INFRASTRUCTURE SELF- ASSESSMENT (ISA) For public and private stakeholders Chad Fullmer Critical Infrastructure Protection (CIP) Office: (907) 428-7000 Email: [email protected] 1 2015 Fall Preparedness Conference
Jan 17, 2018
1
INFRASTRUCTURE SELF-ASSESSMENT (ISA)
For public and private stakeholders
Chad FullmerCritical Infrastructure Protection (CIP)Office: (907) 428-7000Email: [email protected]
2015 Fall Preparedness Conference
‘C’ is for Critical
22015 Fall Preparedness Conference
2015 Fall Preparedness Conference 3
‘I’ is for Infrastructure“Study after study has shown that rebuilding infrastructure is the quickest way to put large numbers of people to work, and the return for each dollar invested in infrastructure renewal is significantly greater than all other investments in the nation’s economy.”
Bob Herbert
Deferred maintenance
- Useable life MOST LOSS
------ vs.------ Infrastructure assessment
+ renewalBEST ROI
2015 Fall Preparedness Conference 4
‘P’ is for Protection
“The caterpillar does all the work, but the butterfly gets all the publicity.”
George Carlin
2015 Fall Preparedness Conference 5
Benefits of CI Awareness“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” Sun Tzu, The Art of War
2015 Fall Preparedness Conference 6
KNOW YOUR WEAKNESSESWhy? (because someone else does)• expedite recovery• maximize improvements
How?• prioritize• plan
2015 Fall Preparedness Conference 7
Infrastructure Protection Principles
2015 Full Preparedness Conference 8
What is ISA?Infrastructure Self-Assessment (ISA)
Purpose: Focus resilience improvement efforts on 1. The most critical vulnerabilities and 2. The widest preparedness gaps
Results:3. Understand4. Prioritize5. Act
2015 Fall Preparedness Conference 9
ISA Process:PHASE 1: Pre-plan
1) Choose, 2) Coordinate, 3) Map
PHASE 2: Prioritize (by Risk)1) Critical, 2) Important, 3) Peripheral
RISK = Probability x Impact
PHASE 3: Site Visit1) Common & restricted areas,
2) Interdependencies/Dependencies,3) Plans, Processes & Pictures
PHASE 5: Take Action1) Critical, 2) Important, 3)Peripheral
Look familiar?
Phase 6: Follow UpNo new steps – just start over
PHASE 4: Re-plan1) Re-choose, 2) Share, 3) Map
2015 Spring Preparedness Conference 10
Phase 1: Choose
Tangible AssetsIntangible Assets Reputation Culture
ThreatsVulnerabilities
PHASE 1: Pre-plan1) Choose, 2) Coordinate, 3) Map
2015 Spring Preparedness Conference 11
Phase 1: CoordinatePHASE 1: Pre-plan
1) Choose, 2) Coordinate, 3) Map
2015 Spring Preparedness Conference 12
Phase 1: Map
City Hall
Public Safety
DOT
School
Airport
Water treatment
PHASE 1: Pre-plan1) Choose, 2) Coordinate, 3) Map
2015 Spring Preparedness Conference 13
Phase 2: Prioritize
PHASE 2: Prioritize (by Risk)1) Critical, 2) Important, 3) Peripheral
RISK = Probability x Impact
C. I. P.
Probability x IMPACT = RISK
2015 Spring Preparedness Conference 14
Phase 2: Prioritize
2015 Spring Preparedness Conference 15
Phase 2: Prioritize
Identify Threats• Natural• Human
PHASE 2: Prioritize (by Risk)1) Critical, 2) Important, 3) Peripheral
RISK = Probability x Impact
2015 Fall Preparedness Conference 16
WHAT’S WRONG WITH THIS PICTURE?
Phase 3: Common & Restricted Areas
PHASE 3: Site Visit1) Common & restricted areas,
2) Interdependencies/Dependencies,3) Plans, Processes & Pictures
2015 Fall Preparedness Conference 17
Phase 3: Dependency & Interdependency
PHASE 3: Site Visit1) Common & restricted areas,
2) Interdependencies/Dependencies,3) Plans, Processes & Pictures
2015 Spring Preparedness Conference 18
Phase 3: Plans & PicturesSubject Matter Experts (SME)• Asset Manager• Police/Fire• Medical• Cyber/IT
PHASE 3: Site Visit1) Common & restricted areas,
2) Interdependencies/Dependencies,3) Plans, Processes & Pictures
2015 Spring Preparedness Conference 19
Phase 4: Re-plan
PHASE 4: Re-plan1) Re-choose , 2) Share, 3) Map
1)Reexamine Plans2)Share the
information3)Map
2015 Spring Preparedness Conference 20
Phase 5: Take Action
Most critical actions first!
BASED ON…? PHASE 5: Take Action1) Critical, 2) Important, 3) Peripheral
Look familiar?
P x I = R
2015 Spring Preparedness Conference 21
Phase 6: Follow UpPhase 6: Follow Up
No new steps – just start over
2015 Fall Preparedness Conference 22
ISA Process:PHASE 1: Pre-plan
1) Choose, 2) Coordinate, 3) Map
PHASE 2: Prioritize (by Risk)1) Critical, 2) Important, 3) Peripheral
RISK = Probability x Impact
PHASE 3: Site Visit1) Common & restricted areas,
2) Interdependencies/Dependencies,3) Plans, Processes & Pictures
PHASE 5: Take Action1) Critical, 2) Important, 3) Peripheral
Look familiar?
Phase 6: Follow UpNo new steps – just start over
PHASE 4: Re-plan1) Re-choose, 2) Share, 3) Map
2015 Fall Preparedness Conference 23
REMEMBER
1. Infrastructure is the best investment.2. If CIP is done right, nothing happens.–Both success and failure are guaranteed.
3. P + I = R4. Plan, prioritize, assess, rinse, and repeat.
2015 Spring Preparedness Conference 24
THE BEGINNING