Infrastructure Resilience Planning Framework (IRPF) - CISA

Transcription

InfrastructureResilience PlanningFramework (IRPF)OCTOBER 2021 VERSION 1.0

SECTION 0SECTION 1InfrastructureResilience PlanningFramework (IRPF)SECTION 2The Cybersecurity and Infrastructure Security Agency (CISA) has developed theInfrastructure Resilience Planning Framework (IRPF) to enable the incorporation of securityand resilience considerations in critical infrastructure planning and investment decisions.The IRPF is organized as follows:SECTION 3Section 0. OverviewSection 1. Lay the FoundationSection 2. Critical Infrastructure IdentificationSection 3. Risk AssessmentSection 4. Develop ActionsSECTION 4Section 5. Implement & EvaluateAll ToolsAll ResourcesGlossaryInfrastructure Resilience Planning Framework (IRPF)2SECTION 5October 2021 Version 1.0

SECTION 00. OverviewThis section addresses the following:0.1 PLANNING FOR RESILIENT INFRASTRUCTURE0.2 BENEFITS OF THE IRPF0.3 THE INFRASTRUCTURE RESILIENCE PLANNING FRAMEWORK (IRPF)0.4 ALIGNMENT TO OTHER PROCESSES0.5 RESOURCES FOR FUNDING AND TECHNICAL ASSISTANCEOctober 2021 Version 1.0Infrastructure Resilience Planning Framework (IRPF)3

Understand and communicate how infrastructure resiliencecontributes to community resilience;October 2021 Version 1.0The IRPF is not a definitive roadmap, but rather a flexible set of guidancedocuments, tools, and resources to kickstart infrastructure security andresilience planning and incorporate it into existing planning mechanisms.*While the IRPF is structured as a set of sequential steps, the usercan choose which steps and sets of resources to more fully considerinfrastructure in any existing or on-going planning process. Communitiescan review the framework to determine where they are in the planningspectrum and choose the guidance and tools that best serve their needs.Communities with limited time and resources may want to focus on theinfrastructure sectors that support critical functions, such as energy,communications, transportation, and water and wastewater systemsinitially, with the potential to expand later.Conversely, communities with more time and resources could consider allother critical infrastructure sectors deemed important and/or vital to thecontinued performance of key social and economic functions integral tothe community or regional prosperity.* Throughout this guide, we provide links to tools and resources developed by partners other than the Federal Government. Thisinformation is provided “as is” for informational purposes only. CISA does not provide any warranties of any kind regarding thisinformation. CISA does not endorse any entity, product or service, including any subjects of analysis. Any reference to specificcommercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or implytheir endorsement, recommendation, or favoring by CISA.Infrastructure Resilience Planning Framework (IRPF)4SECTION 5 Identify how threats and hazards might impact the normal functioningof community infrastructure and delivery of services;0.2 BENEFITS OF THE IRPFSECTION 4This Framework provides methods and tools to address criticalinfrastructure security and resilience through planning, by helpingcommunities and regions:For the purpose of this document, “community” should be understoodto include not just individual cities or towns, but also multijurisdictionalregional authorities conducting planning and stakeholders with commoninterests or working on a common corridor to enhance the resilience ofrelated infrastructure systems.SECTION 3The Cybersecurity and Infrastructure Security Agency (CISA) developedthe Infrastructure Resilience Planning Framework (IRPF) to provide anapproach for localities, regions, and the private sector to work together toplan for the security and resilience of critical infrastructure services in theface of multiple threats and changes. The primary audience for the IRPFis state, local, tribal, and territorial governments and associated regionalorganizations; however, the IRPF can be flexibly used by any organizationseeking to enhance their resilience planning. In many ways, the IRPFcomplements and supplements other planning activities such as NationalInstitute of Standards and Technology’s (NIST) Community ResiliencePlanning Guide (CRPG). It provides tools and resources for integratingcritical infrastructure into planning as well as a framework for workingregionally and across systems and jurisdictions. Recover quickly from disruptions to the normal functioning ofcommunity and regional infrastructureSECTION 2Infrastructure is the backbone of our communities, providing notonly critical services (such as water, transportation, electricity, andcommunications), but also the means for health, safety, and economicgrowth. These systems often extend beyond our communities providingservice to entire regions and contributing to the delivery of NationalCritical Functions. Given the vital importance of infrastructure to oursocial and economic well-being, it is imperative we ensure our networksare strong, secure, and resilient. In order for communities to thrivein the face of uncontrollable circumstances and adapt to changingconditions (e.g., evolving security threats, impacts from extreme weather,technological development, and socio-economic shifts), we must work tomake our infrastructure more resilient. Integrate infrastructure security and resilience considerations,including the impacts of dependencies and cascading disruptions, intoplanning and investment decisions; andSECTION 10.1 PLANNING FOR RESILIENT INFRASTRUCTURESECTION 00. Overview Prepare governments, owners and operators to withstand and adapt toevolving threats and hazards;

