Risk Management and Critical Infrastructure Protection: Assessing, Integrating, and Managing Threats, Vulnerabilities and Consequences

Publication Date: February 2005

Publisher: Library of Congress. Congressional Research Service

Author(s):

Research Area: Government

Type:

Abstract:

The 9/11 Commission recommended that efforts to protect various modes of transportation and allocation of federal assistance to state and local governments should be based on an assessment of risk. In doing so, the Commission was reiterating existing federal policy regarding the protection of all the nation's critical infrastructures. The Homeland Security Act of 2002 (P.L. 107-296) and other Administration documents have assigned the Department of Homeland Security specific duties associated with coordinating the nation's efforts to protect its critical infrastructure, including using a risk management approach to set priorities. Many of these duties have been delegated to the Information Analysis and Infrastructure Protection (IA/IP) Directorate.

Risk assessment involves the integration of threat, vulnerability, and consequence information. Risk management involves deciding which protective measures to take based on an agreed upon risk reduction strategy. Many models/methodologies have been developed by which threats, vulnerabilities, and risks are integrated and then used to inform the allocation of resources to reduce those risks.