This is the accessible text file for GAO report number GAO-08-113 
entitled 'Critical Infrastructure Protection: Sector-Specific Plans' 
Coverage of Key Cyber Security Elements Varies' which was released on 
October 31, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: GAO: 

Report to Congressional Requesters: 

October 2007: 

Critical Infrastructure Protection: Sector-Specific Plans' Coverage of 
Key Cyber Security Elements Varies: 

GAO-08-113: 

GAO Highlights: 

Highlights of GAO-08-113, a report to congressional requesters. 

Why GAO Did This Study: 

The nation's critical infrastructure sectors—such as public health, 
energy, water, and transportation—rely on computerized information and 
systems to provide services to the public. To fulfill the requirement 
for a comprehensive plan, including cyber aspects, the Department of 
Homeland Security (DHS) issued a national plan in June 2006 for the 
sectors to use as a road map to enhance the protection of critical 
infrastructure. Lead federal agencies, referred to as sector-specific 
agencies, are responsible for coordinating critical infrastructure 
protection efforts, such as the development of plans that are specific 
to each sector. In this context, GAO was asked to determine if these 
sector-specific plans address key aspects of cyber security, including 
cyber assets, key vulnerabilities, vulnerability reduction efforts, and 
recovery plans. To accomplish this, GAO analyzed each sector-specific 
plan against criteria that were developed on the basis of DHS guidance. 

What GAO Found: 

The extent to which the sectors addressed aspects of cyber security in 
their sector-specific plans varied; none of the plans fully addressed 
all 30 cyber security-related criteria. Several sector plansùincluding 
the information technology and telecommunications sectorsùfully 
addressed many of the criteria, while othersùsuch as agriculture and 
food and commercial facilitiesùwere less comprehensive. The following 
figure summarizes the extent to which each plan addressed the 30 
criteria. 

Graph: Comprehensiveness of Sector-Specific Plans: 

This figure is a vertical stacked bar graph, depicting seventeen 
sectors on the horizontal axis in three categories: comprehensive, 
somewhat comprehensive, and less comprehensive. The vertical axis of 
the graph represents number of criteria, from 0 to 30. All bars meet 
the total of 30 criteria, through a stacking of fully addressed, 
partially addressed and not addressed. The following is an 
approximation of the number of criteria represented in the graph by 
sectors: 

Information technology: Comprehensive; 
Fully addressed: 28;
Partially addressed: 2; 
Not addressed: 0. 

Telecommunications: Comprehensive; 
Fully addressed: 27; 
Partially addressed: 3; 
Not addressed: 0. 

Public health: Comprehensive; 
Fully addressed: 27; 
Partially addressed: 1; 
Not addressed: 2. 

Energy: Comprehensive; 
Fully addressed: 24; 
Partially addressed: 3; 
Not addressed: 3. 

Government facilities: Comprehensive; 
Fully addressed: 24; 
Partially addressed: 3; 
Not addressed: 3. 

Nuclear reactors: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Water: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Chemical: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Dams: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Transportation: Comprehensive; 
Fully addressed: 22; 
Partially addressed: 6; 
Not addressed: 2. 

Emergency services: Comprehensive; 
Fully addressed: 22; 
Partially addressed: 4; 
Not addressed: 4. 

Postal and shipping: Comprehensive; 
Fully addressed: 21; 
Partially addressed: 8; 
Not addressed: 1. 

Banking and finance: Somewhat comprehensive; 
Fully addressed: 19; 
Partially addressed: 7; 
Not addressed: 4. 

Defense industrial base: Somewhat comprehensive; 
Fully addressed: 18; 
Partially addressed: 5; 
Not addressed: 7. 

National monuments: Somewhat comprehensive; 
Fully addressed: 17; 
Partially addressed: 8; 
Not addressed: 5. 

Agriculture and food: Less comprehensive; 
Fully addressed: 10; 
Partially addressed: 10; 
Not addressed: 10. 

Commercial facilities: Less comprehensive; 
Fully addressed: 8; 
Partially addressed: 12; 
Not addressed: 10. 

Source: GAO analysis of agency data. 

[End of graph] 

What GAO Recommends: 

To assist the sectors in securing their cyber infrastructure, GAO 
recommends that the Secretary of Homeland Security request that, by 
September 2008, the sector-specific agencies develop plans that address 
all of the cyber-related criteria. In written comments on a draft of 
this report, DHS concurred with GAO’s recommendation and provided 
technical comments that have been addressed as appropriate. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.GAO-08-11]. For more information, contact David 
Powner at (202) 512-9286 or pownerd@gao.gov. 

[End of section] 

Contents: 

Letter: 

Compliance with Aspects of Cyber Security Criteria: 

Conclusions: 

Recommendation for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Briefing for Congressional Staff: 

Appendix II: Comments from the Department of Homeland Security: 

Appendix III: GAO Contacts and Staff Acknowledgments: 

Figure: 

Figure 1: Comprehensiveness of Sector-Specific Plans: 

[End of section] 

United States Government Accountability Office:
Washington, DC 20548: 

October 31, 2007: 

The Honorable Joseph I. Lieberman: 
Chairman: 
The Honorable Susan M. Collins: 
Ranking Member: 
Committee on Homeland Security and Governmental Affairs: 
United States Senate: 

The Honorable James R. Langevin: 
Chairman: 
Subcommittee on Emerging Threats, Cybersecurity, and Science and 
Technology: 
Committee on Homeland Security: 
House of Representatives: 

Because the nation's critical infrastructure relies extensively on 
computerized information systems and electronic data, the security of 
those systems and information is essential to our nation's security, 
economy, and public health and safety. To help address critical 
infrastructure protection, federal policy has established a framework 
for public and private sector partnerships and identified 17 critical 
infrastructure sectors, including banking and finance, information 
technology, telecommunications, energy, and public health and 
healthcare.[Footnote 1] 

The Department of Homeland Security (DHS) is a key player in these 
partnerships. The agency issued a National Infrastructure Protection 
Plan (NIPP) in June 2006 to be used as a road map for how DHS and other 
relevant stakeholders are to use risk management principles to 
prioritize protection activities within and across the sectors in an 
integrated, coordinated fashion. Lead federal agencies, referred to as 
sector-specific agencies (including DHS, the Department of the 
Treasury, and the Department of Health and Human Services), are 
responsible for coordinating critical infrastructure protection efforts 
with the public and private stakeholders in their respective sectors. 

The NIPP requires each of the lead federal agencies associated with the 
17 critical infrastructure sectors to develop plans to address how the 
sectors' stakeholders would implement the national plan and how they 
would improve the security of their assets, systems, networks, and 
functions. These sector-specific plans are to, among other things, 
describe how the sector will identify and prioritize its critical 
assets, including cyber assets, and define approaches the sector will 
take to assess risks and develop programs to protect these assets. 

