ISE Mission Partners: Critical Infrastructure and Key Resources

These processes are enabling the integration of private sector security partners, as appropri­ate, into the intelligence cycle and National Common Operating Picture. Moreover, sector security partners are becoming more confident that the integrity and confidentiality of their sensitive information can and will be protected and that the information sharing process can produce actionable information regarding threats, incidents, vulnerabilities, and potential consequences to critical infrastructure and key resources. These efforts are being integrated into broader efforts to establish the ISE.

It is important to note that critical infrastructure and key resource owners and operators uti­lize a number of mechanisms that facilitate the flow of information, mitigate obstacles to vol­untary information sharing, and provide feedback and continuous improvement regarding structure and process. These include the Sector Coordination Councils, Government Coordi­nation Councils, National Infrastructure Coordinating Center, Sector-level Information Shar­ing and Analysis Centers (commonly referred to as ISACs), DHS Protective Security Advisors, the DHS Homeland Infrastructure Threat and Risk Analysis Center (HITRAC), and State and major urban area fusion centers. These mechanisms accommodate a broad range of sector cultures, operations, and risk management approaches and recognize the unique policy and legal challenges for full sharing of information between private sector owners and operators and government, as well as the important requirements for efficient operational processes.

Our efforts to improve information sharing with the private sector have been guided by a number of important factors:

1. Current, reliable, accurate, and actionable information is critical to private sector deci­sions to protect their business;
2. Private sector entities gather, process, analyze, and share information in order to protect their companies’ assets, employees, infrastructure, and ability to operate, so as to main­tain a competitive advantage;
3. In many cases, private sector entities have spent years establishing strong collaborative information sharing relationships with State and local authorities to facilitate the sharing of time-sensitive threat and vulnerability information.  Often it is their preference to coordinate the sharing of this information with the gov­ernment authorities responsible for regulating their activities.
4. The private sector operates within multiple information sharing frameworks: industry executives often prefer to separately share threat-related information with federal and State as well as local government officials and other business executives as they assess the threat environment in which they operate, implement protective measures, and engage in emergency response planning activities;
5. As we incorporate the information sharing needs and capabilities of the private sec­tor into our efforts to enable information sharing, we need to recognize that at times the environment in which homeland security, law enforcement, and terrorism-related information is shared mirrors the regulatory environment in which the sharing entity operates; and
6. The private sector relies on multiple information sources including professional and local organizations, private information providers, news outlets, colleagues, open intel­ligence sources on the web, and company management in both domestic and foreign locations, in addition to the government at all levels (Federal, State, and local).

Accordingly, as we improve efforts to share terrorism-related information with the private sector we must continue to:

1. Build a trusted relationship between federal, state, local, and tribal officials and private sector representatives to facilitate information sharing;
2. Improve the multi-directional sharing of terrorism-related information on incidents, threats, consequences, and vulnerabilities, including enhancing the quantity and quality of spe­cific, timely, and actionable information provided by the Federal Government to critical infrastructure sectors and their State, local, and tribal partners;
3. Ensure that federal, state, local, and tribal authorities have policies in place that ensure the protection of private sector information that is shared with government entities;
4. Integrate private sector analytical efforts into federal, state, local, and tribal processes, as appropriate, for a more complete understanding of the terrorism risk; and
5. Establish mechanisms and processes to ensure compliance with all relevant U.S. laws, including applicable information privacy laws.

Finally, the needs and capabilities of the private sector, particularly those entities considered to be critical infrastructure or key resources, will be incorporated into efforts to establish a national, integrated network of State and major urban area fusion centers and to produce “federally coordinated” terrorism-related information products at NCTC.