The rise of regional programmes on critical infrastructure ... · CIP-R strategies are properly set and supported, they will allow addressing CIP-R issues at higher levels (e.g. national

The rise of regional programmes on critical infrastructure resilience: identification and assessment of current good practices

P. Trucco1, B. Petrenj1, S. Bouchon2 & C. Di Mauro2 1Politecnico di Milano – School of Management, Italy 2RGS, Risk Governance Solutions S.r.l., Italy

Abstract

Effective Critical Infrastructure Protection and Resilience (CIP-R) depends on numerous stakeholders collaborating at different institutional and operational levels and exchanging information by means of a variety of channels. In this regard regional programmes or partnerships, have emerged as one of the key strategies to deal with CIP-R and Emergency Management (EM) issues effectively. Previous research has set the theoretical base of Public-Private Partnerships (PPP) and claimed their high potential for enhancing CIP-R that is vastly unexploited due to challenges in their establishment and management. It is now necessary to move forward to studying practical side of these programmes. MIRACLE (Multi-level Alignment of Regional Approaches to CI Resilience by Learning from Experience) is a research project funded by EC – DG HOME that aims at supporting regional CIP-R strategies in order to improve exiting capacities of the EU Member States to prevent, prepare and protect people against security related risks. This study presents a review of existing Good Practices (GPs), i.e. tools, technologies, activities and processes that are able to support: i) Establishment and management of regional PPPs for CIP-R; ii) Achievement of their main objectives and specific goals. The collected GPs are used to improve resilience levels in different phases of EM. GPs have been identified through an online survey, institutional websites, insights from professionals, available reports, documents and scientific literature. Finally, through engagement of international experts, professionals and researchers the GPs have been evaluated along three main parameters: implementation effort, transferability potential, type and relevance of expected benefits. Keywords: critical infrastructure, resilience, good practices, regional, PPP.

Disaster Management and Human Health Risk IV 233

www.witpress.com, ISSN 1743-3509 (on-line) WIT Transactions on The Built Environment, Vol 150, © 2015 WIT Press

doi:10.2495/DMAN150211

1 Introduction

To protect national infrastructure many public safety and other governmental agencies are establishing partnerships with private-sector organizations to assist in planning, resource allocation, communication strategy, and coordinated response to and strategic recovery following all types of hazards [1]. Regional programmes to Critical Infrastructure Protection and Resilience (CIP-R) aim to increase capacity to prevent, protect against, respond to, and recover from major incidents. PPP models range from big cities, counties/provinces, regions, states/nations all the way to international. In the present study ‘regional’ is understood as the administrative scale but also as the coherent territory corresponding to a CI system extension. The aim of the paper is to study existing regional CIP-R programmes and provide a state-of-the-practice analysis when it comes to successful practices in place. It presents a collection of good practices able to support implementation and functioning of regional CIP-R programmes. The practices were also evaluated by experts in the field, to assess their transferability, required effort and expected benefits. The main assumption behind the study is that, if regional CIP-R strategies are properly set and supported, they will allow addressing CIP-R issues at higher levels (e.g. national or continental). Thus, the present study wants to contribute to a better understanding of this emerging phenomenon towards its full alignment with existing CIP policies and strategies.

2 Definition of good practices and related research in the crisis management field

Good practices are generally defined as ‘Commercial or professional procedures that are accepted or prescribed as being correct or most effective’ [2]. It is any collection of specific methods that when applied solve an existing problem, produce expected results and bring benefits. In our study it applies to available knowledge to addressing:

• Establishment and management of regional PPPs for Critical Infrastructure Protection and Resilience;

• The achievement of their main objectives and specific goals. The rationale is to use a practice that have been effective in addressing similar issues in the past and apply it to a current problem. Still, more than often good practices (or ‘best practices’) offer insight into solutions that may or may not work for a given situation [3]. It can easily happen that a best practice is not applicable, is inappropriate for a particular case or just does not work well as in the original use. Ambler [4] offers an alternative view, ‘contextual practice’, in which the notion of what is ‘best’ will vary with the context. Not only the best practice often has to be adjusted for the new application but it can also evolve into its better version as improvements are discovered. Our work is a ‘Good Practice’ (GP) collection focus is on successful Activities, Procedures, Tools, and Technologies.

