By Christopher Ryan

Photo Credit: Trend Micro & Organization of American States

A fundamental responsibility of State and Local governments is to protect critical infrastructure that preserve public safety, normalcy, and quality of life.  It can be a major challenge, however, for States and localities to determine how best to use limited critical infrastructure protection (CIP) resources to protect the thousands of publicly and privately-owned critical infrastructure assets that the whole community relies on every day.  By following the two actionable recommendations below, State and local governments can begin developing a strategic CIP program in their jurisdiction that will yield significant policy benefits.

To strategically use limited CIP resources, a key early step for State and local CIP programs is to identify and prioritize the critical infrastructure (CI) assets that are most important for maintaining community safety, normalcy, and quality of life.  At the Federal level, the Department of Homeland Security (DHS) identifies and prioritizes CI assets using a set of criteria that identify the highest priority critical infrastructure assets in the country as “Level 1” and slightly lower priority assets as “Level 2.” To qualify, each Level 1 or 2 asset must meet minimum thresholds that reflect DHS’s high-level, nationwide perspective, but the thresholds are too high to fully reflect State and local interests.  DHS’s system thus fails to identify and prioritize many CI assets that States and localities regard as essential.

Recommendation 1: To develop and maintain a strategic CIP program, States and localities should complement DHS’s system by developing their own CI prioritization methodologies to account for assets that are critical to their communities but that do not meet DHS’s Level 1 or Level 2 thresholds.  States and localities can use one of many existing prioritization methodologies, including examples from Harris County, Texas and San Diego, California, as a starting point for developing their own criteria.

Recommendation 2: States and localities should then use their methodology to generate a single prioritized list of CI assets from across their jurisdiction. Using a prioritized list of CI assets, State and local governments can begin enjoying the following practical policy benefits:

• Improved Resource Allocation. States and localities can strategically direct their finite resources for prevention, protection, mitigation, response, and recovery to the most critical assets. Whether determining where to conduct vulnerability assessments, deploy backup generators, build a sea wall, install security cameras, develop private sector partnerships, or position radiation detectors, a prioritized list of CI assets can help State and local leaders manage resources to yield the most significant possible benefits.
• High-Value Intelligence. Intelligence analysts can develop and disseminate richly detailed threat and risk profiles in close to real-time by comparing the locations of suspicious activity reports (SARs) with the locations of the highest-priority CI.
• Critical Customers and Emergency Planning. Emergency planners can identify the CI assets for which reliable water, electrical, communications, and other services are most essential.  State and local officials can work with private sector and utility partners as needed to craft lists of critical customers to be prioritized for service and support as needed.

State and local governments can thus initiate a strategic CIP program and enjoy significant policy benefits by developing and using a CI prioritization methodology for their jurisdiction.