CRITICAL INFRASTRUCTURE CIKR Affiliation Access

1
CRITICAL INFRASTRUCTURE(CI/KR) Affiliation
Access

• Department of Homeland Security
• Office of Infrastructure Protection

Paul Hightower May 15, 2008
2
Affiliation Access

• Objective
• Develop and provide an effective, efficient,
  responsive flexible Access Control Process
  during disaster response and recovery for
  Critical Infrastructure
• Support and facilitate execution of
  Federal/State/Local responsibilities
  authorities
• Ensure that appropriate authorities grant
  priority access to critical infrastructure damage
  assessment and restoration resources before,
  during and after a national disaster or terrorist
  attack.
• Ensure that access decisions/credentials are
  communicated/recognized at all levels of access
  control
• Develop consistent processes and guidance for
  State, local and private sector constituencies

3
Controlling/Managing Access

• Multiple Jurisdictional Responsibility/Authority
  To Control Access
• Federal
• State
• Local
• Law Enforcement
• Fire Marshall
• Public Health
• Emergency Management
• Multiple Reasons for Controlling / Managing
  Access
• Safety
• Security
• Health

4
Incident Management Credentialing Access

• Credentials
• Validates identity, skills and competencies
• Supports resource typing for government
  responders and supporting capabilities/equipment
• Participating individuals (affiliation skills)
  are pre-identified
• Affiliation Access
• Supports access based on affiliation with
  identified CI facility or system
• CI/KR owner/operator identifies requirements,
  skill, competencies needed
• Response personnel/resources cannot be accurately
  pre-identified
• Pre-arranged mutual assistance resources
• Resource requirements dictated by
  damage/restoration requirements
• flexibility for CI/KR to identify appropriate
  workforce and support at the time of the incident
  
• Supports both personnel and equipment

5
Critical Infrastructure/Key Resource Sectors

• Critical Infrastructure
• Agriculture
• Banking and finance
• Chemical and hazardous materials
• Defense industrial base
• Emergency services
• Energy
• Food
• Healthcare
• Information technology
• Telecommunications
• Postal and shipping
• Transportation
• Water and water treatment systems

• Key Resource Areas
• National monuments and icons
• Dams
• Government facilities
• Commercial facilities
• Nuclear

• Key Characteristics
• Identified by legislation, National Strategies
  and Presidential Directives
• National scope and consequence
• Many are networked systems with national
  cascading consequences when disrupted
• Many interdependencies among them

6
Example Georgia Pilot
Placard Letter of Access (LOA) Company
Identifier

• State of Georgia issues and distributes motor
  vehicle placards for requesting critical
  infrastructure entities

• Bell South issues and distributes company
  identifier
• Bell South issues and distributes LOA
• Letter states bearer is an authorized responder
  to event
• LOA is NOT tamper proof
• LOA is NOT individuated

• Individuals providing both the
• LOA and a company identifier
• are admitted
• Both items MUST be
• presented to gain access

7
Example New York City Program

• New York City, New York
• Corporate Emergency Access System
• Pre-event credentialing program, which
• Authenticates critical business employees for
  access to restricted areas following a disaster
  or serious emergency.
• The system uses a secure identification card
  recognized by police.

8
Prioritized Access

• Integrate CI/KR owners and operators into the
  access control process
• First responder public health and safety
• Damage Assessments
• Prioritized restoration and repair
• Consistent criteria and decision making that
  encompasses private sector CI/KR, essential
  services providers, and others that contribute to
  response and recovery

9
Critical Infrastructure Response Recovery
Needs

• Definable, recognizable, efficient and effective
  process
• Framework for consistency across multiple
  jurisdictions
• Ease of implementation, flexibility,
  responsiveness
• Identified process for response
  personnel/resource sequencing
• Supports both personnel and equipment access
• Both corporate/company and contractor
• Single focal point in controlling jurisdiction
• Effective and timely communication to all
  jurisdictions/individuals controlling access

10
What does government need to do?

• Promulgate consistent procedures at State and
  local levels
• Establish the decision and distribution
  process/procedures
• Communicate process to private sector
• Establish a clear Point of Contact and ensure
  contact information is available to private
  sector
• Establish authorization process and CI/KR
  sequencing
• Establish identification criteria for individuals
  equipment
• Establish process to communicate current
  information about access authorization and
  process to local officials managing access

11
CRITICAL INFRASTRUCTURE(CI/KR) Affiliation
Access

• Department of Homeland Security
• Office of Infrastructure Protection