As agreed, our objective was to determine if the sector-specific plans 
address key aspects of cyber security, including cyber assets, key 
vulnerabilities, vulnerability reduction efforts, and recovery plans. 
To accomplish this objective, we analyzed each sector-specific plan 
against 30 criteria that were developed on the basis of DHS guidance. 

On August 7 and 20, 2007, we presented a briefing to the staffs of the 
House Subcommittee on Emerging Threats, Cybersecurity, and Science and 
Technology, Committee on Homeland Security, and the Senate Committee on 
Homeland Security and Governmental Affairs, respectively. This report 
transmits the presentation slides we used to brief the staffs and the 
recommendation that we made to the Secretary of Homeland Security. The 
full briefing, including our scope and methodology, is reprinted in 
appendix I. In commenting on a draft of this report, the Director, DHS 
Departmental GAO/OIG Liaison, concurred with our recommendation. In 
addition, DHS provided technical comments that have been addressed in 
this report as appropriate. 

Compliance with Aspects of Cyber Security Criteria: 

The extent to which the sectors addressed aspects of cyber security in 
their sector-specific plans varied; none of the plans fully addressed 
all 30 cyber security-related criteria. Several plans--including those 
from the information technology and telecommunications sectors--fully 
addressed many of the criteria, while others--such as agriculture and 
food and commercial facilities--were less comprehensive. Figure 1 
summarizes the extent to which each plan addressed the 30 criteria. 

Figure 1: Comprehensiveness of Sector-Specific Plans: 

[See PDF for image] 

Comprehensiveness of Sector-Specific Plans: 

This figure is a vertical stacked bar graph, depicting seventeen 
sectors on the horizontal axis in three categories: comprehensive, 
somewhat comprehensive, and less comprehensive. The vertical axis of 
the graph represents number of criteria, from 0 to 30. All bars meet 
the total of 30 criteria, through a stacking of fully addressed, 
partially addressed and not addressed. The following is an 
approximation of the number of criteria represented in the graph by 
sectors: 

Information technology: Comprehensive; 
Fully addressed: 28;
Partially addressed: 2; 
Not addressed: 0. 

Telecommunications: Comprehensive; 
Fully addressed: 27; 
Partially addressed: 3; 
Not addressed: 0. 

Public health: Comprehensive; 
Fully addressed: 27; 
Partially addressed: 1; 
Not addressed: 2. 

Energy: Comprehensive; 
Fully addressed: 24; 
Partially addressed: 3; 
Not addressed: 3. 

Government facilities: Comprehensive; 
Fully addressed: 24; 
Partially addressed: 3; 
Not addressed: 3. 

Nuclear reactors: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Water: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Chemical: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Dams: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Transportation: Comprehensive; 
Fully addressed: 22; 
Partially addressed: 6; 
Not addressed: 2. 

Emergency services: Comprehensive; 
Fully addressed: 22; 
Partially addressed: 4; 
Not addressed: 4. 

Postal and shipping: Comprehensive; 
Fully addressed: 21; 
Partially addressed: 8; 
Not addressed: 1. 

Banking and finance: Somewhat comprehensive; 
Fully addressed: 19; 
Partially addressed: 7; 
Not addressed: 4. 

Defense industrial base: Somewhat comprehensive; 
Fully addressed: 18; 
Partially addressed: 5; 
Not addressed: 7. 

National monuments: Somewhat comprehensive; 
Fully addressed: 17; 
Partially addressed: 8; 
Not addressed: 5. 

Agriculture and food: Less comprehensive; 
Fully addressed: 10; 
Partially addressed: 10; 
Not addressed: 10. 

Commercial facilities: Less comprehensive; 
Fully addressed: 8; 
Partially addressed: 12; 
Not addressed: 10. 

Source: GAO analysis of agency data. 

[End of figure] 

In addition to the variations in the extent to which the plans covered 
aspects of cyber security, there was also variance among plans in the 
extent to which certain criteria were addressed. For example, all plans 
fully addressed identifying a sector governance structure for research 
and development, while fewer than half of the plans fully addressed 
describing any incentives used to encourage voluntary performance of 
risk assessments. 

Without comprehensive plans, certain sectors may not be effectively 
identifying, prioritizing, and protecting the cyber aspects of their 
critical infrastructure protection efforts. For example, with most 
sectors lacking a process for identifying the consequences of cyber 
attacks against their assets, our nation's sectors could be ill- 
prepared to respond properly to a cyber attack. 

The varying degrees to which each plan addressed the cyber security- 
related criteria can be attributed in part to the varying levels of 
maturity of the different sectors. According to DHS officials, the 
sectors that have been working together longer on critical 
infrastructure issues generally have developed more comprehensive and 
complete plans than the sectors with stakeholders that had not 
previously worked together. For example, the plan for the energy sector 
included most of the key information required for each plan element, 
and the chemical sector had worked with DHS to improve the cyber 
component in its plans; this sector's plan was among those categorized 
as comprehensive. Furthermore, for those sectors that had not been 
previously working together on critical infrastructure issues and were 
thus less mature, the limited amount of time to complete the plans--6 
months--was a factor in their plans being less comprehensive and 
complete. 

DHS acknowledges the GAO-identified shortcomings in the plans. DHS 
officials stated that the sector-specific plans represent only the 
early efforts by the sectors to develop their respective plans and 
anticipate that the plans will improve over time. Nevertheless, until 
the plans fully address key cyber elements, certain sectors may not be 
prepared to respond to a cyber attack against our nation's critical 
infrastructure. 

Conclusions: 

The sector-specific plans varied in how comprehensively they addressed 
the cyber security aspects of their sectors. Without comprehensive 
plans, stakeholders within the infrastructure sectors may not 
adequately identify, prioritize, and protect their critical assets, 
systems, networks, and functions; be prepared to respond to a 
significant attack; or identify the cyber risks they face. As the plans 
are updated, it will be important that DHS work with the sector 
representatives to ensure that the areas not sufficiently addressed are 
covered. Otherwise, the plans will remain incomplete and selected 
sectors' efforts will remain insufficient to enhance the protection of 
their computer-reliant assets. 

Recommendation for Executive Action: 

To assist the sectors in securing their cyber infrastructure, we 
recommended that the Secretary of Homeland Security direct the 
Assistant Secretary for Infrastructure Protection and the Assistant 
Secretary for Cybersecurity and Communications to request that by 
September 2008, the sector-specific agencies' plans address the cyber- 
related criteria that were only partially addressed or not addressed at 
all. 