234 Disaster Management and Human Health Risk IV


The study of principles and good practices for public-private collaborations in the crisis management and resilience areas is not new. PADRES (Publicly Accessible, Dedicated, Resourced, Engaged, Sustainable) model lays out the set of essential attributes to assess/measure ‘state-of-practice’ of PPPs in EM [5]. The PADRES model has subsequently been used then to evaluate maturity levels and capabilities of different PPP levels/sizes across the US. ENISA’s (The European Network and Information Security Agency) efforts in this field focus on trying to analyse, understand and promote the models of PPPs at national and pan European levels. In 2009, ENISA issued its Good Practice Guide (GPG) on Information Sharing aimed at assisting Member States and other relevant stakeholders in setting up and running Network Security Information Exchanges in their own countries. In 2011, ENISA’s Good Practice Guide [6] classified PPPs for security and resilience and revealed the main five components addressing Why, Who, How, What and When questions associated with creating and maintaining PPPs. ENISA offers high-level recommendations to stakeholder on how to successfully build PPPs (for resilient IT security in their context). BUCOPCI project’s Business Continuity Best Practices Report [7] and Security Plan Best Practices Report [8] were based on responses of six CI Operators on Spanish territory. In those reports the project investigated the percentage of compliance to the BCM principles/standards [7] and level of compliance to the Operational Security Management among CI Operators [8]. RECIPE (Recommended Elements of Critical Infrastructure Protection for

Policy Makers in Europe) Project’s Good Practice Manual on CIP Policies [9] brings a set of GPs for covering areas of interest in CIP policies. Those include Identification of CI, Dependencies, PPPs, Information Sharing, Risk Management and CIP, Crisis Management and CI. Three dimensions that have a strong influence on the attainability of a large part of the practices have been considered:

• Involvement of private parties; • Mandated or voluntary co-operation structure; • Required CIP maturity.

3 Study methodology

The primary source of data was the MIRACLE project online survey aimed to review the existing Public-Private collaboration schemes (applied to address CIP-R issues) and to characterise the main features and modes of collaboration for further assessment and gap analysis. The scope of the survey was much broader than the aim of identifying potential GPs. Leveraging on the 159 survey responses, we were able to identify active regional CIP-R programmes and collect additional information such as references – public documents, reports and web-presentations, and direct contacts of the people involved in existing regional programmes (Figure 1). The secondary source of data was digging into scientific and professional literature and Institutional websites.



Figure 1: Data collection process.

More detailed information about identified GPs (both from the survey and from the secondary sources) were then collected through available public information or direct contact with people involved in these practices, mainly through focus groups and/or interviews. The final collection contains 21 Good Practices for which a summary, highlighting main characteristics, is given in Tables 2–3.

3.1 Identification and selection of GPs from the survey

When identifying GPs (and active regional programmes) from the survey answers, we adopted criteria according to the study scope. In the first place, we filtered organisations involved in CIP-R collaborative activities or a programme, resulting in 92 organisations out of the 122 mapped in the survey. The focus was on programmes with the objective of improving resilience and/or Emergency Management (EM) in general, in contrast to ones with other main goals (e.g. enhancing service quality); in this way, 76 organisations in 17 different regions were selected. Focusing on these collaboration clusters we further searched for the available information on partnerships and practices in use. In order for a practice to qualify as GP, an organisation must have reported benefits from its adoption in terms of improvement of CIP-R related performance. Organizations that achieved to establish information sharing and stakeholder collaboration process have a significant importance in contrast to the ones that had no success. Finally, we tried to ensure (as much as possible) the coverage of GPs applied in different contexts (i.e. Regional, County/Province, Metropolitan Area, and City) and across all the EM phases (Mitigation, Preparedness, Response and Recovery).

3.2 Secondary sources

Search for GPs was also conducted inside Critical Infrastructure Warning Information Network (CIWIN), which is an initiative of the Directorate-General for Home Affairs of the European Commission. The search included repositories



of National researches, FP6, FP7, CIPS and ISEC projects, their reports, deliverables and websites. Most of the developed tools focus on the technical aspects of communication/info-sharing and have not been embedded in a practical use (mostly in pilot tests of their functionality). These tools fall out of our scope since we are looking for practices that have been successfully used in practice and potentially transferable to another place. Another line of search for GPs included scientific and professional literature where we were able to find some related contributions. An overview of selected GPs is given in Section 4.

3.3 Validation by international experts

The GPs were assessed through engagement of a panel of international experts, professionals and researchers willing to perform as evaluators. They were provided with the full report on GPs and additional information was made available online. The online survey required approximately 15 min, after previous reading of the GPs collection. It assessed the GPs across three dimensions associated with a specific Likert scale, ranging from 1 to 5:

• Benefits brought by these Good Practices to the implementing organizations and to the PPP as a whole;

• Effort and knowledge required to implement the following Good Practices in an organization or PPP;

• Level of Transferability of these Good Practices across different organizations, PPPs and regions.

The responses were collected over one month, during November and December 2014, and the survey received 20 responses, 13 of which complete.

4 Classification and description of selected Good Practices

In context of CIs, resilience in general implies ‘the ability to reduce the magnitude and/or duration of disruptive events. The effectiveness of a resilient infrastructure or enterprise depends upon its ability to anticipate, absorb, adapt to, and/or rapidly recover from a potentially disruptive event’ [10]. Comprehensive resilience considers all hazards, all EM phases, all stakeholders and all impacts relevant to disasters [1]. It requires capabilities to dynamically prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk. Enhancing resilience through improving Emergency Management requires a partnership among different levels of government and the private sector, detailed planning and co-operation among infrastructure sectors. EM is the discipline of avoiding and dealing with disasters in order to lessen their impact. [1]. A commonly used model of Comprehensive EM, firstly introduced by State Governors’ Association in the US [11], encompasses four elements – mitigation (prevention), preparedness, response (coping) and recovery (aftermath). We have mapped GP contribution to resilience according to EM phases (Table 1).



Tab

le 1

: C

lass

ific

atio

n of

Goo

d P

ract

ices

and

thei

r ev

alua

tion

s.

Loca

tion

of

expe

cted

impr

ovem

ents

A

sses

smen

t

P

repa

redn

ess

Mit

igat

ion

Res

pons

e R

ecov

ery

EFF

T

RA

B

EN

TOOLS & TECHNOLOGIES

DO

MIN

O t

oo

lP

P3.

674.

003.

14V

-BE

OC

PP

P3.

403.

172.

57N

WW

AR

NP

PS

S3.

403.

003.

17C

OM

BA

S Ø

PS

3.60

2.80

3.00

SU

SI

PP

S3.

673.

403.

00N

AF

PS

3.83

3.60

2.57

SA

To

ol

PP

PS

3.80

3.33

3.00

LC

MS

PP

PS

3.57

3.29

3.63

EM

ER

GE

LP

SP

S3.

503.

832.

50G

IS M

app

ing

fo

r C

I A

sset

sS

PP

4.00

4.00

3.50

Tra

ffic

Sco

tlan

d I

SP

PP

P3.

503.

293.

22P

RIS

MP

3.60

3.33

3.13

ACTIVITIES & PROCESSES

Big

Bu

sin

ess

–S

mal

l Bu

sin

ess

PS

P3.

403.

172.

86B

lue

Cas

cad

es

PS

SS

3.20

3.83

2.86

MIC

CP

SS

S3.

403.

333.

38O

per

atio

n E

stre

laP

SS

3.29

3.71

3.00

CA

TE

XP

SS

3.20

3.67

3.00

Mu

lti-

Sta

te F

leet

Res

po

nse

PS

S3.

402.

673.

14T

TF

PS

S3.

403.

003.

00F

ocu

s o

n F

low

sP

SS

3.40

3.00

2.43

Par

tner

ship

Ali

gn

men

tP

SS

S3.

713.

433.

22

P – P

rim

ary

con

trib

uti

on

S – S

eco

nd

ary

con

trib

uti

on

Ave

rag

e3.

523.

373.

02S

tan

dar

d d

evia

tio

n0.

210.

370.

31M

ax v

alu

e4.

004.

003.

63M

in v

alu

e3.

202.

672.

43



Tab

le 2

: S

umm

ary

of G

ood

Pra

ctic

e to

ols

and

tech

nolo

gies

.

TO

OLS

and

T

EC

HN

OLO

GIE

S

WH

O

WH

Y

WH

AT

DO

MIN

O t

oo

l

Cen

tre

risqu

e &

pe

rfor

man

ce (

CR

P)

of É

cole

P

olyt

echn

ique

de

Mon

tréa

l

Bar

riers

to in

form

atio

n sh

arin

g at

th

e po

int o

f int

erde

pend

ency

id

entif

icat

ion

and

anal

ysis

A m

odel

ling,

map

ping

, dec

isio

n an

d pl

anni

ng a

ssis

tanc

e to

ol

usin

g a

flexi

ble

cart

ogra

phy

appr

oach

whi

ch p

rese

rves

the

conf

iden

tialit

y of

info

rmat

ion.

Use

d fo

r m

anag

ing

inte

rdep

ende

ncie

s an

d an

alys

ing

dom

ino

effe

cts.

Vir

tual

Bu

sin

ess

Em

erg

enc

y O

per

atio

ns

Cen

ter

(V-B

EO

C)

NIM

SA

T In

stitu

te,

Loui

sian

a (U

SA

) T

o in

corp

orat

e an

d le

vera

ge o

n na

tion’

s be

st p

ract

ices

in

info

rmat

ion

shar

ing,

less

ons

lear

ned

from

res

earc

h in

PP

Ps,

an

d fr

om e

xper

ienc

e

A fr

ee, w

eb-b

ased

info

rmat

ion

shar

ing

plat

form

that

faci

litat

es

colla

bora

tion

betw

een

publ

ic, p

rivat

e an

d no

n-pr

ofit

orga

niza

tions

. Cap

able

of s

uppo

rtin

g ex

istin

g pr

oces

ses

and

exis

ting

inci

dent

man

agem

ent s

yste

ms

No

rth

wes

t W

arn

ing

, A

lert

an

d R

esp

on

se

Net

wo

rk (

NW

WA

RN

)

Pac

ific

Nor

thw

est

Eco

nom

ic R

egio

n (P

NW

ER

)

To

enco

urag

e cr

oss-

sect

or

info

rmat

ion

shar

ing

An

aler

t, w

arni

ng a

nd in

form

atio

n sh

arin

g pl

atfo

rm e

xplo

iting

ex

pert

s fo

r pa

rtic

ular

infr

astr

uctu

re s

yste

ms.

Ena

bles

nea

r re

al-

time

two-

way

exc

hang

e of

crit

ical

info

rmat

ion

and

susp

icio

n ac

tivity

rep

ortin

g to

aut

horit

ies

Co

mp

ute

r B

ased

Ala

rm

Sys

tem

Øre

sun

dsb

ron

(C

OM

BA

S Ø

)

Øre

sund

sbro

n (D

enm

ark-

Sw

eden

)N

eed

for

a st

able

, effe

ctiv

e an

d ra

pid

alar

m s

yste

m fo

r th

ose

invo

lved

in e

mer

genc

y pr

epar

edne

ss a

nd r

espo

nse

A c

ompu

ter-

base

d al

arm

sys

tem

for

the

Øre

sund

Fix

ed L

ink.

In

form

atio

n on

an

acci

dent

is e

ffici

ently

pas

sed

to th

e em

erge

ncy

serv

ices

. Pro

vide

s im

med

iate

acc

ess

to a

ctio

n pl

ans,

cro

ss-b

orde

r in

form

atio

n sh

arin

g an

d co

llabo

ratio

n.

SU

SI (

Sis

tem

a U

nic

o d

i S

cam

bio

del

le

info

rmaz

ion

i)

Lom

bard

y R

egio

n,

Italy

T

o su

ppor

t com

mun

icat

ion

betw

een

the

oper

ator

s an

d C

ivil

Pro

tect

ion

Aut

horit

ies

A m

ultim

edia

pla

tform

to s

hare

dat

a ab

out d

isas

ters

or

optio

ns

for

prev

entio

n an

d m

onito

ring

the

even

ts b

efor

e di

sast

er

happ

ens.

Inte

rope

rabl

e an

d se

cure

com

mun

icat

ion

chan

nel f

or

timel

y co

mm

unic

atio

n be

twee

n al

l inv

olve

d or

gani

zatio

ns.

NA

TO

Arc

hit

ectu

ral

Fra

mew

ork

(N

AF

)

Dev

elop

ed b

y N

AT

O.

Use

d in

Lom

bard

y R

egio

n, It

aly.

Sta

ndar

d fo

r pr

esen

ting

oper

atio

nal m

odel

s of

the

soci

o-te

chni

cal s

yste

ms.

Ana

lysi

s to

ol to

de

velo

p ne

w c

apab

ilitie

s, s

truc

ture

or

gani

zatio

ns a

nd to

opt

imiz

e pr

oces

ses

An

Ent

erpr

ise

Arc

hite

ctur

e fr

amew

ork

defin

es h

ow to

org

aniz

e th

e st

ruct

ure

and

view

s as

soci

ated

with

a c

ompl

ex, s

ocio

-te

chni

cal s

yste

m th

at c

ompr

ises

inte

rdep

ende

nt r

esou

rces

of

peop

le, i

nfor

mat

ion,

and

tech

nolo

gy th

at m

ust i

nter

act w

ith e

ach

othe

r an

d th

eir

envi

ronm

ent i

n a

com

mon

mis

sion

. Use

d as

an

alys

is to

ol to

dev

elop

new

cap

abili

ties,

str

uctu

re o

rgan

izat

ions

an

d to

opt

imiz

e pr

oces

ses.



TO

OLS

and

T

EC

HN

OLO

GIE

S

WH

O

WH

Y

WH

AT

CE

PP

Sit

ua

tio

na

l A

ware

ness T

oo

l (S

AT

oo

l)

Co

lora

do

E

me

rge

ncy

P

rep

are

dn

ess

P

art

ne

rsh

ip (

CE

PP

)

Sm

oo

th li

ne

s o

f co

mm

un

ica

tion

b

etw

ee

n a

nd

acr

oss

th

e p

ub

lic,

priva

te a

nd

no

n-p

rofit

se

cto

rs.

To

st

ren

gth

en

th

e r

eg

ion

’s c

olle

ctiv

e

EM

ca

pa

citie

s

An

exc

lusi

ve,

secu

re,

on

line

Situ

atio

n C

en

ter,

de

sig

ne

d t

o

con

ne

ct t

he

diff

ere

nt

org

an

iza

tion

s re

spo

nd

ing

to

an

eve

nt

tog

eth

er.

It

is a

ce

ntr

alis

ed

po

rta

l to

re

spo

nd

to

an

d

com

mu

nic

ate

du

rin

g c

ritic

al e

ven

ts a

nd

sh

are

da

y to

da

y in

form

atio

n.

Du

tch

Na

tio

nal

Cri

sis

M

an

ag

em

en

t S

yste

m

(LC

MS

)

Inst

itute

Fo

r P

hys

ica

l Sa

fety

, T

he

Ne

the

rla

nd

s

Ne

ed

fo

r a

ll re

spo

nd

ers

with

in

‘sa

fety

re

gio

ns’

to

fo

rm P

PP

fo

r C

IP-R

an

d b

e a

ble

to

co

llab

ora

te

very

clo

sely

. C

on

ne

ctio

n o

f sa

fety

re

gio

ns

A d

istr

ibu

ted

info

rma

tion

sys

tem

, h

igh

ly f

ocu

sed

on

g

eo

gra

ph

ica

l in

form

atio

n a

nd

lin

ked

da

ta.

Co

nta

ins

mo

du

les

for

Co

mm

un

ica

tion

, C

oo

rdin

atio

n a

nd

Lo

gis

tics;

eff

icie

nt

exc

ha

ng

e

an

d d

iscl

osu

re o

f in

form

atio

n;

Dra

ftin

g a

GIS

vie

w –

Op

era

tion

al

Pic

ture

, C

M a

nd

Re

po

rtin

g.

Fle

xib

le p

latf

orm

th

at

sca

les

to m

ee

t ci

rcu

mst

an

ces,

acc

ess

ible

via

a w

eb

se

rvic

e.

Em

erg

en

cy

Ele

men

ts:

On

tolo

gy

for

Inte

rop

era

bil

ity

(EM

ER

GE

L)

The E

uro

pean

DIS

AS

TE

R

Co

nso

rtiu

m

To

ach

ieve

a d

eta

iled

Co

mm

on

O

pe

ratio

na

l Pic

ture

sh

are

d

be

twe

en

org

an

isa

tion

s w

ith

diff

ere

nt

syst

em

s, b

etw

ee

n

reg

ion

s, o

r e

ven

co

un

trie

s

A t

ech

no

log

y (a

nd

su

pp

ort

ing

to

ols

) th

at

pro

vid

es

inte

rop

era

bili

ty

be

twe

en

EM

Sys

tem

s. A

llow

s e

xch

an

ge

of

info

rma

tion

be

twe

en

E

MS

fa

cilit

atin

g s

em

an

tic in

tero

pe

rab

ility

via

tra

nsl

atio

n a

nd

m

ed

iatio

n

GIS

Map

pin

g f

or

CI

As

se

ts

Po

lice

Sco

tlan

d,

Sco

ttis

h

Go

vern

me

nt,

S

cott

ish

Wa

ter,

S

cott

ish

Ro

ad

s W

ork

s

A n

ee

d f

or

a v

isu

al a

wa

ren

ess

to

ol

to s

pa

tially

ide

ntif

y C

I a

sse

ts in

S

cotla

nd

, to

allo

w a

be

tte

r u

nd

ers

tan

din

g o

f p

hys

ica

l an

d

log

ica

l in

terd

ep

en

de

nci

es

an

d

loca

tion

al v

uln

era

bili

ties.

A G

IS M

ap

pin

g p

rod

uct

wh

ich

co

uld

be

use

d t

o m

ap

all

CI

an

d

oth

er

ap

pro

pria

te s

ites,

incl

ud

ing

ne

two

rk a

nd

inte

rde

pe

nd

en

cy

rela

tion

ship

s. I

de

ntif

ica

tion

of

infr

ast

ruct

ure

inte

rde

pe

nd

en

cie

s,

sup

po

rt t

oo

l fo

r p

lan

nin

g a

nd

exe

rcis

ing

. P

latf

orm

for

da

ta a

nd

in

form

atio

n c

olla

tion

.

Tra

ffic

Sco

tla

nd

In

form

ati

on

Se

rvic

e

Tra

nsp

ort

Sco

tlan

d

To

pro

vid

e k

ey

pa

rtn

ers

, re

spo

nd

ers

an

d t

he

pu

blic

with

up

to

da

te t

raff

ic a

nd

tra

vel

info

rma

tion

An

acc

ura

te,

time

ly,

con

sist

en

t a

nd

ta

ilore

d t

o t

he

ne

ed

s o

f u

sers

In

form

atio

n S

erv

ice

. C

ove

rs d

esk

top

an

d m

ob

ile w

eb

si

tes,

inte

rne

t ra

dio

se

rvic

es,

mo

bile

we

b a

pp

lica

tion

s a

nd

sm

art

ph

on

e a

pp

s, s

oci

al m

ed

ia.

Perf

orm

an

ce &

Ris

k-

based

In

teg

rate

d

Se

cu

rity

Me

tho

do

log

y (P

RIS

M)

Ha

rnse

r R

isk

Gro

up

Ap

pro

ach

to

ra

ise

co

nce

rns

am

on

gst

sta

keh

old

ers

ab

ou

t h

ow

o

rga

nis

atio

ns

ma

ke s

tra

teg

ic a

nd

o

pe

ratio

na

l de

cisi

on

s th

at

aff

ect

th

eir

exp

osu

re t

o s

ecu

rity

ris

k a

nd

its

imp

act

on

th

eir

su

pp

ly c

ha

ins.

An

em

pir

ica

lly b

ase

d,

mo

du

lar

risk

ma

na

ge

me

nt

too

l. F

ou

r p

ha

ses

‘Str

ate

gy

& P

lan

nin

g’,

‘Ris

k A

sse

ssm

en

t’, ‘D

esi

gn

’ an

d

‘Imp

lem

en

tatio

n &

Re

vie

w’.

Gu

ida

nce

no

tes

an

d t

em

pla

tes

for

use

r in

ea

ch p

ha

se –

ra

ise

s a

wa

ren

ess

an

d u

nd

ers

tan

din

g.



Tab

le 2

: C

ontin

ued

Tab

le 3

: S

umm

ary

of G

ood

Pra

ctic

e ac

tiviti

es a

nd p

roce

sses

.

AC

TIV

ITIE

S a

nd

PR

OC

ES

SE

S

WH

O

WH

Y

WH

AT

Big

Bu

sin

ess

– S

mal

l B

usi

nes

s

NIM

SA

T In

stitu

te,

Loui

sian

a (U

SA

) E

ffor

t to

help

sm

all b

usin

esse

s, o

ften

la

ckin

g th

e re

sour

ces

and

kno

wle

dge,

to

be

bette

r pr

epar

ed fo

r al

l-haz

ards

di

sast

ers

Vol

unta

ry b

ased

Priv

ate-

Priv

ate

par

tner

ship

that

pro

mot

es

proa

ctiv

e (w

hole

com

mun

ity)

EM

app

roac

h.

Blu

e C

asc

ade

s E

xerc

ise

seri

es

Pac

ific

Nor

thw

est

Eco

nom

ic R

egio

n (P

NW

ER

),

US

A/C

anad

a

To

expl

ore

infr

astr

uctu

re

inte

rdep

ende

ncie

s, a

t the

sam

e tim

e bu

ildin

g re

latio

nshi

ps a

nd tr

ust –

su

ppor

ting

NW

WA

RN

use

.

A m

odel

for

brin

gin

g to

geth

er p

ublic

and

priv

ate

sect

or

stak

ehol

ders

to d

iscu

ss c

asca

ding

impa

cts

acro

ss th

e re

gion

.

Maj

or

Inci

den

t C

on

tro

l C

om

mit

tee

(MIC

C)

14 ‘t

op ti

er’

indu

stri

al s

ite

oper

ato

rs w

ithin

the

Gra

nge

mou

th

indu

stria

l com

plex

ar

ea, S

cotla

nd

To

over

see

vita

lly im

port

ant

mat

ters

su

ch a

s P

ublic

War

ning

, Tra

inin

g an

d E

xerc

isin

g, m

utu

al a

id a

nd a

ssis

tanc

e be

twee

n co

mpa

nie

s an

d th

e pr

ovis

ion

of te

chni

cal a

dvic

e.

Thr

oug

h re

gula

r jo

int p

lann

ing,

trai

ning

and

exe

rcis

ing,

the

MIC

C e

nsur

es th

at in

tegr

ated

pub

lic a

nd p

rivat

e se

ctor

co

ntin

genc

y pl

ans

are

in p

lace

to c

over

all

impo

rtan

t iss

ues

rega

rdin

g E

M.

Op

era

tio

n E

stre

la

Dev

elop

ed b

y P

olic

e S

cotla

nd.

Rec

eive

d fu

ndin

g fr

om S

cott

ish

Gov

ernm

ent

. Th

e C

PN

I ass

iste

d in

de

velo

pmen

t of t

he

conc

ept

In r

espo

nse

to a

num

ber

of h

igh

pro

file

case

s in

volv

ing

insi

der

atta

ck.

To

flag

up p

oten

tial v

ulne

rabi

litie

s w

ithin

an

orga

nisa

tion,

to e

xerc

ise

and

test

re

silie

nce

to a

n in

side

r at

tack

An

exer

cise

pro

gra

mm

e e

xam

ines

the

recr

uitin

g, p

re-

empl

oym

ent s

cre

enin

g, id

entit

y ve

rific

atio

n, p

erso

nnel

/rol

e ba

sed

risk

asse

ssm

ent.

