GAO: DHS emphasizes cybersecurity in national infrastructure plan

The Homeland Security Department's updated master plan for mitigating risks to national infrastructure places greater emphasis on cybersecurity, according to a textual analysis of old and new plans by the Government Accountability Office.

DHS's 2009 version of its National Infrastructure Protection Plan calls for identifying cyber assets, systems, networks and functions, making sure those elements are included into risk assessments and prioritizing the importance of those elements, the GAO states.

Unlike the 2006 version, the plan elevates resiliency to the same level of importance as protection, the GAO says. More emphasis on resiliency should cause the federal agencies that oversee private sector infrastructure to work together on issues that transcend single sectors. As a result, cybersecurity will get more attention, as will "discussion of the importance of systems and networks within and among sectors as a means of fostering resilience," the report states. Already, as a result of the 2009 plan, government planners have created a cross-sector cybersecurity working group and a public-private program specifically for cybersecurity, the GAO states.

DHS officials told the GAO that changes to the language around resiliency aren't a major policy change--resiliency has always been important, they said. Rather, the changes "were intended to increase attention to and raise awareness about resiliency as it applies within individual sectors," said Jerald Levine, director of the DHS GAO/OIG liaison office, in the department's written response to the report.

Agencies in direct supervision of particular infrastructure sectors must, with the 2009 NIPP as guidance, produce their own updated sector specific plans by later this year.

For more:
- read GAO report 10-296 (.pdf)
- go to the DHS NIPP site, or go directly to the NIPP plan (.pdf)
- see this GCN article on the GAO report

Related Articles:
GAO: SEC must address new and unresolved IT vulnerabilities
GAO: Bureau of Public Debt must address information security
Schulz's cybersecurity imperative: Better, faster, cheaper
GAO: DoD loses track of 72,000 combat records
GAO: Cybersecurity flaws at Los Alamos lab