Agency Comments and Our Evaluation: 

We received written comments on a draft of this report from DHS (see 
app. II). In the response, the Director, Departmental GAO/OIG Liaison, 
concurred with our recommendation. The director also proposed replacing 
the term "cyber assets" with "cyber infrastructure" to broaden the 
recommendation and update the Assistant Secretary's title. We agreed 
and addressed his comments accordingly. In addition, the director 
stated that DHS is currently working on an action plan to assist 
sectors in addressing cyber security issues not adequately addressed in 
the initial sector specific plans. Furthermore, DHS provided technical 
comments that have been addressed in this report as appropriate. 

We are sending copies of this report to interested congressional 
committees, the Secretary of Homeland Security, and other interested 
parties. We also will make copies available to others upon request. In 
addition, this report will be available at no charge on GAO's Web site 
at [hyperlink, http://www.gao.gov]. 

Should you or your staffs have any questions on matters discussed in 
this report, please contact Dave Powner at (202) 512-9286 or 
pownerd@gao.gov, or Keith Rhodes at (202) 512-6412, or rhodesk@gao.gov. 
Contact points for our Offices of Congressional: 

Relations and Public Affairs may be found on the last page of this 
report. GAO staff who made key contributions to this report are listed 
in appendix III. 

Signed by: 

David A. Powner: 
Director: 
Information Technology Management Issues: 

Signed by: 

Keith A. Rhodes: 
Chief Technologist:
Applied Research and Methods: 
Center for Technology and Engineering: 

[End of section] 

Appendix I: Briefing for Congressional Staff: 

Critical Infrastructure Protection: Sector-Specific Plans'
Coverage of Key Cyber Security Elements Varies: 

Briefing for the House Committee on Homeland Security, Subcommittee on 
Emerging Threats, Cybersecurity, and Science and Technology: 

August 7, 2007: 

and the Senate Committee on Homeland Security and Governmental Affairs: 

August 20, 2007: 

Table of Contents: 

* Introduction: 
* Objectives, Scope, and Methodology: 
* Results in Brief: 
* Background: 
* Cyber Security Aspects of Sector-Specific Plans: 
* Conclusions: 
* Recommendation for Executive Action: 
* Agency Comments: 
* Attachment 1. Summary Analysis of Individual Sector-Specific Plans: 
* Attachment 2. Overall Summary Analysis of Sector-Specific Plans: 

Introduction: 

Because the nation's critical infrastructure relies extensively on 
computerized information systems and electronic data, the security of 
those systems and information is essential to our nation's security, 
economy, and public health and safety. To help address critical 
infrastructure protection, federal policy established a framework for 
public and private sector partnerships and identified 17 critical 
infrastructure sectors, including banking and finance, information 
technology, telecommunications, energy, and public health and
healthcare. 

The Department of Homeland Security (DHS) is a key player in these 
partnerships and is responsible for developing a National 
Infrastructure Protection Plan (NIPP) as a road map for how DHS and 
other relevant stakeholders are to enhance the protection of critical
infrastructure. Lead federal agencies, referred to as sector-specific 
agencies (including DHS, Treasury, and Health and Human Services), are 
responsible for coordinating critical infrastructure protection efforts 
with the public and private stakeholders in their respective sectors. 

DHS issued NIPP in June 2006. It is a base plan that is to serve as a 
road map for how DHS and other relevant stakeholders should use risk 
management principles to prioritize protection activities within and 
across the sectors in an integrated, coordinated fashion. 

NIPP required each of the lead federal agencies associated with the 17 
critical infrastructure sectors to develop plans to address how the 
sectors' stakeholders would implement the national plan and how they 
would improve the security of their assets and functions. These plans 
are to, among other things, describe how the sector will identify and 
prioritize its critical assets, including cyber assets, and define 
approaches the sector will take to assess risks and develop programs to 
protect these assets. 

Two DHS organizations that have responsibilities associated with the 
NIPP and sector-specific plans: 

* The Office of Infrastructure Protection (OIP) has responsibility for 
overseeing and coordinating the development of the plans and tracking 
and reporting on the progress of implementation. In addition, OIP is 
responsible for 5 sectors (chemical, commercial facilities, dams, 
emergency services, and nuclear). 

* The Office of Cyber Security and Communication (CS&C) has 
responsibility for developing, maintaining, and updating the cyber 
aspects of the NIPP and providing assistance to all sector-specific 
agencies in developing and implementing the cyber aspects of their 
respective sector-specific plans. In addition, CS&C is responsible, as
the designated sector-specific agency, for the information technology 
and communications sectors. 

Objectives, Scope, and Methodology: 

As requested, our objective was to determine if the sector-specific 
plans address key aspects of cyber security, including cyber assets, 
key vulnerabilities, vulnerability reduction efforts, and recovery 
plans. 

We analyzed DHS's guidance provided to the critical infrastructure 
sectors that stated how the sectors should address cyber aspects in 
their sector-specific plans which were to be structured in eight major 
sections. From this analysis, we identified 30 cyber-related criteria 
within the 8 sections. DHS officials from CS&C generally agreed with 
the criteria we developed. Table 1 on the following slide shows the 8 
major sections and the 30 associated criteria. 

Table 1: Cyber-Related Sections: 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects; 
* Identifies stakeholder relationships for securing cyber assets. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements; 
* Describes process to identify cyber dependencies/independences. 

Section 3: Assess Risks: 
* Describes how the risk assessment process addresses cyber elements; 
* Describes a screening process for cyber aspects; 
* Describes methodology to identify potential consequences of cyber 
attacks; 
* Describes methodology for vulnerability assessments of cyber aspects; 
* Describes methodology for threat analyses of cyber aspects; 
* Describes incentives to encourage voluntary vulnerability 
assessments. 

Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects; 
* Describes criteria and basis for prioritization of cyber aspects. 

Section 5: Develop and Implement Protective Programs: 
* Describes process to develop long-term protective plans for cyber 
aspects; 
* Describes process to identify specific cyber-related program needs; 
* Identifies programs to deter, respond, and recover from cyber attack; 
* Addresses implementation and maintenance of protective programs. 

Section 6: Measure Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process; 
* Describes how cyber metrics will be reported to DHS; 
* Includes developing and using cyber metrics to measure progress; 
* Describes how to use metrics to guide future cyber projects. 

Section 7: Critical Infrastructure Protection Research and Development: 
* Describes how technology developments are related to the sector’s 
cyber goals; 
* Describes process to identify cyber security technology requirements; 
* Describes process to solicit information on ongoing cyber research 
and development initiatives; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps; 
* Identifies research and development governance structure. 