It a

lso

asse

sses

the

pote

ntia

l im

pact

of a

n ‘in

side

r at

tack

’ and

the

rele

vant

con

sequ

ence

m

anag

emen

t. B

usi

ness

con

tinui

ty p

roce

sses

are

test

ed to

as

sess

thei

r ad

equa

cy

‘CA

TE

X’ R

eg

ion

al

Exe

rcis

es

All

Ha

zard

s C

onso

rtiu

m (

US

A)

As

a pa

rt o

f an

inte

grat

ed p

lan

ning

ef

fort

- F

EM

A R

egi

onal

Cat

astr

ophi

c P

lann

ing

Gra

nt P

rogr

am (

RC

PG

P)

To

coor

dina

te t

he

effo

rts

of m

ultip

le

stat

es, f

eder

al a

gen

cies

and

priv

ate

sect

or o

wne

rs/o

per

ator

s in

to th

e pl

anni

ng p

roce

ss fo

r m

ajor

eve

nts.

Mul

ti-ye

ar e

xerc

ise

prog

ram

tha

t an

nual

ly e

ngag

es

publ

ic

and

priv

ate

sect

or p

artic

ipan

ts in

a m

ulti-

stat

e ta

blet

op

and/

or li

mite

d fu

nct

iona

l exe

rcis

e us

ing

a sc

enar

io(s

) in

or

der

to f

ocu

s o

n s

eve

ral i

mpo

rtan

t are

as c

ritic

al to

re

spon

ding

and

rec

over

ing

from

cat

astr

ophi

c ev

ents

and

es

tabl

ish

a fr

amew

ork

for

disc

ussi

on a

nd fu

rthe

r p

rom

ote

inte

grat

ed p

lann

ing

effo

rts

and

part

ners

hips

.



T

able

3:

Con

tinue

d.

AC

TIV

ITIE

S a

nd

PR

OC

ES

SE

S

WH

O

WH

Y

WH

AT

Mu

lti-

Sta

te F

lee

t R

esp

on

se I

nit

iati

ve

Mul

ti-S

tate

Fle

et

Res

pons

e W

orki

ng

Gro

up

(US

A -

NJ

and

Pen

nsyl

vani

a)

The

spe

ed u

p m

ovem

ent o

f lar

ge

con

voys

of

reso

urc

es

acr

oss

mu

ltipl

e

Sta

te a

nd/o

r na

tiona

l bou

ndar

ies

to

supp

ort r

espo

nse

and

reco

very

fo

llow

ing

disa

ster

s.

Exp

editi

ng th

e m

ovem

ent o

f priv

ate

sect

or r

esou

rces

on

a m

ulti-

stat

e le

vel i

n su

ppor

t of

resp

onse

effo

rts

and

mut

ual

assi

stan

ce fo

r ra

pid

CI r

esto

ratio

n.

Th

em

atic

Tas

k F

orc

es

(TT

F)

Lom

bard

y R

egi

on,

Italy

To

deve

lop

colla

bora

tive

proc

edu

res

for

copi

ng w

ith s

peci

fic a

ccid

ent

scen

ario

s, m

appi

ng o

f the

info

rma

tion

flow

s an

d co

mm

unic

atio

n ch

anne

ls

amon

g ac

tors

TT

F a

re r

esul

t of p

artn

ersh

ip b

etw

een

the

Lom

bar

dy

Reg

ion,

tran

spo

rt a

nd e

nerg

y C

I ope

rato

rs in

the

regi

on,

Civ

il P

rote

ctio

n an

d fir

st r

esp

onde

rs. I

nvol

ving

ope

rato

rs

acco

rdin

g to

thei

r ow

n in

tere

sts

and

conc

erns

.

Fo

cus

on

Flo

ws

The

Res

ilien

t R

egio

ns

Ass

ocia

tion

(Sw

eden

)

The

flo

ws

whi

ch a

re v

ital f

or s

ocie

ty

are

inte

rde

pend

ent

and

take

n ca

re o

f b

y di

ffere

nt a

ctor

s, b

oth

publ

ic a

nd

priv

ate.

The

re is

no

acto

r in

the

syst

em

wh

o ca

n si

ngle

hand

edly

ens

ure

tha

t th

e ci

ty’s

flo

ws

func

tion.

Coo

pera

tion

and

the

deve

lopm

ent

of f

unct

iona

l citi

es w

ith a

fo

cus

on th

e flo

ws

of g

oods

, ser

vice

s, m

one

y, p

eopl

e,

ener

gy

and

info

rmat

ion.

S

emin

ars,

con

fere

nces

, bre

akfa

st m

eetin

gs, m

emb

ers’

tr

aini

ng c

ours

es, w

ork

shop

s an

d st

udy

visi

ts

Par

tner

ship

Ali

gn

men

t fo

r E

nh

ance

d S

ecu

rity

The

Net

her

land

s S

afet

y R

egi

ons

Tra

nsfe

r of

res

pons

ibili

ties

for

the

prep

arat

ion

of p

lans

and

res

pons

es to

cr

ises

and

dis

aste

rs to

the

safe

ty

regi

onal

leve

l of g

over

nmen

t

Par

tner

ship

s fo

r al

ignm

ent o

f sec

urity

man

age

me

nt a

nd

proc

ess

incl

ude

cove

rage

of C

IR,

as fo

llow

s:

S

ecur

ity R

egio

ns A

ct (

defin

es th

e pa

rtne

rshi

ps)

R

egio

nal R

isk

Pro

file

Reg

iona

l Cris

is M

anag

emen

t Pol

icy

R

egio

nal C

risis

Pla

n

Spe

cific

CIP

-R C

risis

Pla

ns



5 Assessment of Good Practices

The average values for each GP across the three dimensions are shown in Table 1. All the practices received medium-high values of Benefits and Transferability, which approves them as Good Practices. The results of the GPs assessment exercise are plotted in Figure 2, where the size (width) of the bubble represents the benefits. As the GPs assessments fall quite close to each other, the average values have been rescaled (normalized) for a better representation and distinction.

Figure 2: GPs assessment.

The experts feel that fairly enough effort and knowledge is required when it comes to implementing the GPs, which indicates a lack of ‘quick wins’. It is understandable that Activities and Processes require less implementation effort compared to Tools and Technologies, while the latter are able to bring greater benefits and, on average, possess higher transferability. Even though some of the practices share the same guiding principles, each is significantly customised, addressing the specific needs of the regional programme. As practices are rarely directly transferable (‘as such’), offering a hands-on experience would give practitioners a much better insight – an opportunity to examine the suitability for use, potential benefits, need for adjustments and human training in their own context. Feasibility of providing a first-hand experience is an issue to consider. While GPs are usable when there is a lack of a practice, looking at the ratio between the benefits and effort it is clear that it would be irrational for any region to substitute a practice already in place with another one of the same type. Of course it does not mean that sharing of GPs between existing regional programmes is not needed. A reasonable action in this case would be to improve



or expand the current practice based on the shared knowledge and experience and advance the existing CIP-R programme. GPs are not only a customised approaches but the ideas that lie behind the practices – the reasoning on how to cope with problems at hand and the base made of common determinants and features. GPs are therefore a source of knowledge on how to address issues, how to improve practices already in place and adopt new ones.

6 Conclusions

The paper studied the regional CIP-R programmes and provided a state-of-the-practice analysis when it comes to successful practices used for establishing and running a regional programme and reaching specific goals. After presenting a collection of GPs, we have involved experienced practitioners to evaluate those GPs along three relevant characteristics. The practitioners can dig into this GPs collection in search for ideas and solutions for their existing problems, leveraging on others experience and experts’ opinions. Results may also support policy makers and practitioners to frame and develop regional CIP-R Programmes. Future research will test implementation of some of the GPs into new environments. Determinants of GP, which are the primary transferable elements (rather than practices as such) should be extracted. Possible alignments and synergies should be further investigated in two aspects: i) Between the two types of GPs (Activities/Processes and Tools/Technologies) – for better mix and match; ii) Between programmes on different levels – i.e. in which way are regional CIP-R strategies able to address CIP-R issues at higher levels, and vice versa, how can CIP-R policies and strategies support a bottom-up approach in the form of regional programmes.

Acknowledgement

The present study has been completed under MIRACLE, a research project co-funded by DG Home Affairs of the European Commission, under CIPS/ISEC Work Programme. The financial support is gratefully acknowledged.

References

[1] FEMA website: https://training.fema.gov/EMI/ [2] Dictionary, O. E. Oxford dictionary of English. Online version, 2012. [3] Bardach, E. A Practical Guide for Policy Analysis: The Eightfold Path to

More Effective Problem Solving. Thousand Oaks, CA: Sage, 2011. [4] Ambler, S. Questioning ‘Best Practices’ for Software Development .

Retrieved 17 November 2011. [5] Federal Emergency Management Agency (FEMA). After Action Report of

the first national conference on “Building Resilience through Public-Private Partnerships”, August 3-4, 2011, Washington, D.C.



“ ”

[6] The European Network and Information Security Agency (ENISA). Cooperative Models for Effective Public Private Partnership – Good Practice Guide, 2011.

[7] Business Continuity Planning for Critical Infrastructures (BUCOPCI) Project. D1.2: Business Continuity Best Practices Report, 2012.

[8] Business Continuity Planning for Critical Infrastructures (BUCOPCI) Project. D1.3: Security Plan Best Practices Report, 2012.

[9] Recommended Elements of CIP for Policy Makers in Europe (RECIPE). Good Practices Manual for CIP Polices, 2014.

[10] National Infrastructure Advisory Council (NIAC) ‘Critical Infrastructure Resilience – Final Report and Recommendations’, U.S. Department of Homeland Security, Washington, D.C., 2009.

[11] National Governors' Association. Emergency preparedness project: Final report. Washington, DC: National Governor's Association, 1978.



Documents

The rise of regional programmes on critical infrastructure ... · CIP-R strategies are properly set and supported, they will allow addressing CIP-R issues at higher levels (e.g. national