrastructure Assessment

The J100 RAMCAP Method

National Counterterrorism Center

Why you should adopt the NIST Cybersecurity Framework

Mississippi Emergency Management Agency. Shawn Wise. Office Of Preparedness

Mapping to the National Broadband Plan

how to manage risks in those rare cases where existing mitigation mechanisms are insufficient or impractical.

December 10, Statement of the Securities Industry and Financial Markets Association. Senate Committee on Banking, Housing, and Urban Development

DHS Supply Chain Activity: Cross-Sector Supply Chain Working Group and Strategy on Global Supply Chain Security

Control Systems Cyber Security Awareness

Joint ICTP-IAEA School of Nuclear Energy Management November 2012

Inter-American Port Security Cooperation Plan

Resolution: Advancing the National Preparedness for Cyber Security

Hazard Management Cayman Islands

PIPELINE SECURITY An Overview of TSA Programs

Resolution adopted by the General Assembly on 21 December [on the report of the Second Committee (A/64/422/Add.3)]

Directive on security of network and information systems (NIS): State of Play

Mississippi Emergency Management Agency. Brittany Hilderbrand & Kamika Durr. Office Of Preparedness

Directive on Security of Network and Information Systems

Critical Infrastructure Protection (CIP) as example of a multi-stakeholder approach.

How AlienVault ICS SIEM Supports Compliance with CFATS

Critical Infrastructure Sectors and DHS ICS CERT Overview

Chapter 1. Chapter 2. Chapter 3

Integrated Consortium of Laboratory Networks (ICLN) Brief to the NPDN National Meeting

FEMA Update. Tim Greten Technological Hazards Division Deputy Director. NREP April 2017

Testimony. Christopher Krebs Director Cybersecurity and Infrastructure Security Agency U.S. Department of Homeland Security FOR A HEARING ON

Report for Congress. Safeguarding the Nation s Drinking Water: EPA and Congressional Actions. Updated March 7, 2003

National Strategy for CBRNE Standards

The Office of Infrastructure Protection

Critical Information Infrastructure Protection. Role of CIRTs and Cooperation at National Level

Bradford J. Willke. 19 September 2007

Pipeline Security Guidelines. April Transportation Security Administration

Implementing the Administration's Critical Infrastructure and Cybersecurity Policy

IAEA Perspective: The Framework for the Security of Radioactive Material and Associated Facilities

Cyber Security Strategy

Critical Information Infrastructure Protection Law

June 5, 2018 Independence, Ohio

GAO CRITICAL INFRASTRUCTURE PROTECTION. Significant Challenges in Developing Analysis, Warning, and Response Capabilities.

G7 Bar Associations and Councils

Chemical Facility Anti- Terrorism Standards

Cyber Security Strategic Level Landscape in Poland. Krzysztof Silicki NASK Institute, Poland ENISA MB, EB

Cybersecurity and Data Privacy

Legal and Regulatory Developments for Privacy and Security

NHS Gloucestershire Clinical Commissioning Group. Business Continuity Strategy

MNsure Privacy Program Strategic Plan FY

GAO INFORMATION SHARING ENVIRONMENT

Transcription:

PD 7: Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection December 17, 2003 SUBJECT: Critical Infrastructure Identification, Prioritization, and Protection Purpose This directive establishes a national policy for Federal departments and agencies to identify and prioritize United States critical infrastructure and key resources and to protect them from terrorist attacks. Background Terrorists seek to destroy, incapacitate, or exploit critical infrastructure and key resources across the United States to threaten national security, cause mass casualties, weaken our economy, and damage public morale and confidence. America's open and technologically complex society includes a wide array of critical infrastructure and key resources that are potential terrorist targets. The majority of these are owned and operated by the private sector and State or local governments. These critical infrastructures and key resources are both physical and cyber-based and span all sectors of the economy. Critical infrastructure and key resources provide the essential services that underpin American society. The Nation possesses numerous key resources, whose exploitation or destruction by terrorists could cause catastrophic health effects or mass casualties comparable to those from the use of a weapon of mass destruction, or could profoundly affect our national prestige and morale. In addition, there is critical infrastructure so vital that its incapacitation, exploitation, or destruction, through terrorist attack, could have a debilitating effect on security and economic well-being. While it is not possible to protect or eliminate the vulnerability of all critical infrastructure and key resources throughout the country, strategic improvements in security can make it more difficult for attacks to succeed and can lessen the impact of attacks that may occur. In addition to strategic security enhancements, tactical security improvements can be rapidly implemented to deter, mitigate, or neutralize potential attacks. Definitions 1. In this directive: a. The term "critical infrastructure" has the meaning given to that term in section 1016(e) of the USA PATRIOT Act of 2001 (42 U.S.C. 5195c(e)). 1