Section 8: Managing Sector-Specific Agency Responsibilities: 
* Describes sector-specific agency’s management of NIPP 
responsibilities; 
* Describes process for updating, reporting, budgeting, and training; 
* Describes sector’s coordination structure; 
* Describes process for investment priorities; 
* Describes process for cyber-related information sharing. 

[End of table] 

We then analyzed the sector-specific plans of the 17 critical 
infrastructures to determine the extent to which each plan addressed 
the 30 cyber-related criteria. The following categories were used: 

* fully addressed: the plan specifically addressed the cyber-related 
criteria; 
* partially addressed: the plan addressed parts of the criteria or did 
not clearly address the cyber-related criteria; 
* not addressed: the plan did not specifically address the cyber-
related criteria. 

We met with DHS/CS&C officials to discuss their review and analysis of 
the plans, as well as our review and analysis of the plans. In 
addition, DHS/OIP and CS&C officials provided information related to 
their initiatives to improve the plans. We did not interview officials 
from the sector-specific agencies or sector representatives or review 
the adequacy of the sector's actions to address cyber security within 
their respective sectors. 

Our work was performed at DHS/CS&C in Arlington, Virginia, from 
February 2007 to July 2007 in accordance with generally accepted 
government auditing standards. 

Results in Brief: 

The extent to which the sectors addressed key aspects of cyber security 
in their sector-specific plans varied; none of the plans fully 
addressed all 30 cyber security-related criteria. Several 
plans—including the information technology and telecommunications
sectors—fully addressed many of the criteria, while others—such as the 
agriculture and food and commercial facilities sectors—were not as 
comprehensive. 

In addition to the varying degrees with which the sector-specific plans 
addressed the 30 section criteria, the plans as a whole addressed 
certain criteria more comprehensively than they did others. For 
example, all 17 plans fully addressed the criterion to identify a 
sector governance structure for research and development, while only 7 
plans fully addressed the process for identifying the consequences of 
cyber attacks. Further, only 3 plans fully addressed the criterion to 
describe incentives used to encourage voluntary performance of risk 
assessments. 

Without comprehensive plans, certain sectors may not be adequately 
identifying, prioritizing, and protecting the cyber aspects of their 
critical infrastructure protection efforts. Specifically, with most 
sectors lacking a process for identifying the consequences of cyber 
attacks against their assets, our nation's sectors could be ill 
prepared to respond properly to a cyber attack. 

The varying degrees to which each plan addressed the cyber security-
related criteria can be attributed in part to the varying level of 
maturity of the different sectors: that is, sectors whose stakeholders 
had more experience working together on critical infrastructure issues 
generally had more comprehensive and complete plans than those with 
less prior experience. 

To assist the sectors in securing their cyber assets, we are 
recommending that the Secretary of Homeland Security direct the 
Assistant Secretary for Infrastructure Protection and the Assistant 
Secretary for Cyber Security and Communication to request that by 
September 2008 the sector-specific agencies' plans address the cyber-
related criteria that were only partially addressed or not addressed. 

Background: 

Consistent with the Homeland Security Act of 2002, Homeland Security 
Presidential Directive-7 (1) established DHS as the principal federal 
agency to lead, integrate, and coordinate implementation of efforts to 
protect critical infrastructure and key resources and (2) identified 
lead federal agencies, referred to as sector-specific agencies, that are
responsible for coordinating critical infrastructure protection efforts 
with the public and private stakeholders in their respective sectors. 
It also required DHS to develop a comprehensive and integrated plan by 
December 2004 that outlines national goals, objectives, milestones, and 
key initiatives necessary for fulfilling its responsibilities for 
physical and cyber critical infrastructure protection. 

In 2005, we reported on the status of DHS's key cyber security 
responsibilities, which included developing a NIPP.[Footnote 2] During 
this time, DHS had issued an interim NIPP for improving critical 
infrastructure protection that included cyber security, but that this 
plan was not yet comprehensive and complete. For example, we reported 
that the plan did not include sector-specific cyber security plans, 
lacked required milestones, and was not yet final. We recommended that 
the Secretary of Homeland Security strengthen the department's ability 
to implement key cyber security responsibilities. 

In June 2006, DHS issued a final NIPP. This base plan is to serve as a 
road map for how DHS and other relevant stakeholders should use risk 
management principles to prioritize protection activities within and 
across sectors in an integrated, coordinated fashion. Further, NIPP 
required the lead agencies of the 17 critical infrastructure sectors to
develop sector-specific plans to address how the sector's stakeholders 
would implement the national plan and how each sector would improve the 
security of its assets systems, networks, and functions. The sector-
specific plans are to be developed by the designated sector-specific 
agencies in coordination with relevant government and private-sector
representatives. 

The plans are important because they are to: 

* describe how the sector will identify and prioritize its critical 
assets, including cyber assets such as networks;
* identify the approaches the sector will take to assess risks and 
develop programs to manage and mitigate risk;
* define the security roles and responsibilities of members of the 
sector; and;
* establish the methods that members will use to interact and share 
information related to the protection of critical infrastructure. 

DHS is to use these individual plans to evaluate whether any gaps exist 
in the protection of critical infrastructures on a national level and, 
if so, to work with the sectors to address them. The plans are an 
important step in identifying risk management practices to be 
implemented, which could improve the security of our nation's cyber-
reliant critical infrastructure. These plans do not identify the actual 
assets and vulnerabilities. Instead, the plans identify the approaches 
the sector will take to protect their critical cyber infrastructure. 

DHS announced the release of the plans for the 17 sectors on May 21, 
2007; 7 have been released publicly.[Footnote 3] The sectors were to 
provide status updates to DHS by July 1, 2007. DHS plans to incorporate 
these status reports into an overall critical infrastructure/key 
resources (Cl/KR) report, the "National Cl/KR Protection Annual 
Report," which is due by September 1 of every year to the Executive 
Office of the President. 

Cyber Security Aspects of Sector-Specific Plans: 

The extent to which the sectors addressed aspects of cyber security in 
their sector-specific plans varied; none of the plans fully addressed 
all 30 cyber security-related criteria. Several plans—including the 
information technology and telecommunications sectors—fully addressed 
many of the criteria and others—such as agriculture and food and 
commercial facilities—were less comprehensive. Figure 1 summarizes the 
extent to which each plan addressed the 30 criteria. 

