Internet Infrastructure: DHS Faces Challenges in Developing a Joint Public/Private Recovery Plan

In response to our recommendation, DHS finalized the National Infrastructure Protection Base Plan in June 2006 and updated the National Response Framework (formerly the National Response Plan) in January 2008. Also in January 2008, DHS finalized Emergency Response Function #2, which is the Communications Annex to the National Response Plan. This Annex provides for the restoration of the public communications infrastructure and ensures the provision of federal communications support to response efforts during incidents of national significance. In addition, in August 2010, DHS officials stated that the National Response Framework's Cyber Incident Annex would be replaced by the National Cyber Incident Response Plan, which would describe how the United States will respond to significant cyber incidents. DHS officials also stated that the National Cyber Incident Response Plan would be finalized following testing during Cyberstorm III, which is scheduled for September 2010.

In April of 2007, DHS commissioned a task force that reviewed National Communication System (NCS) and National Cyber Security Division (NCSD) organizational structures and roles. The task force recommended that NCS and NCSD be physically and functionally merged. Since then, DHS has taken steps to implement the recommendation by, for example, physically co-locating NCS and NCSD personnel in the same office space. In addition, the department said it plans to address other merger-related issues as part of an ongoing strategic planning effort for the area but did not provide a date when this effort is to be finalized.

In August 2010, DHS officials stated that National Cybersecurity and Communications Integration Center (NCCIC) co-locates organizations that are responsible for developing and implementing cyber recovery activities, including US-CERT and the National Communication System's National Coordinating Center for Telecommunications. The center has been designed to serve as a 24-hour, DHS-led coordinated watch and warning center to address threats and incidents affecting the nation's critical information technology and cyber infrastructure. According to DHS officials, the NCCIC concept-of-operations, which is still being drafted, will define the relationships and interdependencies between NCCIC-participating organizations.

As a result of its first national-level cyber exercise conducted in February 2006, called Cyber Storm, DHS identified eight lessons that had significant impact across sectors, agencies, and exercise participants. These lessons involved improving (1) the interagency coordination groups; (2) contingency planning, risk assessment, and roles and responsibilities; (3) integration of incidents across infrastructures; (4) access to information; (5) coordination of response activities; (6) strategic communications and public relations; (7) processes, tools, and technology; and (8) the exercise program. Since then DHS has begun implementing these lessons learned, as we recently reported in September 2008 (see GAO-08-825).

DHS participates in multiple public-private initiatives such as the Cross-Sector Cyber Security Working Group (CSCSWG) and the Information Technology Sector Coordinating Council (ITSCC) that may be used to discuss cybersecurity risks, interdependencies, and plans for recovery in the event of a significant cyber incident. To date, DHS has not yet documented specific governmental functions that it would provide in responding to a major Internet disruption.

DHS provided GAO with a March 2010 draft revision of the National Cyber Incident Response Plan. Consistent with our recommendation, the draft plan defines the conditions that would trigger heightened levels of coordination among government agencies and with the private sector to respond to a cyber incident. DHS officials stated that the draft plan would be finalized following testing during Cyberstorm III, which is scheduled for September 2010.

Consistent with this recommendation, DHS released the Information Technology Sector Baseline Risk Assessment in August 2009. According to this document, DHS collaborated with members of the private and public sectors to develop and document a risk assessment methodology for the Information Technology sector. The document identifies assumptions, such as the sufficiency of an IT-sector member's emergency power capacity, which could pose a challenge to Internet recovery. The document also identifies multiple risks that could affect Internet recovery efforts and references general mitigation strategies that currently exist, are being enhanced, or which could be considered for the future. By documenting these assumptions and developing strategies to manage key challenges outside of the government's control, DHS is better able to facilitate public/private efforts to recover the Internet in case of a major disruption.