SECTION 0The IRPF helps users explore dependency relationships betweeninfrastructure systems to better understand infrastructure risk,develop projects and strategies to address it, and identify funding andimplementation resources to take action.Ultimately infrastructure resilience contributes to a more resilientcommunity, and can help develop and maintain a strong, safe, andeconomically vibrant place to live and work. This can help form a selfreinforcing cycle whereby increased social and economic resilience leadto increased infrastructure resilience and vice versa.SECTION 10.3 THE INFRASTRUCTURE RESILIENCE PLANNING FRAMEWORK (IRPF)2345Lay iskAssessmentDevelopActionsImplement &EvaluateIn Step 1, Lay the Foundation, communities define and scope the planningeffort, form a planning team to execute the effort, and review existingdata, plans, studies, maps, and other resources.Step 3, Risk Assessment, walks communities through the process ofconducting a risk assessment of critical infrastructure to include evaluatingvulnerabilities to threats and hazards, and consequences that may result.Step 4, Develop Actions, provides guidance on the development of astrategic action plan for addressing risk and enhancing infrastructureresilience by identifying and prioritizing potential solutions.RESOURCES AVAILABLE!Throughout this guide, the IRPF provides assistance as indicated bythe symbols below. The goal of this is to provide a comprehensivelist of resilience planning tools available to all jurisdictions. The IRPFidentifies resources by entity (federal, state, non-profit, etc.), eligibility,infrastructure sector, etc.RESOURCESTOOLSQUICK TIPSNOTESSECTION 4Step 2, Critical Infrastructure Identification, provides guidance tocommunities on how to identify and prioritize infrastructure and evaluatedependencies among infrastructure systems.To support these efforts, the IRPF also includes an assortment ofresources and tools to assist communities as they move through thevarious steps of the IRPF.SECTION 3The IRPF is designed to be an easy-to-use framework for incorporatingcritical infrastructure resilience into local, regional, and Tribal plans. It isintended to help communities, regions, and infrastructure owners andoperators better understand critical infrastructure risk, identify opportunitiesto enhance resilience, and inform policy and investment decisions.SECTION 21TERMSOctober 2021 Version 1.0Infrastructure Resilience Planning Framework (IRPF)5SECTION 5Step 5, Implement & Evaluate, focuses on incorporating infrastructureresilience projects and strategies into community and regional plans andprocesses for measuring success.

SECTION 0SECTION 1The IRPF encourages planners to take a functional, system-basedapproach when considering critical infrastructure. Individual infrastructureassets are only as important as the ultimate function they help provide:it may not matter that a water treatment plant or pumping stationis disrupted during an incident, for example, if there are adequatealternatives for providing potable water to the community until thatsystem can be restored. Alternately, infrastructure systems are highlyinterconnected, and disruption in one may have cascading impacts thataffect a range of other infrastructure systems. Because of these twofactors, the IRPF encourages planners to consider the critical functionsprovided by infrastructure systems as well as the dependencies that existwithin and between those systems. A strong understanding of these twofactors can help planners identify strategies and projects to reduce theirrisk and make better investments in resilience.SECTION 2SECTION 3The IRPF can be applied to all 16 sectors of critical infrastructureidentified by Presidential Policy Directive 21 (PPD-21) – CriticalInfrastructure Security and Resilience, which establishes a national policyto strengthen and maintain secure, functioning, and resilient criticalinfrastructure against physical and cyber threats. PPD-21 identifies 16critical infrastructure sectors whose assets, systems, and networks,whether physical or virtual, are considered so vital to the United Statesthat their incapacitation or destruction would have a debilitating effecton security, national economic security, national public health or safety,or any combination thereof. These critical infrastructure sectors are listedin Table 1, including a brief description of the typical components thatcomprise each sector.Infrastructure Resilience Planning Framework (IRPF)6SECTION 5October 2021 Version 1.0SECTION 4Within every community and region, these sectors provide criticalfunctions through infrastructure systems. These systems are composedof assets that are linked to and reliant on one another, and the continuedoperation of these systems is dependent not only on their own assets,but also other systems in other sectors. Importantly, nearly all sectorsare reliant on energy, water and wastewater, communications, andtransportation systems to function. The IRPF helps users examine theseinfrastructure systems, identify key dependencies within and betweenthem, and incorporate that knowledge into planning.

SECTION 0Table 1. Critical Infrastructure SectorsPublicly- and privately-owned facilities that draw large crowds of people for entertainment and/or media; gaming; lodging; outdoor events;public assembly; real estate; retail; and sports purposes.3. CommunicationsVoice and data services and/or terrestrial, satellite, and wireless communication networks.4. Critical ManufacturingFacilities supporting the manufacture of primary metals; machinery; electrical equipment, appliances, and components; andtransportation equipment.5. DamsAssets in the sector include dam projects, hydropower plants, navigation locks, levees, dikes, hurricane barriers, mine tailings, and otherindustrial waste impoundments. The National Inventory of Dams lists more than 100,000 dams throughout the United States. A large anddiverse set of public and private entities own and operate these facilities under highly distributed regulatory oversight from federal, state,and local entities.6. Defense Industrial BaseLaboratories, special purpose manufacturing facilities, organizations, and supply chains that perform research and development, design,manufacturing, systems integration, maintenance and servicing of military weapon systems, subsystems, components, subcomponents,or parts that support military operations.7. Emergency ServicesFacilities, communications structures; other specialized equipment supporting/housing law enforcement, fire and rescue services,emergency medical services, emergency management, and public works.8. EnergyFacilities and systems for electricity generation, transmission, and distribution, and for oil and natural gas extraction, refining, anddistribution.9. Financial ServicesDepository institutions, providers of investment products, insurance companies, other credit and financing organizations, and theproviders of the critical financial utilities and services that support these functions.10. Food and AgricultureAreas or facilities associated with the production, processing, and delivery of consumable products (e.g., restaurants, food outlets, foodfacilities, and farms).11. Government FacilitiesFacilities owned or leased by federal, state, local, territorial, and tribal governments, as well as government and private sector-ownededucation facilities and national monuments and icons.12. Healthcare & Public HealthPublic and private healthcare facilities, research centers, suppliers, manufacturers, and other physical assets.13. Information TechnologyPhysical assets and virtual systems and networks involved in creating information technology products and services, such as researchand development, manufacturing, distribution, upgrades, and maintenance.14. Nuclear Reactors, Materials,and WasteNuclear power reactors and/or their facilities, research and test reactors, cooling ponds, and fuel cycle facilities.15. Transportation SystemsAviation, terrestrial or maritime transportation systems (e.g., mass transit, ships, railroad, roadways, and pipeline systems).16. Water/Wastewater SystemsPotable water systems, wells and wastewater treatment systems.October 2021 Version 1.0Infrastructure Resilience Planning Framework (IRPF)7SECTION 52. Commercial FacilitiesSECTION 4Facilities that manufacture basic chemicals, specialty chemicals, agricultural chemicals, pharmaceuticals, and consumer products.SECTION 31. ChemicalSECTION 2TYPICAL COMPONENTSSECTION 1CRITICAL INFRASTRUCTURESECTOR

Alignment of IRPF to Federal Planning and Risk ManagementProcessesThis matrix illustrates how the IRPF is in alignment with andcomplimentary to the various other existing federal risk and/orresilience planning processes and guidelines.View resource in the Infrastructure Resilience Planning Resources.Table 2. Planning Efforts the IRPF Can InformEXISTING FEDERAL, STATE, LOCAL, TRIBAL & TERRITORIAL PLANSComprehensive/General PlansLong-Term Recovery PlansEconomic Development PlansPre-Disaster Recovery PlansQUICK TIPEmergency Operations PlansSpecific/Area Development PlansOutputs from the IRPF can inform Step 3 of the CRPG,Characterizing the Built Environment, and can support nearly everyphase of the hazard mitigation planning process by supporting adeeper dive into critical infrastructure and dependencies, gettinginfrastructure owners to the table, and analyzing risk from hazards,which can in turn be used by the community to apply for Federal grantfunding. For additional resources, please refer to the InfrastructureResilience Planning Tools.FEMA Logistics CapabilityAssistance Tool (LCAT)Threat and Hazard Identificationand Risk Assessment (THIRA)Growth Management PlansTransportation PlansHazard Mitigation PlansWatershed Management PlansHousing PlansOther local and regional plans8SECTION 5Infrastructure Resilience Planning Framework (IRPF)SECTION 4Land Use PlansSECTION 3Capital Improvement PlansOctober 2021 Version 1.0SECTION 2The steps and the associated tools can be easily integrated intoother planning processes, such as comprehensive, hazard mitigation,environmental, capital improvement programming, and regionaltransportation. In fact, a key benefit of the IRPF is that it can help identifyresilience projects that can be incorporated into these plans, allowinga community to build its resilience over the long-term and providing aprioritized list of potential projects that can be implemented with Federalfunding following a disaster. Additionally, the IRPF aligns with andsupports the Federal Emergency Management Agency (FEMA) NationalMitigation Investment Strategy and the U.S. Government AccountabilityOffice (GAO) Disaster Resilience Framework.THERE’S A RESOURCE FOR THAT!SECTION 1It is important to note that the IRPF was developed to align with andinform other federal, state, local, tribal, and territorial planning efforts acommunity may be responsible for executing. Table 2 identifies some ofthe existing planning efforts which the IRPF can inform.SECTION 00.4 ALIGNMENT TO PLANNING EFFORTS ANDFEDERALLY RECOGNIZED PROCESSES

SECTION 00.5 RESOURCES FOR FUNDING OPPORTUNITIESAND TECHNICAL ASSISTANCESECTION 1A key feature of planning is determining resource availability to developand carry out planning and implementation. The IRPF provides acompendium of these resources in both a document and a user-friendlymatrix, outlining funding opportunities and technical assistance that canhelp communities make planning a reality.THERE’S A TOOL FOR THAT!SECTION 2Compendium of Programs and Mechanisms for FundingInfrastructure ResilienceThe Compendium of Programs and Mechanisms for FundingInfrastructure Resilience provides a list of potential funding andtechnical assistance sources with links.View tool in the Infrastructure Resilience Planning ToolsSECTION 3SECTION 4Infrastructure Resilience Planning Framework (IRPF)9SECTION 5October 2021 Version 1.0

1. Lay the FoundationSECTION 1This section addresses the following:1.1 IDENTIFY A PROJECT CHAMPION1.2 DEFINE AND SCOPE THE EFFORT1.3 COLLECT AND REVIEW EXISTING INFORMATION1.4 FORM COLLABORATIVE PLANNING GROUP1.5 ESTABLISH GOALS AND OBJECTIVESOctober 2021 Version 1.0Infrastructure Resilience Planning Framework (IRPF)10

SECTION 01. Lay the FoundationDefine andScope theEffortCollect andReview ExistingInformationEstablish Goalsand ObjectivesSECTION 21.2 DEFINE AND SCOPE THE EFFORTPrior to integrating the IRPF into a planning process, several questionsshould be considered to define the effort: What is driving the desire or need for resilience planning? What are the community’s resilience goals and objectives? Are there specific shortcomings in infrastructure serving the communitythat need to be addressed?Once the overall direction of the effort has been determined, a communitycan more effectively allocate time, funds, and personnelto match the scope of the effort.SECTION 3Step 1 of the IRPF lays the foundation for success by providing guidanceon how to develop initial buy-in, form a collaborative planning group, andcollect and review existing data, plans, studies, maps, or other technicalresources that may be relevant in informing the planning effort. Whilethis section is structured as a sequential process, many of these “steps”occur simultaneously and iteratively. For example, as a champion andplanning team are identified, users may wish to revisit their scope andre-evaluate what past assessments and planning activities are relevantto their current effort. Planners should consider how the IRPF can bestsupplement their current planning process, and which steps will add themost value. Ultimately, the framework is intended to be flexible--users areencouraged to adapt the IRPF process as best meets their needs.FormCollaborativePlanning GroupSECTION 1Identify aProject Champion1.1 IDENTIFY A PROJECT CHAMPIONOne critical component of success for the IRPF planning processis process documentation. At all stages of the IRPF, coordinatingleadership and documenting all planning efforts is very important.Take care to ensure proper note-taking, and try to keep regularbackups (with redundancies, if possible) of all relevant files.Infrastructure Resilience Planning Framework (IRPF)11SECTION 5October 2021 Version 1.0PLEASE NOTESECTION 4To develop buy-in, it is important for a community official who championsthe importance of resilience to provide support in the form of time andresources to planning efforts. This official can be a mayor, memberof a city council or board of supervisors, tribal leader or a communityor regional planner who is leading the development of a plan. What isimportant, is that this individual is able to actively support the planningprocess and implementation efforts.

