GAO: Infrastructure protection stresses resilience, recovery

Plans for protecting the nation's critical information technology networks and systems are focused on developing resiliency and quick recovery rather than on safeguarding against every type of threat, according to a new report from the Government Accountability Office.

The GAO report provides an update on activities of the nation's 17 critical infrastructure sectors, including IT, energy, food, water, transportation and health care, which are developing plans due in December to protect their sectors from terrorist attack. The goal is to coordinate with the National Infrastructure Protection Plan, which became final in June 2006.

While responding to draft versions of the national plan, members of five of the 17 sectors ? IT, public health, energy, telecommunications and transportation sectors ? said the plan should emphasize resiliency rather than protection.

"Industries in those sectors prefer to invest resources in protecting the most critical assets with the highest risk of damage or destruction or to plan for recovering quickly from an event," the GAO report said.

The Homeland Security Department rewrote sections of the national plan to acknowledge those preferences.

As part of the national plan, each sector created a council composed of industry representatives. The IT Sector Coordinating Council, a steering group composed of 11 government agencies and 34 private companies and organizations, is expected to deliver its plan for protecting the IT sector's critical infrastructure by December.

The GAO report said elements of some highly regulated sectors, notably nuclear power, were able to coordinate their plans more quickly because of past experience working closely with each other. In contrast, the IT sector, which named its coordinating council in January 2006, was one of the last sectors to do so.