b. The term "key resources" has the meaning given that term in section 2(9) of the Homeland Security Act of 2002 (6 U.S.C. 101(9)). c. The term "the Department" means the Department of Homeland Security. d. The term "Federal departments and agencies" means those executive departments enumerated in 5 U.S.C. 101, and the Department of Homeland Security; independent establishments as defined by 5 U.S.C. 104(1);Government corporations as defined by 5 U.S.C. 103(1); and the United States Postal Service. e. The terms "State," and "local government," when used in a geographical sense, have the same meanings given to those terms in section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101). f. The term "the Secretary" means the Secretary of Homeland Security. g. The term "Sector-Specific Agency" means a Federal department or agency responsible for infrastructure protection activities in a designated critical infrastructure sector or key resources category. Sector-Specific Agencies will conduct their activities under this directive in accordance with guidance provided by the Secretary. h. The terms "protect" and "secure" mean reducing the vulnerability of critical infrastructure or key resources in order to deter, mitigate, or neutralize terrorist attacks. Policy 2. It is the policy of the United States to enhance the protection of our Nation's critical infrastructure and key resources against terrorist acts that could: a. cause catastrophic health effects or mass casualties comparable to those from the use of a weapon of mass destruction; b. impair Federal departments and agencies' abilities to perform essential missions, or to ensure the public's health and safety; c. undermine State and local government capacities to maintain order and to deliver minimum essential public services; d. damage the private sector's capability to ensure the orderly functioning of the economy and delivery of essential services; e. have a negative effect on the economy through the cascading disruption of other critical infrastructure and key resources; or f. undermine the public's morale and confidence in our national economic and political institutions. 3. Federal departments and agencies will identify, prioritize, and coordinate the protection of critical infrastructure and key resources in order to prevent, deter, and mitigate the effects of deliberate efforts to destroy, incapacitate, or exploit them. Federal departments and agencies will work with State and local governments and the private sector to accomplish this objective. 4. Federal departments and agencies will ensure that homeland security programs do not diminish the overall economic security of the United States. 5. Federal departments and agencies will appropriately protect information associated with carrying out this directive, including handling voluntarily 2

provided information and information that would facilitate terrorist targeting of critical infrastructure and key resources consistent with the Homeland Security Act of 2002 and other applicable legal authorities. 6. Federal departments and agencies shall implement this directive in a manner consistent with applicable provisions of law, including those protecting the rights of United States persons. Roles and Responsibilities of the Secretary 7. In carrying out the functions assigned in the Homeland Security Act of 2002, the Secretary shall be responsible for coordinating the overall national effort to enhance the protection of the critical infrastructure and key resources of the United States. The Secretary shall serve as the principal Federal official to lead, integrate, and coordinate implementation of efforts among Federal departments and agencies, State and local governments, and the private sector to protect critical infrastructure and key resources. 8. Consistent with this directive, the Secretary will identify, prioritize, and coordinate the protection of critical infrastructure and key resources with an emphasis on critical infrastructure and key resources that could be exploited to cause catastrophic health effects or mass casualties comparable to those from the use of a weapon of mass destruction. 9. The Secretary will establish uniform policies, approaches, guidelines, and methodologies for integrating Federal infrastructure protection and risk management activities within and across sectors along with metrics and criteria for related programs and activities. 10. The Secretary shall coordinate protection activities for each of the following critical infrastructure sectors: information technology; telecommunications; chemical; transportation systems, including mass transit, aviation, maritime, ground/surface, and rail and pipeline systems; emergency services; and postal and shipping. The Department shall coordinate with appropriate departments and agencies to ensure the protection of other key resources including dams, government facilities, and commercial facilities. In addition, in its role as overall cross-sector coordinator, the Department shall also evaluate the need for and coordinate the coverage of additional critical infrastructure and key resources categories over time, as appropriate. 11. The Secretary will continue to maintain an organization to serve as a focal point for the security of cyberspace. The organization will facilitate interactions and collaborations between and among Federal departments and agencies, State and local governments, the private sector, academia and international organizations. To the extent permitted by law, Federal departments and agencies with cyber expertise, including but not limited to the Departments of Justice, Commerce, the Treasury, Defense, Energy, and State, and the Central Intelligence Agency, will collaborate with and support the organization in accomplishing its mission. The organization's mission includes analysis, warning, information sharing, vulnerability reduction, mitigation, and aiding national recovery efforts for critical infrastructure information systems. The organization will support the Department of Justice and other law enforcement agencies in their continuing missions to investigate and prosecute threats to and attacks against cyberspace, to the extent permitted by law. 3

12. The Secretary will work closely with other Federal departments and agencies, State and local governments, and the private sector in accomplishing the objectives of this directive. Roles and Responsibilities of Sector-Specific Federal Agencies 13. Recognizing that each infrastructure sector possesses its own unique characteristics and operating models, there are designated Sector-Specific Agencies, including: a. Department of Agriculture -- agriculture, food (meat, poultry, egg products); b. Health and Human Services -- public health, healthcare, and food (other than meat, poultry, egg products); c. Environmental Protection Agency -- drinking water and water treatment systems; d. Department of Energy -- energy, including the production refining, storage, and distribution of oil and gas, and electric power except for commercial nuclear power facilities; e. Department of the Treasury -- banking and finance; f. Department of the Interior -- national monuments and icons; and g. Department of Defense -- defense industrial base. 14. In accordance with guidance provided by the Secretary, Sector-Specific Agencies shall: a. collaborate with all relevant Federal departments and agencies, State and local governments, and the private sector, including with key persons and entities in their infrastructure sector; b. conduct or facilitate vulnerability assessments of the sector; and c. encourage risk management strategies to protect against and mitigate the effects of attacks against critical infrastructure and key resources. 15. Nothing in this directive alters, or impedes the ability to carry out, the authorities of the Federal departments and agencies to perform their responsibilities under law and consistent with applicable legal authorities and presidential guidance. 16. Federal departments and agencies shall cooperate with the Department in implementing this directive, consistent with the Homeland Security Act of 2002 and other applicable legal authorities. Roles and Responsibilities of Other Departments, Agencies, and Offices 17. In addition to the responsibilities given the Department and Sector-Specific Agencies, there are special functions of various Federal departments and agencies and components of the Executive Office of the President related to critical infrastructure and key resources protection. a. The Department of State, in conjunction with the Department, and the Departments of Justice, Commerce, Defense, the Treasury and other 4

appropriate agencies, will work with foreign countries and international organizations to strengthen the protection of United States critical infrastructure and key resources. b. The Department of Justice, including the Federal Bureau of Investigation, will reduce domestic terrorist threats, and investigate and prosecute actual or attempted terrorist attacks on, sabotage of, or disruptions of critical infrastructure and key resources. The Attorney General and the Secretary shall use applicable statutory authority and attendant mechanisms for cooperation and coordination, including but not limited to those established by presidential directive. c. The Department of Commerce, in coordination with the Department, will work with private sector, research, academic, and government organizations to improve technology for cyber systems and promote other critical infrastructure efforts, including using its authority under the Defense Production Act to assure the timely availability of industrial products, materials, and services to meet homeland security requirements. d. A Critical Infrastructure Protection Policy Coordinating Committee will advise the Homeland Security Council on interagency policy related to physical and cyber infrastructure protection. This PCC will be chaired by a Federal officer or employee designated by the Assistant to the President for Homeland Security. e. The Office of Science and Technology Policy, in coordination with the Department, will coordinate interagency research and development to enhance the protection of critical infrastructure and key resources. f. The Office of Management and Budget (OMB) shall oversee the implementation of government-wide policies, principles, standards, and guidelines for Federal government computer security programs. The Director of OMB will ensure the operation of a central Federal information security incident center consistent with the requirements of the Federal Information Security Management Act of 2002. g. Consistent with the E-Government Act of 2002, the Chief Information Officers Council shall be the principal interagency forum for improving agency practices related to the design, acquisition, development, modernization, use, operation, sharing, and performance of information resources of Federal departments and agencies. h. The Department of Transportation and the Department will collaborate on all matters relating to transportation security and transportation infrastructure protection. The Department of Transportation is responsible for operating the national air space system. The Department of Transportation and the Department will collaborate in regulating the transportation of hazardous materials by all modes (including pipelines). i. All Federal departments and agencies shall work with the sectors relevant to their responsibilities to reduce the consequences of catastrophic failures not caused by terrorism. 5

18. The heads of all Federal departments and agencies will coordinate and cooperate with the Secretary as appropriate and consistent with their own responsibilities for protecting critical infrastructure and key resources. 19. All Federal department and agency heads are responsible for the identification, prioritization, assessment, remediation, and protection of their respective internal critical infrastructure and key resources. Consistent with the Federal Information Security Management Act of 2002, agencies will identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. Coordination with the Private Sector 20. In accordance with applicable laws or regulations, the Department and the Sector-Specific Agencies will collaborate with appropriate private sector entities and continue to encourage the development of information sharing and analysis mechanisms. Additionally, the Department and Sector-Specific Agencies shall collaborate with the private sector and continue to support sector-coordinating mechanisms: a. to identify, prioritize, and coordinate the protection of critical infrastructure and key resources; and b. to facilitate sharing of information about physical and cyber threats, vulnerabilities, incidents, potential protective measures, and best practices. National Special Security Events 21. The Secretary, after consultation with the Homeland Security Council, shall be responsible for designating events as "National Special Security Events" (NSSEs). This directive supersedes language in previous presidential directives regarding the designation of NSSEs that is inconsistent herewith. Implementation 22. Consistent with the Homeland Security Act of 2002, the Secretary shall produce a comprehensive, integrated National Plan for Critical Infrastructure and Key Resources Protection to outline national goals, objectives, milestones, and key initiatives within 1 year from the issuance of this directive. The Plan shall include, in addition to other Homeland Security-related elements as the Secretary deems appropriate, the following elements: a. a strategy to identify, prioritize, and coordinate the protection of critical infrastructure and key resources, including how the Department intends to work with Federal departments and agencies, State and local governments, the private sector, and foreign countries and international organizations; b. a summary of activities to be undertaken in order to: define and prioritize, reduce the vulnerability of, and coordinate the protection of critical infrastructure and key resources; c. a summary of initiatives for sharing critical infrastructure and key resources information and for providing critical infrastructure and key 6

resources threat warning data to State and local governments and the private sector; and d. coordination and integration, as appropriate, with other Federal emergency management and preparedness activities including the National Response Plan and applicable national preparedness goals. 23. The Secretary, consistent with the Homeland Security Act of 2002 and other applicable legal authorities and presidential guidance, shall establish appropriate systems, mechanisms, and procedures to share homeland security information relevant to threats and vulnerabilities in national critical infrastructure and key resources with other Federal departments and agencies, State and local governments, and the private sector in a timely manner. 24. The Secretary will continue to work with the Nuclear Regulatory Commission and, as appropriate, the Department of Energy in order to ensure the necessary protection of: a. commercial nuclear reactors for generating electric power and non-power nuclear reactors used for research, testing, and training; b. nuclear materials in medical, industrial, and academic settings and facilities that fabricate nuclear fuel; and c. the transportation, storage, and disposal of nuclear materials and waste. 25. In coordination with the Director of the Office of Science and Technology Policy, the Secretary shall prepare on an annual basis a Federal Research and Development Plan in support of this directive. 26. The Secretary will collaborate with other appropriate Federal departments and agencies to develop a program, consistent with applicable law, to geospatially map, image, analyze, and sort critical infrastructure and key resources by utilizing commercial satellite and airborne systems, and existing capabilities within other agencies. National technical means should be considered as an option of last resort. The Secretary, with advice from the Director of Central Intelligence, the Secretaries of Defense and the Interior, and the heads of other appropriate Federal departments and agencies, shall develop mechanisms for accomplishing this initiative. The Attorney General shall provide legal advice as necessary. 27. The Secretary will utilize existing, and develop new, capabilities as needed to model comprehensively the potential implications of terrorist exploitation of vulnerabilities in critical infrastructure and key resources, placing specific focus on densely populated areas. Agencies with relevant modeling capabilities shall cooperate with the Secretary to develop appropriate mechanisms for accomplishing this initiative. 28. The Secretary will develop a national indications and warnings architecture for infrastructure protection and capabilities that will facilitate: a. an understanding of baseline infrastructure operations; b. the identification of indicators and precursors to an attack; and c. a surge capacity for detecting and analyzing patterns of potential attacks. 7

In developing a national indications and warnings architecture, the Department will work with Federal, State, local, and non-governmental entities to develop an integrated view of physical and cyber infrastructure and key resources. 29. By July 2004, the heads of all Federal departments and agencies shall develop and submit to the Director of the OMB for approval plans for protecting the physical and cyber critical infrastructure and key resources that they own or operate. These plans shall address identification, prioritization, protection, and contingency planning, including the recovery and reconstitution of essential capabilities. 30. On an annual basis, the Sector-Specific Agencies shall report to the Secretary on their efforts to identify, prioritize, and coordinate the protection of critical infrastructure and key resources in their respective sectors. The report shall be submitted within 1 year from the issuance of this directive and on an annual basis thereafter. 31. The Assistant to the President for Homeland Security and the Assistant to the President for National Security Affairs will lead a national security and emergency preparedness communications policy review, with the heads of the appropriate Federal departments and agencies, related to convergence and next generation architecture. Within 6 months after the issuance of this directive, the Assistant to the President for Homeland Security and the Assistant to the President for National Security Affairs shall submit for my consideration any recommended changes to such policy. 32. This directive supersedes Presidential Decision Directive/NSC-63 of May 22, 1998 ("Critical Infrastructure Protection"), and any Presidential directives issued prior to this directive to the extent of any inconsistency. Moreover, the Assistant to the President for Homeland Security and the Assistant to the President for National Security Affairs shall jointly submit for my consideration a Presidential directive to make changes in Presidential directives issued prior to this date that conform such directives to this directive. 33. This directive is intended only to improve the internal management of the executive branch of the Federal Government, and it is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity, against the United States, its departments, agencies, or other entities, its officers or employees, or any other person. Last Published Date: September 22, 2015 Source: https://www.dhs.gov/homeland-security-presidential-directive-7 20171224 / MustafaA 8