Figure 1: Comprehensiveness of Sector-Specific Plans 

[See PDF for image] 

This figure is a vertical stacked bar graph, depicting seventeen 
sectors on the horizontal axis in three categories: comprehensive, 
somewhat comprehensive, and less comprehensive. The vertical axis of 
the graph represents number of criteria, from 0 to 30. All bars meet 
the total of 30 criteria, through a stacking of fully addressed, 
partially addressed and not addressed. The following is an 
approximation of the number of criteria represented in the graph by 
sectors: 

Information technology: Comprehensive; 
Fully addressed: 28;
Partially addressed: 2; 
Not addressed: 0. 

Telecommunications: Comprehensive; 
Fully addressed: 27; 
Partially addressed: 3; 
Not addressed: 0. 

Public health: Comprehensive; 
Fully addressed: 27; 
Partially addressed: 1; 
Not addressed: 2. 

Energy: Comprehensive; 
Fully addressed: 24; 
Partially addressed: 3; 
Not addressed: 3. 

Government facilities: Comprehensive; 
Fully addressed: 24; 
Partially addressed: 3; 
Not addressed: 3. 

Nuclear reactors: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Water: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Chemical: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Dams: Comprehensive; 
Fully addressed: 23; 
Partially addressed: 6; 
Not addressed: 1. 

Transportation: Comprehensive; 
Fully addressed: 22; 
Partially addressed: 6; 
Not addressed: 2. 

Emergency services: Comprehensive; 
Fully addressed: 22; 
Partially addressed: 4; 
Not addressed: 4. 

Postal and shipping: Comprehensive; 
Fully addressed: 21; 
Partially addressed: 8; 
Not addressed: 1. 

Banking and finance: Somewhat comprehensive; 
Fully addressed: 19; 
Partially addressed: 7; 
Not addressed: 4. 

Defense industrial base: Somewhat comprehensive; 
Fully addressed: 18; 
Partially addressed: 5; 
Not addressed: 7. 

National monuments: Somewhat comprehensive; 
Fully addressed: 17; 
Partially addressed: 8; 
Not addressed: 5. 

Agriculture and food: Less comprehensive; 
Fully addressed: 10; 
Partially addressed: 10; 
Not addressed: 10. 

Commercial facilities: Less comprehensive; 
Fully addressed: 8; 
Partially addressed: 12; 
Not addressed: 10. 

Source: GAO analysis of agency data. 

[End of figure] 

Attachment 1 contains the detailed results of our analysis showing to 
what extent each sector plan addressed each criterion. 

In addition to the variation in the extent to which the plans covered 
aspects of cyber security, there was also variance among plans in the 
extent to which certain criteria were addressed. 

All of the plans fully addressed the following criteria: 

* identifying a sector governance structure for research and 
development;
* describing how the sector-specific agency intends to manage its NIPP 
responsibilities; and; 
* describing the sector's coordinating mechanisms and structures. 

At least 15 of the plans fully addressed the following criteria: 

* characterizing the sector's infrastructure, including the cyber 
reliance;
* identifying stakeholder relationships for securing cyber assets;
* describing a process for updating, reporting, budgeting, and 
training; and; 
* describing a process for cyber-related information sharing. 

Fewer than half of the plans fully addressed the following criteria: 

* describing a process to identify potential consequences of cyber 
attacks;
* describing any incentives used to encourage voluntary performance of 
risk assessments;
* developing and using cyber metrics to measure progress; and; 
* identifying existing cyber-related projects that support goals and 
identify gaps. 

Attachment 2 contains the detailed results of our analysis and shows to 
what extent the sector-specific plans address each of the 30 criteria. 

Without comprehensive plans, certain sectors may not be effectively 
identifying, prioritizing, and protecting the cyber aspects of their 
critical infrastructure protection efforts. For example, with most 
sectors lacking a process for identifying the consequences of cyber 
attacks against their assets, our nation's sectors could be ill-
prepared to respond properly to a cyber attack. 

The varying degrees to which each plan addressed the cyber security-
related criteria can be attributed in part to the varying level of 
maturity of the different sectors. According to DHS officials, the 
sectors that have been working together longer on critical 
infrastructure issues generally have more comprehensive and complete 
plans than the sectors with stakeholders without prior experience 
working together for a common goal. For example, the plan for the 
energy sector included most of the key information required for each 
plan element. This is a result of this sector having a history of 
working to plan and accomplish many of the same activities that are 
being required for the sector-specific plans. In addition, according to 
DHS officials, the chemical sector had worked with DHS to improve the 
cyber component in its plans; this sector's plan was among those 
categorized as comprehensive. 

Further, for those sectors that had not been working together earlier 
on critical infrastructure issues and were thus less mature, the 
limited amount of time to complete the plans was a factor in their 
plans being less comprehensive and complete. The sectors had 6 months 
from the time the NIPP was completed—June 2006—and when plans were
to be completed—December 2006. 

DHS acknowledges the GAO-identified shortcomings in the plans. DHS 
officials stated that the 17 sector-specific plans represent only the 
early efforts by the sectors to develop their respective plans and 
anticipate that the plans will improve over time. Nevertheless, until 
the plans fully address key cyber elements, certain sectors may not be 
prepared to respond to a cyber attack against our nation's critical 
infrastructure. 

Conclusions: 

The sector-specific plans varied in how comprehensively they addressed 
the cyber security aspects of their sectors. Without comprehensive 
plans, stakeholders within the infrastructure sectors may not 
adequately identify, prioritize, and protect their critical assets; be 
prepared to respond to a significant attack; or identify the cyber 
risks they face. As the plans are updated, it will be important that 
DHS work with the sector representatives to ensure that the areas not 
sufficiently addressed are covered. Otherwise, the plans will remain 
incomplete and selected sectors' efforts will remain insufficient to 
enhance the protection of their computer-reliant assets. 

Recommendation: 
To assist the sectors in securing their cyber assets, we are 
recommending that the Secretary of Homeland Security direct the 
Assistant Secretary for Infrastructure Protection and the Assistant 
Secretary for Cyber Security and Communication to request that by 
September 2008 the sector-specific agencies' plans address the cyber-
related criteria that were only partially addressed or not addressed at 
all. 

Agency Comments: 

In commenting on a draft of this briefing, DHS officials generally 
agreed with our findings and recommendations. They also provided 
technical comments, which we have incorporated into this briefing, as 
appropriate. 

Attachment 1: 
Summary Analysis of Individual Sector Specific Plans: 

The following 17 slides summarize our analysis of whether each sector-
specific plan fully, partially, or did not address the 30 cyber 
security-related criteria. 

Agriculture and Food: 

Total amounts: 
fully addressed = 10; 
partially addressed = 10; 
not addressed = 10. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed; 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
partially addressed; 
* Describes process to identify cyber dependencies/independences: not 
addressed; 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: partially addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 	
* Describes methodology for vulnerability assessments of cyber aspects: 
partially addressed; 	
* Describes methodology for threat analyses of cyber aspects: partially 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: partially addressed.
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed; 	
* Describes criteria and basis for prioritization of cyber aspects: 
partially addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
partially addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
not addressed; 
* Addresses implementation and maintenance of protective programs: 
partially addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: not addressed; 
* Describes how cyber metrics will be reported to DHS: not addressed; 
* Includes developing and using cyber metrics to measure progress: not 
addressed; 
* Describes how to use metrics to guide future cyber projects: not 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: not addressed; 
* Describes process to identify cyber security technology requirements: 
partially addressed; 
* Describes process to solicit information on ongoing cyber R&D 
initiatives: not addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: not addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 
* Describes process for investment priorities: not addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 
	
Banking and Finance: 

Total amounts: 
fully addressed = 19; 
partially addressed = 7; 
not addressed = 4. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: partially addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
partially addressed; 
* Describes process to identify cyber dependencies/independences: 
partially addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: partially addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: fully addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
not addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: 
partially addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: partially addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed; 
* Describes process to solicit information on ongoing cyber R&D 
initiatives: not addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: not addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
partially addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: not addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 	 

Chemical: 

Total amounts: 
fully addressed = 23; 
partially addressed = 6; 
not addressed = 1. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: partially 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: partially addressed; 
* Describes how cyber metrics will be reported to DHS: partially 
addressed; 
* Includes developing and using cyber metrics to measure progress: 
partially addressed; 
* Describes how to use metrics to guide future cyber projects: 
partially addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed; 
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Commercial Facilities: 

Total amounts: 
fully addressed = 8; 
partially addressed = 12; 
not addressed = 10. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	
partially addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
not addressed; 
* Describes process to identify cyber dependencies/independences: not 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
partially addressed; 
* Describes a screening process for cyber aspects: partially addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: not addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
not addressed; 	
* Describes methodology for threat analyses of cyber aspects: not 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
partially addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
partially addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: not addressed; 
* Describes process to identify specific cyber-related program needs: 
partially addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
partially addressed; 
* Addresses implementation and maintenance of protective programs: 
partially addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: not addressed; 
* Describes how cyber metrics will be reported to DHS: partially 
addressed; 
* Includes developing and using cyber metrics to measure progress: not 
addressed; 
* Describes how to use metrics to guide future cyber projects: not 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: partially addressed; 
* Describes process to identify cyber security technology requirements: 
partially addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: partially addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Dams: 

Total amounts: 
fully addressed = 23; 
partially addressed = 6; 
not addressed = 1. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: partially addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: partially 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: partially addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: partially 
addressed; 
* Includes developing and using cyber metrics to measure progress: not 
addressed; 
* Describes how to use metrics to guide future cyber projects: 
partially addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: partially addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Defense Industrial Base: 

Total amounts: 
fully addressed = 18; 
partially addressed = 5; 
not addressed = 7. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
partially addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: not addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: not addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
not addressed; 	
* Describes methodology for threat analyses of cyber aspects: not 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
partially addressed;	
* Describes criteria and basis for prioritization of cyber aspects: not 
addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: partially addressed; 
* Describes process to identify specific cyber-related program needs: 
partially addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: not addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: partially 
addressed. 	 

Emergency Services: 

Total amounts: 
fully addressed = 22; 
partially addressed = 4; 
not addressed = 4. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
partially addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: partially addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
not addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: not addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
partially addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: not addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 	 

Energy: 

Total amounts: 
fully addressed = 24; 
partially addressed = 3; 
not addressed = 3. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
not addressed;	
* Describes criteria and basis for prioritization of cyber aspects: not 
addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: partially addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
partially addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: partially addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Government Facilities: 
	
Total amounts: 
fully addressed = 24; 
partially addressed = 3; 
not addressed = 3. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: partially addressed; 	
Identifies stakeholder relationships for securing cyber assets:	
partially addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: not 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
not addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: partially 
addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Information Technology: 

Total amounts: 
fully addressed = 28; 
partially addressed = 2; 
not addressed = 0. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: partially addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
partially addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

National Monuments and Icons: 

Total amounts: 
fully addressed = 17; 
partially addressed = 8; 
not addressed = 5. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: not addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: partially 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: partially addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
partially addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
partially addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: not addressed; 
* Describes how cyber metrics will be reported to DHS: not addressed; 
* Includes developing and using cyber metrics to measure progress: not 
addressed; 
* Describes how to use metrics to guide future cyber projects: not 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
partially addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: partially addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: partially addressed; 
* Describes process for cyber-related information sharing: partially 
addressed. 

Nuclear Reactors, Waste, Materials: 

Total amounts: 
fully addressed = 23; 
partially addressed = 6; 
not addressed = 1. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
partially addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
partially addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: partially addressed; 
* Describes how cyber metrics will be reported to DHS: partially 
addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: partially addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Postal and Shipping: 

Total amounts: 
fully addressed = 21; 
partially addressed = 8; 
not addressed = 1. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: partially addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: fully addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
partially addressed; 
* Addresses implementation and maintenance of protective programs: 
partially addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: not addressed; 
* Describes how cyber metrics will be reported to DHS: partially 
addressed; 
* Includes developing and using cyber metrics to measure progress: 
partially addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
partially addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: partially addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Public Health and Healthcare: 

Total amounts: 
fully addressed = 27; 
partially addressed = 1; 
not addressed = 2. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: not addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
not addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Telecommunications: 

Total amounts: 
fully addressed = 27; 
partially addressed = 3; 
not addressed = 0. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: partially addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
partially addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
fully addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Transportation: 

Total amounts: 
fully addressed = 22; 
partially addressed = 6; 
not addressed = 2. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
partially addressed; 
* Describes a screening process for cyber aspects: not addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: partially addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
fully addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: partially addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: fully addressed; 
* Describes process to identify specific cyber-related program needs: 
fully addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
fully addressed; 
* Addresses implementation and maintenance of protective programs: 
partially addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
fully addressed; 
* Describes how to use metrics to guide future cyber projects: fully 
addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
partially addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: partially addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: not addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Water: 

Total amounts: 
fully addressed = 23; 
partially addressed = 6; 
not addressed = 1. 

Section 1: Sector Profile and Goals: 
* Characterizes cyber aspects: fully addressed; 	
Identifies stakeholder relationships for securing cyber assets:	fully 
addressed. 

Section 2: Identify Assets, Systems, Networks, and Functions: 
* Describes process to identify cyber assets, functions, or elements: 
fully addressed; 
* Describes process to identify cyber dependencies/independences: fully 
addressed. 

Section 3: Assessing Risks: 
* Describes how the risk assessment process addresses cyber elements: 
fully addressed; 
* Describes a screening process for cyber aspects: fully addressed; 
* Describes methodology to identify potential consequences of cyber 
attacks: fully addressed; 
* Describes methodology for vulnerability assessments of cyber aspects: 
partially addressed; 	
* Describes methodology for threat analyses of cyber aspects: fully 
addressed; 
* Describes incentives to encourage voluntary vulnerability 
assessments: fully addressed. 
	
Section 4: Prioritizing Infrastructure: 
* Identifies entity responsible for prioritization of cyber aspects: 
fully addressed;	
* Describes criteria and basis for prioritization of cyber aspects: 
fully addressed. 

Section 5: Developing and Implementing Protective Programs: 
* Describes process to develop long-term protective-plans for cyber 
aspects: partially addressed; 
* Describes process to identify specific cyber-related program needs: 
partially addressed; 
* Identifies programs to deter, respond, and recover from cyber attack: 
not addressed; 
* Addresses implementation and maintenance of protective programs: 
fully addressed. 

Section 6: Measuring Progress: 
* Ensures that integration of cyber metrics is part of measurement 
process: fully addressed; 
* Describes how cyber metrics will be reported to DHS: fully addressed; 
* Includes developing and using cyber metrics to measure progress: 
partially addressed; 
* Describes how to use metrics to guide future cyber projects: 
partially addressed. 

Section 7: Critical Infrastructure Protection R&D: 
* Describes how technology developments are related to the sector's 
cyber: fully addressed; 
* Describes process to identify cyber security technology requirements: 
partially addressed;
* Describes process to solicit information on ongoing cyber R&D 
initiatives: fully addressed; 
* Identifies existing cyber-related projects that support goals and 
identifies gaps: fully addressed; 
* Identifies R&D governance structure: fully addressed. 

Section 8: Managing and Coordinating SSA responsibilities: 
* Describes sector-specific agency's management of NIPP 
responsibilities: fully addressed; 
* Describes process for updating, reporting, budgeting, and training: 
fully addressed; 
* Describes sector's coordination structure: fully addressed; 	
* Describes process for investment priorities: fully addressed; 
* Describes process for cyber-related information sharing: fully 
addressed. 

Attachment 2: 
Overall Summary Analysis of Sector Specific Plans: 

The following table illustrates the number of plans that fully, 
partially, and did not address each criterion. 

Criteria: 
Section 1: Sector Profile and Goals:
Characterizes the sector infrastructure, including cyber reliance:	
No. of plans that fully	addressed: 15;
No. of plans that partially addressed: 2; 	
No. of plans that did not address: 0.  

Criteria: 
Section 1: Sector Profile and Goals:
Identifies stakeholder relationships for securing cyber assets:	
No. of plans that fully	addressed: 15;
No. of plans that partially addressed: 2; 	
No. of plans that did not address: 0. 	 

Criteria: 
Section 2: Identify Assets, Systems, Networks, and Functions:
Describes process to identify cyber assets, functions, or elements:	
No. of plans that fully	addressed: 13;
No. of plans that partially addressed: 3; 	
No. of plans that did not address: 1. 

Criteria: 
Section 2: Identify Assets, Systems, Networks, and Functions:
Describes process to identify cyber dependencies/independences:	
No. of plans that fully	addressed: 13;
No. of plans that partially addressed: 1; 	
No. of plans that did not address: 3.  

Criteria: 
Section 3: Assessing Risks
Describes how the risk assessment process addresses cyber elements: 
No. of plans that fully	addressed: 14;
No. of plans that partially addressed: 3; 	
No. of plans that did not address: 0. 

Criteria: 
Section 3: Assessing Risks
Describes a screening process for cyber aspects: 
No. of plans that fully	addressed: 9;
No. of plans that partially addressed: 5; 
No. of plans that did not address: 3. 

Criteria: 
Section 3: Assessing Risks
Describes methodology to identify potential consequences of cyber 
attacks: 
No. of plans that fully	addressed: 7;
No. of plans that partially addressed: 8; 
No. of plans that did not address: 2. 

Criteria: 
Section 3: Assessing Risks
Describes methodology for vulnerability assessments of cyber aspects: 
No. of plans that fully	addressed: 13;
No. of plans that partially addressed: 2; 
No. of plans that did not address: 2. 

Criteria: 
Section 3: Assessing Risks
Describes methodology for threat analyses of cyber aspects: 
No. of plans that fully	addressed: 11;
No. of plans that partially addressed: 4; 
No. of plans that did not address: 2. 

Criteria: 
Section 3: Assessing Risks
Describes incentives to encourage voluntary vulnerability assessments: 
No. of plans that fully	addressed: 3;
No. of plans that partially addressed: 6; 
No. of plans that did not address: 8. 

Criteria: 
Section 4: Prioritizing Infrastructure
Identifies entity responsible for prioritization of cyber aspects: 	
No. of plans that fully	addressed: 11;
No. of plans that partially addressed: 4; 
No. of plans that did not address: 2. 

Criteria: 
Section 4: Prioritizing Infrastructure
Describes criteria and basis for prioritization of cyber aspects: 	
No. of plans that fully	addressed: 12;
No. of plans that partially addressed: 3; 
No. of plans that did not address: 2. 

Criteria: 
Section 5: Developing and Implementing Protective Programs: 
Describes process to develop long-term protective-plans for cyber 
aspects: 
No. of plans that fully	addressed: 13;
No. of plans that partially addressed: 3; 
No. of plans that did not address: 1. 

Criteria: 
Section 5: Developing and Implementing Protective Programs: 
Describes process to identify specific cyber-related program needs: 
No. of plans that fully	addressed: 11;
No. of plans that partially addressed: 6; 
No. of plans that did not address: 0. 

Criteria: 
Section 5: Developing and Implementing Protective Programs: 
Identifies programs to deter, respond, and recover from cyber attack: 
No. of plans that fully	addressed: 9;
No. of plans that partially addressed: 3; 
No. of plans that did not address: 5. 

Criteria: 
Section 5: Developing and Implementing Protective Programs: 
Addresses implementation and maintenance of protective programs:  
No. of plans that fully	addressed: 13;
No. of plans that partially addressed: 4; 
No. of plans that did not address: 0. 

Criteria: 
Section 6: Measuring Progress
Ensures that integration of cyber metrics is part of measurement 
process: 
No. of plans that fully	addressed: 9;
No. of plans that partially addressed: 3; 
No. of plans that did not address: 5. 

Criteria: 
Section 6: Measuring Progress
Describes how cyber metrics will be reported to DHS: 
No. of plans that fully	addressed: 9;
No. of plans that partially addressed: 6; 
No. of plans that did not address: 2. 

Criteria: 
Section 6: Measuring Progress
Includes developing and using cyber metrics to measure progress: 
No. of plans that fully	addressed: 8;
No. of plans that partially addressed: 5; 
No. of plans that did not address: 4. 

Criteria: 
Section 6: Measuring Progress
Describes how to use metrics to guide future cyber projects: 
No. of plans that fully	addressed: 10;
No. of plans that partially addressed: 4; 
No. of plans that did not address: 3. 

Criteria: 
Section 7: Critical Infrastructure Protection R&D
Describes how technology developments are related to the sector's cyber 
goals: 
No. of plans that fully	addressed: 14;
No. of plans that partially addressed: 2; 
No. of plans that did not address: 1. 

Criteria: 
Section 7: Critical Infrastructure Protection R&D
Describes process to identify cyber security technology requirements: 
No. of plans that fully	addressed: 11;
No. of plans that partially addressed: 6; 
No. of plans that did not address: 0. 

Criteria: 
Section 7: Critical Infrastructure Protection R&D
Describes process to solicit information on ongoing cyber R&D 
initiatives: 
No. of plans that fully	addressed: 13;
No. of plans that partially addressed: 2; 
No. of plans that did not address: 2. 

Criteria: 
Section 7: Critical Infrastructure Protection R&D
Identifies existing cyber-related projects that support goals & 
identifies gaps: 
No. of plans that fully	addressed: 7;
No. of plans that partially addressed: 5; 
No. of plans that did not address: 5. 

Criteria: 
Section 7: Critical Infrastructure Protection R&D
Identifies R&D governance structure: 
No. of plans that fully	addressed: 17;
No. of plans that partially addressed: 0; 
No. of plans that did not address: 0. 

Criteria: 
Section 8: Managing and Coordinating SSA responsibilities
Describes sector-specific agency's management of NIPP responsibilities: 
No. of plans that fully	addressed: 17;
No. of plans that partially addressed: 0; 
No. of plans that did not address: 0. 

Criteria: 
Section 8: Managing and Coordinating SSA responsibilities
Describes process for updating, reporting, budgeting, and training: 
No. of plans that fully	addressed: 16;
No. of plans that partially addressed: 1; 
No. of plans that did not address: 0. 

Criteria: 
Section 8: Managing and Coordinating SSA responsibilities
Describes sector's coordination structure: 
No. of plans that fully	addressed: 17;
No. of plans that partially addressed: 0; 
No. of plans that did not address: 0. 

Criteria: 
Section 8: Managing and Coordinating SSA responsibilities
Describes process for investment priorities: 
No. of plans that fully	addressed: 14;
No. of plans that partially addressed: 1; 
No. of plans that did not address: 2. 

Criteria: 
Section 8: Managing and Coordinating SSA responsibilities
Describes process for cyber-related information sharing: 
No. of plans that fully	addressed: 15;
No. of plans that partially addressed: 2; 
No. of plans that did not address: 0. 

[End of section] 

Appendix II: Comments from the Department of Homeland Security:

U.S. Department of Homeland Security: 
Washington, DC 20528: 

October 16, 2007: 

Mr. David A. Powner: 
Director: 
Information Technology Management Issues: 
Government Accountability Office: 
Washington, DC 20548: 

Dear Mr. Powner:

Re: Draft Report GAO-07-1191, Critical Infrastructure Protection Sector-
Specific Plans' Coverage of Key Cyber Security Elements Varies.

Thank you for the opportunity to review the draft report.

The following represents the Department's response to the GAO 
recommendation. 

Recommendation:

To assist the sectors in securing their cyber assets, we recommend that 
the Secretary of Homeland Security direct the Assistant Secretary for 
Infrastructure Protection and the Assistant Secretary for Cyber 
Security and Communication to request that by September 2008 the sector-
specific agencies' plans address the cyber related criteria that were 
only partially addressed or not addressed at all.

Response:

Concur. However, we propose a revision to the recommendation as follows 
To assist the sectors in securing their cyber infrastructure, we are 
recommending that the Secretary of Homeland Security direct the 
Assistant Secretary for Infrastructure Protection and the Assistant 
Secretary for Cybersecurity and Communications to request that by 
September 2008 the sector-specific agencies' plans address the cyber-
related criteria that were only partially addressed or not addressed.

Rationale: Infrastructure is a broader term than assets. Suggest using 
infrastructure for consistency with NIPP concept of assets, systems, 
networks, and functions.

DHS has adopted the language of Section 514 of the Homeland Security 
Act (6 U.S.C. 321c(b)) establishing the position of Assistant Secretary 
for "Cybersecurity" and Communications.

The Cybersecurity and Communications National Cyber Security Division 
is currently working on an action plan to assist sectors in addressing 
cyber security issues not adequately addressed in the initial Sector-
Specific Plans (SSPs).

Sincerely,

Signed by: 

Steven J. Pecinovsky: 
Director: 
Departmental GAO/OIG Liaison Office

[End of section]

Appendix III: GAO Contacts and Staff Acknowledgments:

GAO Contacts:

David A. Powner at (202) 512-9286 or pownerd@gao.gov: 
Keith A. Rhodes at (202) 512-6412 or rhodesk@gao.gov:

Staff Acknowledgments:

In addition to the contacts named above, the following also made key 
contributions to this report: Scott Borre, Barbara Collier, Neil 
Doherty, Michael Gilmore, Nancy Glover, Franklin Jackson, Barbarol 
James, and Eric Winter.

[End of section] 

Footnotes: 

[1] The White House, Homeland Security Presidential Directive 7 
(Washington, D.C.: Dec. 17, 2003); and Department of Homeland Security, 
National Infrastructure Protection Plan (Washington, D.C.: 2006).

[2] GAO, Critical Infrastructure Protection: Department of Homeland 
Security Faces Challenges in Fulfilling Cybersecurity Responsibilities. 
GAO-05-434 (Washington, D.C.: May 26, 2005).

[3] New, published versions of the plans are due every 3 years; 
however, new internal versions of the plans are to be completed every 
year. 

[End of section] 

GAO's Mission:

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony:

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates."

Order by Mail or Phone:

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, DC 20548:

To order by Phone: Voice: 
(202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061:

To Report Fraud, Waste, and Abuse in Federal Programs:

Contact:

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470:

Congressional Relations:

Gloria Jarmon, Managing Director, jarmong@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, DC 20548: 

Public Affairs:

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, DC 20548: