This is the accessible text file for GAO report number GAO-09-654R 
entitled 'The Department of Homeland Security's (DHS) Critical 
Infrastructure Protection Cost-Benefit Report' which was released on 
June 26, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 


United States Government Accountability Office: 
Washington, DC 20548: 

June 26, 2009: 

The Honorable Robert C. Byrd:
The Honorable George Voinovich:
Ranking Member:
Committee on Appropriations:
Subcommittee on Homeland Security:
United States Senate: 

The Honorable David E. Price:
The Honorable Harold Rogers:
Ranking Member:
Committee on Appropriations:
Subcommittee on Homeland Security:
House of Representatives: 

Subject: The Department of Homeland Security's (DHS) Critical 
Infrastructure Protection Cost-Benefit Report: 

In 2005, Hurricane Katrina devastated the Gulf Coast, damaging critical 
infrastructure, such as oil platforms, pipelines, and refineries; water 
mains; electric power lines; and cellular phone towers. The 
infrastructure damage and resulting chaos disrupted government and 
business functions alike, producing cascading effects far beyond the 
physical location of the storm. Threats against critical infrastructure 
are not limited to natural disasters. For example, in 2005, suicide 
bombers struck London's public transportation system, disrupting the 
city's transportation and mobile telecommunications infrastructure. In 
March 2007, we reported that our nation's critical infrastructures and 
key resources (CIKR)--systems and assets, whether physical or virtual, 
so vital to the United States that their incapacity or destruction 
would have a debilitating impact on national security, national 
economic security, national public health or safety, or any combination 
of those matters--continue to be vulnerable to a wide variety of 
threats.[Footnote 1] According to DHS, because the private sector owns 
approximately 85 percent of the nation's CIKR--banking and financial 
institutions, telecommunications networks, and energy production and 
transmission facilities, among others--it is vital that the public and 
private sectors work together to protect these assets. 

The Homeland Security Act of 2002 created DHS and gave the department 
wide-ranging responsibilities for, among other things, leading and 
coordinating the overall national critical infrastructure protection 
effort.[Footnote 2] For example, the act required DHS to (1) develop a 
comprehensive national plan for securing the nation's CIKR and (2) 
recommend measures to protect CIKR in coordination with other agencies 
of the federal government and in cooperation with state and local 
government agencies and authorities, the private sector, and other 
entities. Homeland Security Presidential Directive 7 (HSPD-7) further 
defined critical infrastructure protection responsibilities for DHS and 
those federal agencies--known as sector-specific agencies (SSA)-- 
responsible for particular industry sectors, such as transportation, 
energy, and communications. HSPD-7 directed DHS to establish uniform 
policies, approaches, guidelines, and methodologies for integrating 
federal infrastructure protection and risk management activities within 
and across CIKR sectors.[Footnote 3] Also, in accordance with the 
Homeland Security Act and in response to HSPD-7, DHS issued, in June 
2006, the National Infrastructure Protection Plan (NIPP), which 
provides the overarching approach for integrating the nation's many 
CIKR protection initiatives into a single national effort. The NIPP 
sets forth a comprehensive risk management framework and clearly 
defined roles and responsibilities for DHS, SSAs, and other federal, 
state, regional, local, tribal, territorial, and private sector 
partners implementing the NIPP.[Footnote 4] Within this framework DHS 
has emphasized the importance of collaboration and partnering with CIKR 
stakeholders, and relies on voluntary information sharing between the 
private sector and DHS to better protect and ensure the resiliency of 
CIKR in the United States. 

The Conference Report accompanying the Department of Homeland Security 
Appropriations Act, 2005, directed DHS to complete an analysis on 
whether the department should require private sector entities to 
provide DHS with existing information about their security measures and 
vulnerabilities in order to improve the department's ability to 
evaluate critical infrastructure protection nationwide.[Footnote 5] 
This direction was consistent with concerns raised by the House 
Appropriations Committee about DHS's progress conducting vulnerability 
assessments for critical infrastructure facilities generally, and 
security measures at chemical facilities in particular. The analysis 
was to include all critical infrastructure, including chemical plants; 
the costs to the private sector for implementing such a requirement; 
the benefits of obtaining the information; and costs to DHS's 
Information Analysis and Infrastructure Protection (IAIP) (presently 
the Office of Infrastructure Protection (IP)) to implement this 
requirement.[Footnote 6] The Conference Report further directed us to 
review the quality of the analysis and report to the House and Senate 
Committees on Appropriations within 3 months after completion of the 
analysis. DHS provided us a copy of the report on February 23, 2009. 
According to DHS, the report was completed in 2005 and information was 
subsequently updated in June 2007.[Footnote 7] However, based on 
discussions with your staff and IP officials, the report was never 
delivered to the Senate and House Appropriation Committees. As agreed 
with your staff in March 2009, due to the age of DHS's report, this 
correspondence summarizes DHS's approach for preparing its report and 
documents the results of our efforts in order to fulfill our 
responsibility as directed in Conference Report 108-774. 

To determine DHS's approach for preparing the report, we reviewed the 
cost-benefit report and met with DHS officials in IP to better 
understand how the report was prepared and why it was prepared in that 
manner. We also compared it to Office of Management and Budget (OMB) 
Circular A-4 which provides criteria federal agencies are to use when 
performing a regulatory analysis. Specifically, the circular, which is 
based on best practices, is designed to standardize the way benefits 
and costs of federal regulatory actions are measured and reported to 
(1) help learn if the benefits of a proposed action are likely to 
justify the costs, and (2) discover which of the possible alternatives 
is the most cost-effective. Among other things, the circular stipulates 
that the regulatory analysis include a quantitative analysis of costs 
and benefits.[Footnote 8] In unusual cases where there is no quantified 
information on either benefits or costs, the circular allows agencies 
to do a qualitative analysis and suggests that professional judgment be 
used to highlight those costs and benefits believed to be the most 
important. In either case, the circular calls for agencies to compare 
the benefits with the costs in the regulatory analysis. 

We conducted this performance audit from February 2009 to June 2009 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 


DHS used two contractors to complete the cost-benefit report at a cost 
of about $3.4 million.[Footnote 9] In August 2005, the first contractor 
developed a draft proposal that discussed the scope of the information 
required to complete the report and the security and vulnerability 
information currently available to DHS. It also proposed surveying the 
public and private sectors to collect information on the costs and 
benefits of providing vulnerability assessment and security information 
to DHS. DHS officials said that DHS rejected this approach because DHS 
was involved in developing a public-private partnership structure and 
officials believed that doing a survey on possible regulatory costs 
would have adversely affected the partnership building process. DHS 
officials also said that the Paperwork Reduction Act (PRA)--which 
requires agency requests for information to undergo internal and Office 
of Management and Budget review and approval and includes, among other 
requirements, public comment periods for the proposed information-
gathering method[Footnote 10]--could have resulted in some delays in 
gathering data for the report, but it was not the primary reason for 
rejecting the proposed survey approach. 

DHS subsequently tasked the second contractor to complete the report 
using a different methodology, and according to DHS, this contractor 
produced a draft report in December 2005. This contractor compiled 
publicly available information on the costs and benefits to the public 
and private sectors of requiring vulnerability and security information 
be provided to DHS. Although the second contractor's report discussed 
potential public and private sector costs and benefits, it did not 
articulate which of these costs and benefits were most important, nor 
did it conclude whether the costs exceeded the benefits, or vice a 
versa, with regard to potential requirements for the private sector to 
provide information on vulnerabilities and existing security measures. 
Circular A-4 states that the objective of cost-benefit analysis is to 
produce a measure of the difference between benefits and costs and that 
when costs and benefits are based on a qualitative analysis, those 
deemed to be the most important are to be highlighted. DHS took receipt 
of the second contractor's report and, according to DHS officials, 
continued to revise it throughout the following year to incorporate 
information from the final NIPP and it's supporting sector specific 
plans.[Footnote 11] In addition to a discussion of potential costs and 
benefits, DHS's final report, dated June 2007, includes a general 
discussion of critical infrastructure risk management and associated 
information needs, an overview of the existing regulatory environment 
for each of the CIKR sectors, and the availability of security 
information and its utility to security partners, such as CIKR owners 
and operators.[Footnote 12] DHS officials said that they did not 
perform a cost-benefit analysis consistent with Circular A-4 because at 
the time they were required to do the report, they did not have 
quantifiable data to do such an analysis. They further explained that 
DHS was developing the report while DHS's Information Analysis and 
Infrastructure Protection group (now IP) was in the process of being 
established and prior to DHS's development of an accepted framework for 
compiling security and vulnerability information and assessing risk. In 
the absence of this framework, the officials said that contractor staff 
was tasked to compile material from published unclassified sources on 
the existing regulatory structure in the 17 sectors and draft the 
report, which was reviewed by DHS staff. They also said that DHS 
updated the report in 2007 to account for changes that had taken place 
since 2005, including a statutory requirement that DHS issue 
regulations requiring vulnerability assessments for certain chemical 
facilities and the development and implementation of site security 
plans for those facilities.[Footnote 13] DHS officials also noted that 
the interim NIPP was available while the draft was being prepared and 
it was used to help guide the development of the final report. 

DHS officials told us that they believe the final report was useful 
because it provided insights on different regulatory approaches across 
sectors and used appendixes to present more detailed regulatory 
overviews of three sectors--the chemical sector, the electricity sub 
sector of the energy sector, and the food and agriculture sector. They 
added that some sectors used this information to help write sector 
specific plans (SSPs) that are to augment the NIPP and detail the 
application of the NIPP framework to each CIKR sector.[Footnote 14] 
Nonetheless, DHS officials said that they believe that the report is 
outdated because DHS's CIKR program has evolved and matured since the 
report was originally completed, including DHS's efforts to promote and 
achieve voluntary information sharing between DHS and the private 
sector. Regarding the latter, DHS officials stated that they believe 
that the type of report directed by the Conference Report--that DHS 
analyze whether private sector entities should be required to provide 
information to the department--conflicts with the partnering/voluntary 
information-sharing approach DHS was already mandated to pursue under 
the Homeland Security Act.[Footnote 15] 

In February 2009, DHS provided us with a separate document referred to 
as the Executive Summary: Update of the Cost Benefit Report. This 
document included an elaboration of how DHS's partnering arrangement 
has evolved since the 2005 report was undertaken. This evolution 
occurred via the formation and continued maturation of the SSA concept, 
where the federal departments and agencies identified in HSPD-7 as 
responsible for CIKR protection activities in specified CIKR sectors 
lead the coordination effort for CIKR protection in those sectors; the 
formation of government and sector coordinating councils (GCCs and 
SCCs);[Footnote 16] and the issuance of critical infrastructure 
protection planning documents, including the NIPP and SSPs. Officials 
identified several other mechanisms that have been developed to share 
CIKR information and improve critical information protection. These 
include the CIKR Information Sharing Environment that is designed to 
address the complex requirements of information sharing among diverse 
sectors having different characteristics such as ownership patterns, 
history of collaboration, types and extent of interdependencies, and 
regulatory requirements. According to DHS, the Infrastructure Analysis 
and Strategy Division and DHS's Homeland Infrastructure Threat and Risk 
Analysis Center (HITRAC)[Footnote 17] have undertaken activities to 
enhance the ability of the private sector to prevent, protect against, 
and respond to terrorist attacks and all-hazards incidents impacting 
CIKR. These activities include individual sector threat assessments and 
the development of a common risk model to be deployed across all 
sectors to evaluate risks associated with infrastructure 
security.[Footnote 18] We did not evaluate whether these actions are 
adequate to address the CIKR security and vulnerability concerns that 
led to the conference report language directing DHS to do the cost- 
benefit report. Such a study on our part would entail, among other 
things, a closer examination of the sources used by DHS to obtain cost 
and benefit information, including whether alternative sources or 
methods would yield more complete data, and discussions with 
representatives from some or all of the CIKR sectors to assess the 
completeness and appropriateness of the DHS approach--which is beyond 
the scope of this review. 

As discussed with your staff, because the DHS report is several years 
old and given DHS's evolving approach to CIKR partnering that it 
reports has improved CIKR information sharing and security, further 
analysis of the report would not be beneficial. Therefore, this 
correspondence represents the fulfillment of our responsibility as 
directed in Conference Report 108-774. 

Agency Comments and Our Evaluation: 

We requested comments on a draft of this report from the Secretary of 
Homeland Security. DHS provided written comments on June 17, 2009 which 
are summarized below and reprinted in Enclosure II. 

In its comments, DHS did not state whether it concurred with the 
contents of the draft report but emphasized that the primary basis for 
the approach taken in 2005 to develop the cost-benefit report was to 
assure that the Department's mandated public-private partnership 
building activity be performed without disruption. It said that a data 
collection effort to identify costs and benefits for a regulatory 
approach to collecting information from the private sector would have 
stopped this process with questionable success at acquiring the 
information. DHS added that the PRA was not the primary factor in the 
approach chosen as suggested in the draft report. We have revised 
language in the report to clarify that the PRA was, according to DHS, a 
contributing factor, not the primary factor, in making the decision 
about which approach to choose. Finally, DHS reiterated that the cost- 
benefit report has proved beneficial to DHS because it helped shape the 
development of the regulatory process put into place for selected 
chemical facilities and provided the basis for developing the current 
CIKR information sharing environment. DHS also provided technical 
comments which we have incorporated where appropriate. 

We will send copies of this correspondence to the Secretary of Homeland 
Security and interested congressional committees and subcommittees. We 
will also make copies available to others on request. In addition, this 
report will be available at no charge on GAO's Web site at [hyperlink,]. 

If you or your staff has any questions about this report or wish to 
discuss the matter further, please contact me at (202) 512-8777 or Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. In addition to the contact named above, John Mortin, Assistant 
Director and Tony DeFrank, Analyst-in-Charge, managed this assignment. 
Chuck Bausell assisted with design and methodology. Thomas Lombardi 
provided legal support and Katherine Davis provided assistance in 
report preparation. 


Signed by: 

Stephen L. Caldwell:
Director, Homeland Security and Justice Issues: 


[End of section] 

Enclosure I: 

Sector-Specific Agencies (SSAs), and Critical Infrastructure and Key 
Resource (CIKR) Sectors: 

The National Infrastructure Protection Plan (NIPP) provides a framework 
for organizing and managing risk to the U.S.'s CIKR. The NIPP outlines 
the roles and responsibilities of the Department of Homeland Security 
(DHS) and other security partners--including other federal agencies, 
state, territorial, local, and tribal governments, and private 
companies. Within the NIPP framework, DHS is responsible for leading 
and coordinating the overall national effort to enhance protection via 
18 CIKR sectors. The NIPP assigns responsibility for CIKR sectors to 
SSAs. As an SSA, DHS has direct responsibility for leading, 
integrating, and coordinating efforts of security partners to protect 
11 CIKR sectors. The remaining sectors are led by eight other federal 
agencies. The following lists the SSAs and their sectors. 

Sector Specific Agency: 

Sector Specific Agency: Departments of Agriculture[A] and Health and 
Human Services[B]; 
Critical Infrastructure and Key Resource Sector: Agriculture and Food. 

Sector Specific Agency: Department of Defense[C]; 
Critical Infrastructure and Key Resource Sector: Defense Industrial 

Sector Specific Agency: Department of Energy; 
Critical Infrastructure and Key Resource Sector: Energy[D]. 

Sector Specific Agency: Department of Health and Human Services; 
Critical Infrastructure and Key Resource Sector: Healthcare and Public 

Sector Specific Agency: Department of the Interior; 
Critical Infrastructure and Key Resource Sector: National Monuments and 

Sector Specific Agency: Department of the Treasury; 
Critical Infrastructure and Key Resource Sector: Banking and Finance. 

Sector Specific Agency: Environmental Protection Agency; 
Critical Infrastructure and Key Resource Sector: Water[E]. 

Sector Specific Agency: Department of Homeland Security: Office of 
Infrastructure Protection; 
Critical Infrastructure and Key Resource Sector: Commercial Facilities; 
Critical Manufacturing; Emergency Services; Nuclear Reactors, 
Materials, and Waste; Dams; and Chemical Sectors. 

Sector Specific Agency: Department of Homeland Security: Office of 
Cyber Security and Communications; 
Critical Infrastructure and Key Resource Sector: Information Technology 
and Communications Sectors. 

Sector Specific Agency: Department of Homeland Security: Transportation 
Security Administration; 
Critical Infrastructure and Key Resource Sector: Postal and Shipping. 

Sector Specific Agency: Department of Homeland Security: Transportation 
Security Administration and U. S. Coast Guard[F]; 
Critical Infrastructure and Key Resource Sector: Transportation 

Sector Specific Agency: Department of Homeland Security: Immigration 
and Customs Enforcement, Federal Protective Service; 
Critical Infrastructure and Key Resource Sector: Government 

Source: 2009 National Infrastructure Protection Plan: 

[A] The Department of Agriculture is responsible for agriculture and 
food (meat, poultry, and egg products). 

[B] The Department of Health and Human Services is responsible for food 
other than meat, poultry, and egg products. 

[C] Nothing in the NIPP impairs or otherwise affects the authority of 
the Secretary of Defense over the Department of Defense (DoD), 
including the chain of command for military forces from the President 
as Commander in Chief, to the Secretary of Defense, to the commander of 
military forces, or military command and control procedures. 

[D] The Energy Sector includes the production, refining, storage, and 
distribution of oil, gas, and electric power, except for commercial 
nuclear power facilities. 

[E] The Water Sector includes drinking water and wastewater systems. 

[F] The U.S. Coast Guard is the SSA for the maritime transportation 

[G] In accordance with HSPD-7, the Department of Transportation and the 
Department of Homeland Security will collaborate on all matters 
relating to transportation security and transportation infrastructure 

[H] The Department of Education is the SSA for the Education Facilities 
Subsector of the Government Facilities Sector. 

[End of table] 

[End of section] 

Enclosure II: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

June 17, 2009: 

Mr. Stephen L. Caldwell: 
Director, Homeland Security and Justice Issues: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Caldwell: 

Re: Draft Report GAO-09-654R, The Department of Homeland Security's 
Critical Infrastructure Protection Cost-Benefit Report (GAO Job Code 

Thank you for the opportunity to review and comment on the draft report 
referenced above. Department of Homeland Security (DHS) officials 
recognize the short timeframe your team had to fulfill responsibilities 
under the Conference Report 108-774 reporting requirement on the costs 
and benefits of mandating private sector security measure and 
vulnerability reporting that accompanied the Department of Homeland 
Security Appropriations Act, 2005. National Protection and Programs 
Directorate (NPPD) officials appreciated your team's professionalism in 
conducting this review in an efficient a way as possible to collect the
information needed. 

The draft report contains no recommendations but summarizes and 
documents DHS's approach to developing this report. NPPD officials 
separately provided specific technical comments as suggestions for 
enhancing the draft report's clarity and accuracy. Officials 
reemphasize that the primary basis for the approach taken in 2005 to 
develop the Cost-Benefit Report was to assure that the Department's 
mandated public-private partnership building activity be performed 
without disruption. A data collection effort to identify costs/benefits 
for a regulatory approach to collecting information from private sector 
would have stopped the process with questionable success at acquiring 
the information. The Paperwork Reduction Act was a factor but not the 
primary factor as the draft suggests. 

The draft report describes the information sharing programs that NPPD 
staff discussed with the U.S. Government Accountability Office (GAO) 
team that have evolved from a public-private partnership foundation 
since 2005. Information from the Cost-Benefit Report helped to shape 
the development of the regulatory process that was put in place for 
selected chemical facilities and the development and implementation of 
site security plans for those facilities. In addition, the framework 
laid out in the Cost-Benefit report provided the basis for the 
development of the current Critical Infrastructure and Key Resource 
(CIKR) Information Sharing Environment described in the draft report. 
This CIKR Environment has since been adopted as the primary private 
sector component of the National Information Sharing Environment by the 
Program Manager of the Information Sharing Environment, the Federal 
Office established under the 2002 Intelligence Reform and Terrorist 
Prevention Act to improve information sharing across the Federal 
government and with its security stakeholders. Consequently, the effort 
to develop the Cost-Study Report has proved beneficial. 


Signed by: 

Jerald E. Levine: 
Departmental GAO/OIG Audit Liaison Office: 

[End of section] 


[1] GAO, Critical Infrastructure: Sector Plans Complete and Sector 
Councils Evolving, [hyperlink,] (Washington, D.C.: July 12, 
2007); and National Cybersecurity Strategy: Key Improvements are Needed 
to Strengthen the Nation's Posture, [hyperlink,] (Washington, D.C.: Mar. 10, 

[2] See generally Pub. L. No. 107-296, 116 Stat. 2135 (2002). Title II 
of the Homeland Security Act, as amended, primarily addresses the 
department's responsibilities for critical infrastructure protection. 

[3] The 17 sectors identified pursuant to HSPD-7 are the agriculture 
and food sector; the banking and finance sector; the chemical sector; 
the commercial facilities sector; the commercial nuclear reactors, 
materials, and waste sector; the communications sector; the dams 
sector; the defense industrial base sector; the drinking water and 
water treatment systems sector; the emergency services sector; the 
energy sector; the government facilities sector; the information 
technology sector; the national monuments and icons sector; the postal 
and shipping sector; the public health and health care sector; and the 
transportation systems sector. DHS created the critical manufacturing 
sector as an 18TH sector in 2008. Enclosure I discusses how the 
National Infrastructure Protection Plan (NIPP) provides the framework 
for organizing and managing risk to the U.S.'s CIKR and shows how the 
NIPP assigns responsibility for CIKR sectors to SSAs. 

[4] DHS issued a revised NIPP in 2009. 

[5] See H.R. Conf. Rep. No. 108-774, at 75-76 (Oct. 9, 2004) 
(accompanying H.R. 4567, the DHS Appropriations Bill, 2005, and enacted 
as Public Law 108-334, 118 Stat. 1298 (2004)). The Conference Report 
did not specify a date for submission. 

[6] As a result of a subsequent DHS reorganization, the applicable 
mission of the Under Secretary for IAIP now resides with the Under 
Secretary for National Protection and Programs. Although the Conference 
Report specifically directed IAIP to conduct this analysis, we have 
generalized this direction to the Department due to its subsequent 

[7] Report to Congress: Mandatory Information Sharing for the 
Protection of Critical Infrastructure and Key Resources: The Costs and 
Benefits of Requiring Information from the Private Sector on Security 
Measures and Vulnerabilities, Department of Homeland Security, the 
Office of Infrastructure Protection (IP), Partnership and Outreach 
Division, (June 2007). This report has been designated For Official Use 
Only (FOUO). 

[8] According OMB Circular A-4, a quantitative analysis of costs and 
benefits would require that benefits and costs be expressed in monetary 
or physical units, if possible, so that the regulatory alternative that 
maximizes net benefits (the difference between benefits and costs) can 
be identified. 

[9] DHS officials told us that, based on available records, the first 
contractor, MITRE, received over $558,000 and the second contractor, 
Energetics, received more than $2.8 million for work related to the 
cost-benefit report. 

[10] The purpose of the Paperwork Reduction Act , among other things, 
is to minimize the paperwork burden for individuals, small businesses, 
and educational and nonprofit institutions, federal contractors, and 
state, local and tribal governments, and other persons resulting from 
the collection of information by or for the federal government. See 31 
U.S.C. § 3501. For a more complete discussion, see GAO, Paperwork 
Reduction Act: New Approaches Can Strengthen Information Collection and 
Reduce Burden, GAO-06-477T (Washington, D.C.: Mar. 8, 2006). 

[11] DHS officials told us that the document was last revised in June 
2007. They said that they continued to coordinate the review of the 
last version of the report within DHS but no further versions were 

[12] DHS's report also contains appendices that cover a variety of 
topics, including the issue of liability as relates to information 
sharing, for example, the damages the owner of a CIKR facility may face 
if it did not address identified vulnerabilities if an incident 
occurred; the applicability of different regulatory structures to 
critical infrastructure protection; and various approaches to the 
conduct of cost-benefit analysis. 

[13] See Pub. L. No. 109-295, § 550, 121 Stat. 1355, 1388-89 (2006). 

[14] Sector Specific Plans are to be developed by the sector specific 
agencies in collaboration with other sector partners. 

[15] See Pub. L. No. 107-296, § 214, 116 Stat. at 2152-55. See also 71 
Fed. Reg. 52,262 (Sept. 1, 2006) (establishing uniform procedures for 
the voluntary sharing of critical infrastructure information with DHS) 
(codified at 6 C.F.R. pt. 29). 

[16] The GCC comprises representatives across various levels of 
government (federal, state, local, tribal, and territorial) as 
appropriate to the security and operational landscape of each 
individual sector. The SCC is the private sector counterpart to the 
GCC. These councils are self-organized, self-run, and self-governed 
organizations that are representative of a spectrum of key stakeholders 
within a sector. SCCs serve as the government's principal point of 
entry into each sector for developing and coordinating a wide range of 
CIKR protection activities and issues. 

[17] According to DHS, HITRAC is a joint infrastructure intelligence 
fusion center that combines the expertise of IP's Infrastructure 
Analysis and Strategy Division with that of the Office of Intelligence 
and Analysis in the Critical Infrastructure Threat Analysis Division. 
DHS officials said that HITRAC is to manage a range of analytic 
activities of Federal, State, local, and private sector decision-makers 
by integrating a variety of models, methodologies, and analytic 

[18] GAO has conducted evaluations of risk modeling, for example, see 
Highway Infrastructure: Federal Efforts to Strengthen Security Should 
be Better Coordinated and Targeted on the Nation's Most Critical 
Highway Infrastructure, [hyperlink,], (Washington, D.C.: January 
2009) and Emergency Transit Assistance: Federal Funding for Recent 
Disasters and Options for the Future, [hyperlink,], (Washington, D.C.: February 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink,]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink,] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 

To Report Fraud, Waste, and Abuse in Federal Programs: 


Web site: [hyperlink,]: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: