DHS vows to protect info on national database

The Homeland Security Department has stepped up assurances that it will maintain the confidentiality of critical infrastructure information submitted to the National Asset Database, according to the newly revised draft National Infrastructure Protection Plan Base Plan version 2.0.

DHS will evaluate all requests to view the database and will grant access only to select DHS employees and others on a "tightly controlled, need-to-know" basis, the revised plan states.

The new language is set forth in the 234-page national infrastructure protection plan distributed by DHS this week. The plan was delivered by e-mail via NIPP@dhs.gov.

The plan establishes a work and time frame for assessing vulnerabilities and risks and coordinating protections for 17 critical infrastructure sectors, including IT and telecommunications. Cybersecurity is treated as a cross-sector responsibility. The department will accept comments until Feb. 6.

DHS' assurances about database access appear to address concerns raised by IT executives and others over protecting confidentiality of the information they might submit on specific vulnerabilities within their sectors.

One fear raised by IT industry members is that disclosing weak spots in their own networks may result in leaks that can be exploited by competitors.

"We've been concerned about what [DHS] can do to protect the IT infrastructure information and how they can help protect the critical assets," said Greg Garcia, vice president of information for the Information Technology Association of America in Arlington, Va., who is involved with the IT Sector Coordinating Council organization efforts.

IT industry members have asked for "originator control" for specific information they provide to the database, so they can be assured of its protection, Garcia said. However, that term does not appear in the new document.

Garcia, contacted today, said he was still reviewing the language proposed by DHS to give access on a need-to-know basis and to selected employees only.

The new plan version updates an earlier 175-page draft National Infrastructure Protection Plan released in November 2005. It reflects changes in response to nearly 7,000 public comments received on the previous version, according to a statement from DHS officials.

The new document also contains more information on cybersecurity initiatives, international cooperation and the goal of resilience. "Resilient" and "resiliency" are mentioned 26 times in the updated plan versus 18 times in the initial draft.

Other changes include a new executive summary, clarification of all-hazards linkages, and explanations of requirements pertaining to the risk management framework, according to DHS in a statement.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here
close

Trending

  • Dive into our Contract Award database

    In an exclusive for WT Insider members, we are collecting all of the contract awards we cover into a database that you can sort by contractor, agency, value and other parameters. You can also download it into a spreadsheet. Our databases track awards back to 2013. Read More

  • Navigating the trends and issues of 2016 Nick Wakeman

    In our latest WT Insider Report, we pull together our best advice, insights and reporting on the trends and issues that will shape the market in 2016 and beyond. Read More

contracts DB

Washington Technology Daily

Sign up for our newsletter.

I agree to this site's Privacy Policy.