Common criteria for the assessment of critical infrastructures

Abstract

Society is reliant on infrastructure services, such as information and communication technology, energy, water, and food supply, but also on governmental, cultural, and search and rescue organizations. The goal of project Kritis-KAT at the Federal Office of Civil Protection and Disaster Assistance in Germany is the development of generic criteria for the identification and evaluation of infrastructures regarded as “critical” for society. Acknowledging that full protection against all threats and cascading effects is not possible, the approach focuses on the impacts rather than the prevention of threats. The development of generic criteria requires the prioritization of infrastructures and identification of their key characteristics for civil protection purposes, risk management activities, and strategic proactive planning. For this purpose, the development of a national critical infrastructure priority inventory is based on a thorough examination of the range of criteria typically used in similar approaches. The specific focus of this paper is to identify and simplify essential characteristics of infrastructure criticality. The main outcome of this study is the development of common criteria generally applicable to a variety of infrastructures.

Keywords

civil protection / criteria / critical infrastructure / criticality / national inventory

References

[1] Allenby B., Fink J.. Toward Inherently Secure and Resilient Societies. Science, 2005, 309(5737): 1034-36 10.1126/science.1111534

[2] Apostolakis G. E., Lemon D. M.. A Screening Methodology for the Identification and Ranking of Infrastructure Vulnerabilities Due to Terrorism. Risk Analysis, 2005, 25(2): 361-76 10.1111/j.1539-6924.2005.00595.x

[3] Australian Government. 2010. Critical Infrastructure Resilience Strategy. Commonwealth of Australia. http://www.tisn.gov.au/.

[4] Boin A., McConnell A.. Preparing for Critical Infrastructure Breakdowns: The Limits of Crisis Management and the Need for Resilience. Journal of Contingencies and Crisis Management, 2007, 1(15): 50-59 10.1111/j.1468-5973.2007.00504.x

[5] Bonin, S., C. Doktor, and B. Habegger. 2009. Risk Analysis. Integrated Risk Management and Societal Security. Focal Report 2. Center for Security Studies, ETH Zürich.

[6] Bouchon, S. 2006. The Vulnerability of Interdependent Critical Infrastructures Systems: Epistemological and Conceptual State-of-the-Art. Institute for the Protection and Security of the Citizen, Joint Research Centre, European Commission.

[7] Brunner, E. M., and M. Suter. 2008. International CIIP Handbook 2008/2009. Center for Security Studies, ETH Zurich.

[8] Chittenden, M., and S. Swinford. 2010. Volcanic Ash Grounds Britain for Days to Come. Times Online. April 18. http://www.timesonline.co.uk.

[9] EC (European Commission). 2008. COUNCIL DIRECTIVE 2008/114/EC of 8 December 2008 on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve their Protection. Official Journal of the European Union. 23.12.2008. L 345/75-82. http://eur-lex.europa.eu/JOIndex.do.

[10] Federal Ministry of the Interior of Germany. 2007. Protecting Critical Infrastructures—Risk and Crisis Management. A Guide for Companies and Government Authorities. Berlin.

[11] —. 2009. National Strategy for Critical Infrastructure Protection (CIP Strategy). Berlin.

[12] German Advisory Council on Global Change. World in Transition, 2000, Berlin: Springer

[13] Gladwell M.. The Tipping Point: How Little Things Can Make a Big Difference, 2000, New York: Back Bay Books

[14] JRC (Joint Research Centre of the European Commission). 2007. Towards the Definition of Criticality Criteria for the Identification of European Critical Infrastructures. Ispra.

[15] Kahan J. H., Allen A. C., George J. K.. An Operational Framework for Resilience. Journal of Homeland Security and Emergency Management, 2009, 6(1): 1-48 10.2202/1547-7355.1675

[16] Lauwe P.. Harmon C. C., Pratt A. N., Gorka S.. The Protection of Critical Infrastructure within Germany. Toward A Grand Strategy Against Terrorism, 2010, New York: McGraw-Hill 328-40.

[17] Lovins A. B., Lovins L. H.. Brittle Power. Energy Strategy for National Security, 1982, Andover, Massachusetts: Brick House Publishing Co

[18] Luiijf E. A. M., Burger H. H., Klaver M. H. A.. Gattiker U. E.. Critical Infrastructure Protection in The Netherlands: A Quick-scan. EICAR Conference Best Paper Proceedings, 2003, Copenhagen: EICAR

[19] Merriam-Webster Dictionary Online. 2010. Accessed November 24. http://www.merriam-webster.com/dictionary/critical.

[20] Metzger, J. 2004. Challenging the Concept “Critical Infrastructure Protection” (Das Konzept “Schutz kritischer Infrastrukturen” hinterfragt). Bulletin 2004 zur schweizerischen Sicherheitspolitik, 73–85.

[21] Moteff J.. Risk Management and Critical Infrastructure Protection: Assessing, Integrating, and Managing Threats, Vulnerabilities and Consequences, 2004, [Washington, DC]: Congressional Research Service, Library of Congress

[22] Moteff J.. Critical Infrastructure: The National Asset Database, 2007, [Washington, DC]: Congressional Research Service, Library of Congress

[23] Online Etymology Dictionary. 2010. Accessed November 24. http://www.etymonline.com/index.php?search=critical&searchmode=none.

[24] PEP Critical Infrastructure Rating Workbook, 2007, British Columbia, Canada: Provincial Emergency Program

[25] Peter, L. 2011. E. coli: EU Vegetable Producers Hit Hard. BBC News. June 28. http://www.bbc.co.uk/news/world-europe-13698760.

[26] Perrow C.. Normal Accidents: Living with High-Risk Technologies, 1999, Princeton, NJ: Princeton University Press

[27] de Porcellinis S., Oliva G., Panzieri S., Setola R.. Palmer C., Shenoi S.. A Holistic-Reductionistic Approach for Modeling Interdependencies. Critical Infrastructure Protection III, 2009, Berlin: Springer 215-227 10.1007/978-3-642-04798-5_15

[28] Rinaldi S. M., Peerenboom J. P., Kelly T. K.. Identifying, Understanding, and Analyzing Critical Infrastructure Interdependencies. IEEE Control Systems Magazine, 2001, 21(6): 11-25 10.1109/37.969131

[29] Robert B., Senay M.-H., Plamondon M.-È. P. P., Sabourin J.-P.. Characterization and Ranking of Links Connecting Life Support, 2003, Networks. Ottawa: Public Safety and Emergency Preparedness Canada

[30] Swiss Federal Office for Civil Protection. 2009. The Swiss Programme on Critical Infrastructure Protection. Federal Office for Civil Protection. Bern.

[31] Theoharidou M., Kotzanikolaou P., Gritzalis D.. Palmer C., Shenoi S.. Risk-Based Criticality Analysis. Critical Infrastructure Protection III, 2009, Berlin: Springer 35-49 10.1007/978-3-642-04798-5_3

[32] Tierney K., Bruneau M.. Conceptualizing and Measuring Resilience. A Key to Disaster Loss Reduction. TR News, 2007, 250: 14-17.

[33] UKCO (United Kingdom. Cabinet Office). 2010. Strategic Framework and Policy Statement on Improving the Resilience of Critical Infrastructure to Disruption from Natural Hazards. London.

[34] USDHS The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, 2003, Washington, DC: [Department of Homeland Security]

[35] USDHS. National Infrastructure Protection Plan, 2006, [Washington,x DC]: Department of Homeland Security

[36] Vrijling J. K., van Gelder P. H. A. J. M., Goossens L. H. J., Voortman H. G., Pandey M. D.. A Framework for Risk Criteria for Critical Infrastructures: Fundamentals and Case Studies in the Netherlands. Journal of Risk Research, 2004, 7(6): 569-79 10.1080/1366987032000081178