1.2.3 Conduct Preliminary ActivitiesIt is important to adequately staff and fund planning efforts such thatresources are dedicated commensurate with resilience goals and thecomplexity of the work entailed in meeting them. In recognition of time andresource constraints that may exist, the IRPF is designed to support andcomplement existing or ongoing local and regional planning activities. Thus,it is anticipated that nominal additional resources and time will be requiredto incorporate the infrastructure resilience concepts outlined in the IRPF.Once the planning team lead has been identified, he/she should conductpreliminary activities to lay the foundation for a successful effort. Theseactivities include:SECTION 1 Defining the purpose of the effort and identifying its relationship toother community planning effortsSECTION 01.2.1 Time and Resources Defining the scope of the effort (including the planning area) Articulating goals and objectives and outlining a strategy for the effort Developing a preliminary schedule Securing a meeting facilityCommunities may be able to save money by incorporating IRPFprocesses, tools, and resources with existing planning practices beingfunded by grants or technical assistance, such as hazard mitigation,comprehensive, or economic development planning. Identifying a facilitator to facilitate discussions during planning groupmeetings (if applicable)SECTION 2QUICK TIP Identifying stakeholders that have an interest or information critical tothe effort1.3 COLLECT AND REVIEW EXISTINGINFORMATION1.2.2 Identify a Planning Team LeadWHAT MAKES A GOOD PLANNING TEAM LEAD?1. W orking knowledge of local and regional infrastructure, such as public works2. Understanding of threats and hazards, risks, and consequencesOther existing community plans should also be reviewed to identifyinformation pertinent to the current planning effort. See Table 2 inSection 0.2 for a list of community plans to review. During the review,the strategies in these existing plans should be compared to identify anyinconsistencies or conflicts that might be resolved through the currentplanning effort.4. Ability to perform administrative, coordination, and event-planningfunctions and facilitate planning sessionsOctober 2021 Version 1.0Infrastructure Resilience Planning Framework (IRPF)12SECTION 53. Ability to engage a broad spectrum of stakeholders to participate in theplanning process and provide expertise on critical infrastructure issuesPrior to the first planning meeting, the planning team lead shouldidentify and review data and information pertinent to the community’sinfrastructure assets, systems, and networks, as well as data andinformation on threats, hazards, and disaster events in the community.SECTION 4Table 3. Planning Team Lead QualificationsTo establish a solid foundation for participants, it is important to identifyprevious planning efforts, studies, mapping, and other data that caninform the effort. These data resources can come from state, local, tribal,and territorial (SLTT), regional, or federal sources.SECTION 3Strong leadership is needed throughout the IRPF integration process,and a planning team lead should serve as a project manager. In somecases, the lead will be the project champion but at a minimum, the leadshould report to the project champion, community officials and others,as necessary, to provide progress updates and results of the variousactivities related to the planning process. Table 3 identifies qualificationsfor a good planning team lead.

SECTION 0QUICK TIPTHERE’S A RESOURCE FOR THAT!While overall scope and objectives will be driven by the natureof the planning activity being undertaken, it can help to think throughthe goals and approach for enhanced consideration of criticalinfrastructure within the planning process. Several steps can assist inthis process:Data Collection – Sample List of ResourcesThe goal of this list is to encourage that planners employing the IRPFframework identify all previous relevant efforts.SECTION 2View resource in the Infrastructure Resilience Planning Resources.Comparison of Existing Community PlansThe Plan Integration for Resilience Scorecard is a plan evaluationmethod developed by Department of Homeland Security (DHS)Science and Technology through its Coastal Resilience Center ofExcellence partner at Texas A&M University. The scorecard canhelp communities evaluate and coordinate their various plans (e.g.,transportation, economic development, hazard mitigation, emergencymanagement, etc.) so that they present consistent strategies andwork together to reduce vulnerabilities to hazards.SECTION 3View the resource at this link & in the Infrastructure ResiliencePlanning Resources.SECTION 4Infrastructure Resilience Planning Framework (IRPF)13SECTION 5October 2021 Version 1.0SECTION 1 Define knowledge gaps: At the outset, it can be valuable toarticulate the infrastructure resilience knowledge gaps you seekto resolve. In many cases, these knowledge gaps will includedetermining how critical functions or services are supported byinfrastructure systems, what dependencies exist between systems,and which systems are vulnerable to disruption. This process doesnot have to be exhaustive but can help planners and participantsthink expansively about the infrastructure systems and issues thatshould be examined during planning. Refine scope: Once knowledge gaps have been defined, refiningscope can help focus the role of considering infrastructureresilience within your planning process. The scope of the effortshould be wide enough to inform planning, but narrow enough thatit is commensurate with the timeline and resources associated withthe larger planning project. Develop data collection strategy: Based on scope and identifiedknowledge gaps, a strategy can be developed to define whatinformation needs to be collected, how and when it will be gathered,and what participants and partners should be involved. Ultimately,the goal of the data collection strategy is to spell out what mustbe gathered to better understand infrastructure systems and theirresilience issues. Develop analysis strategy: An analysis strategy can help considerhow information will be used to support planning goals andconsider what tools and methods will be incorporated into theplanning process.The Sample List of Existing Resources provides a general overview ofpotential reference resources, sorted by resource owners/creators.Creators include: Local/County/Regional Agencies Critical Infrastructure Owners/Operators State, Tribal, and Territorial Agencies Federal Agencies

1.4.1 Identify ParticipantsEnhanced capabilities to characterize and identify threats,hazards, and risks, and measures to address them.Identification and implementation of creative resilient solutionsthrough broadened partnerships.Enhanced commitment to implement the plan amongdiverse interestsSECTION 4Business risk should be considered in the planning process, so thatdependency on critical skills, imports, and other supply chains that areessential to the long-term resilience of the community can be accountedfor. This can include discussion with critical infrastructure operators andkey businesses. Finding ways to diversify sources proactively will enablethe community to be more adaptive as global, national, or local economicconditions change. In November 2020, the Homeland Security AdvisoryCommittee released a report documenting how business risks couldimpact resilience.SECTION 3Increased knowledge and awareness of critical infrastructureneeds amongst critical infrastructure stakeholders forincorporation into future long-term planning.Cybersecurity should also be considered during the planning processand information technology/security officers or experts that understandthe interconnectivity of the cyber infrastructure with the physicalinfrastructure should be invited to participate. Infrastructure systemsand assets increasingly rely on industrial control systems and automatedsystems that will require cybersecurity expertise to inform planning andinvestment decisions.SECTION 2For the purposes of the IRPF, critical infrastructure stakeholders includecommunity and private sector partners responsible for the planning,design, development, investment in, and operations and management ofcritical infrastructure assets and systems. This includes elected officials,community leaders, planners, engineers, public works staff, emergencymanagement personnel, business owners and infrastructure operators.Partners from key sectors can provide operational information about theirinfrastructure systems that can lead to the identification of resiliencechallenges and options for improving resilience strategies.Federal, state, tribal, and territorial government agency representativescan provide valuable data and information that will be useful in thecollection and review of existing data, plans, studies, and mappingresources; the identification of applicable best practices; and theidentification of technical assistance and implementation support.Additionally, their participation can provide political support. If theserepresentatives are not able to actively participate, communities canreach out to these representatives as needed and provide periodicupdates throughout the planning process.SECTION 1One approach for incorporating critical infrastructure resilience i

Institute of Standards and Technology's (NIST) Community Resilience Planning Guide (CRPG). It provides tools and resources for integrating critical infrastructure into planning as well as a framework for working regionally and across systems and jurisdictions. This Framework provides methods and tools to address critical