Critical Infrastructure Protection - Revision history

WikiSysop at 14:51, 17 June 2010

2010-06-17T14:51:39Z

← Older revision		Revision as of 14:51, 17 June 2010
Line 5:		Line 5:
	==Full Citation==		==Full Citation==

	GAO, ''Critical Infrastrcture Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment'' (2009). Report to Congressional Requesters and prepared by Government Accountability Office.		GAO, ''Critical Infrastrcture Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment'' (2009). Report to Congressional Requesters and prepared by Government Accountability Office. [http://www.gao.gov/new.items/d09969.pdf ''web'']

	[http://www.gao.gov/new.items/d09969.pdf''web'']

	[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&action=viewsource&startkey=GAO:2009&f=wikibiblio.bib ''BibTeX'']		[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&action=viewsource&startkey=GAO:2009&f=wikibiblio.bib ''BibTeX'']
Line 13:		Line 11:
	==Categorization==		==Categorization==

	~~Issues~~: [[Government Reports]]		Overview: [[Government Reports]]

	~~[[Public Critical Infrastrcture]]~~

	~~[[Regulation/Liability~~]]

	[[Government Organization]]		Issues: [[Government Organization]]; [[Public Critical Infrastrcture]]; [[Regulation/Liability]]

	==Key Words==		==Key Words==

	[http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#National_Cybersecurity_Strategy_.28U.S..29 National Cybersecurity Strategy]		[http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#National_Cybersecurity_Strategy_.28U.S..29 National Cybersecurity Strategy], [http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#Department_of_Homeland_Security Department of Homeland Security]

	[http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#Department_of_Homeland_Security Department of Homeland Security]

	==Synopsis==		==Synopsis==

WikiSysop: Critical Infrastructure Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment moved to Critical Infrastructure Protection

2010-06-17T14:50:29Z

Critical Infrastructure Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment moved to Critical Infrastructure Protection

← Older revision	Revision as of 14:50, 17 June 2010
(No difference)

Jacob: /* Full Citation */

2010-06-16T19:21:30Z

Full Citation

← Older revision		Revision as of 19:21, 16 June 2010
Line 5:		Line 5:
	==Full Citation==		==Full Citation==

	GAO, ''Critical Infrastrcture Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment'' (2009). Report to Congressional Requesters and prepared by ~~ENISA~~.		GAO, ''Critical Infrastrcture Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment'' (2009). Report to Congressional Requesters and prepared by Government Accountability Office.

	[http://www.gao.gov/new.items/d09969.pdf''web'']		[http://www.gao.gov/new.items/d09969.pdf''web'']

Jacob at 19:21, 16 June 2010

2010-06-16T19:21:02Z

← Older revision		Revision as of 19:21, 16 June 2010
Line 78:		Line 78:
	==Additional Notes and Highlights==		==Additional Notes and Highlights==

	~~http~~:~~//cyber~~.~~law~~.~~harvard.edu/cybersecurity/Glossary_of_Core_Ideas#National_Cybersecurity_Strategy_.28U.S..29~~		Contact: David A. Powner at (202) 512-9286 or pownerd@gao.gov

Jacob: New page: ==Full Title of Reference== Critical Infrastructure Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment ==Full Citation== GAO, ''Critical Infrastrcture Prote...

2010-06-16T19:20:08Z

New page: ==Full Title of Reference== Critical Infrastructure Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment ==Full Citation== GAO, ''Critical Infrastrcture Prote...

New page

==Full Title of Reference==

Critical Infrastructure Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment

==Full Citation==

GAO, ''Critical Infrastrcture Protection - Current Cyber Sector-Specific Planning Approach Needs Reassessment'' (2009). Report to Congressional Requesters and prepared by ENISA.

[http://www.gao.gov/new.items/d09969.pdf''web'']

[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&action=viewsource&startkey=GAO:2009&f=wikibiblio.bib ''BibTeX'']

==Categorization==

Issues: [[Government Reports]]

[[Public Critical Infrastrcture]]

[[Regulation/Liability]]

[[Government Organization]]

==Key Words==

[http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#National_Cybersecurity_Strategy_.28U.S..29 National Cybersecurity Strategy]

[http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#Department_of_Homeland_Security Department of Homeland Security]

==Synopsis==

Although DHS reported many efforts under way and planned to improve the
cyber content of sector-specific plans, sector-specific agencies have yet to
update their respective sector-specific plans to fully address key DHS cyber
security criteria. For example, of the 17 sector-specific plans, only 9 have been
updated. Of these 9 updates, just 3 addressed missing cyber criteria, and those
3 involved only a relatively small number (3 or fewer) of the criteria in
question. Recently DHS issued guidance specifically requesting that the
sectors address cyber criteria shortfalls in their 2010 sector-specific plan
updates. Until the plans are issued, it is not clear whether they will fully
address cyber requirements. Accordingly, the continuing lack of plans that
fully address key cyber criteria has reduced the effectiveness of the existing
sector planning approach and thus increases the risk that the nation’s cyber
assets have not been adequately identified, prioritized, and protected.

Most sector-specific agencies developed and identified in their 2007 sector
plans those actions—referred to by DHS as implementation actions—essential
to carrying out the plans; however, since then, most agencies have not
updated the actions and reported progress in implementing them as called for
by DHS guidance. Specifically, in response to 2006 guidance that called for
agencies to address three key implementation elements (action descriptions,
completion milestones, and parties responsible), most sectors initially
developed implementation actions that fully addressed the key elements.
However, while 2008 guidance called for implementation actions to be
updated and for sector reports to include progress reporting against
implementation action milestone commitments, only five sectors updated
their plans and reported on progress against implementation actions. DHS
attributed this in part to the department not following up and working to
ensure that all sector plans are fully developed and implemented in
accordance with department guidance.

The lack of complete updates and progress reports are further evidence that
the sector planning process has not been effective and thus leaves the nation
in the position of not knowing precisely where it stands in securing cyber
critical infrastructures. Not following up to address these conditions also
shows DHS is not making sector planning a priority. Further, recent studies by
a presidential working group—which resulted in the President establishing
the White House Office of Cybersecurity Coordinator—and an expert
commission also identified shortfalls in the effectiveness of the current public-
private partnership approach and related sector planning and offered options
for improving the process. Such options include (1) prioritizing sectors to
focus planning efforts on those with the most important cyber assets and (2)
streamlining existing sectors to optimize their capacity to identify priorities
and develop plans. Given this, it is essential that DHS and the to-be-appointed
Cybersecurity Coordinator determine whether the current process as
implemented should continue to be the national approach and thus worthy of
further investment.

==Additional Notes and Highlights==

http://cyber.law.harvard.edu/cybersecurity/Glossary_of_Core_Ideas#National_Cybersecurity_Strategy_.28U.S..29