InfoGram

March 31, 2005

NOTE: This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Suspicious Activities Reporting

An important mission of the EMR-ISAC is to encourage Emergency Services Sector (ESS) departments and agencies to report suspicious activities directly to the National Infrastructure Coordinating Center (NICC) by voice at 202-282-9201, email at nicc@dhs.gov, or by facsimile at 703-607-4998. A suspicious activity report contains information regarding an activity or event that is beyond what is considered normal activity. See "Reporting Urgency" in the 17 March InfoGram for numerous examples of suspicious activities such as unexplainable behaviors, strange objects, and unusual circumstances: http://www.usfa.fema.gov/subjects/emr-isac/infograms/ig2005/igmar1705.shtm

Department of Homeland Security (DHS) infrastructure protection and intelligence officials requested the EMR-ISAC emphasize the importance for ESS organizations to report suspicious activities to the NICC as well as their local authorities. DHS specialists offered the following crucial reasons to sharply increase reporting:

• Analysts cannot know what's happening without suspicious activity reports.
• Suspicious activity reports are necessary to track potential threats.
• Security experts cannot "connect the dots" when there aren't any dots.
• Reporting directly to the NICC saves valuable time.

Threat Analysis

Throughout the history of the United States, invaluable lessons have been learned regarding the protection of critical infrastructures. One paramount lesson substantiates that critical infrastructure protection (CIP) is an "all-hazards" discipline that guides the practitioner to consider threats (i.e., plausible sources of an attack) from people, nature, and hazardous material accidents. However, because of the possibility of multiple threats against communities and their emergency responders, compounded by scarce resources to counter these threats, the EMR-ISAC recommends local decision-makers concentrate only on those threats that will potentially degrade survivability, continuity of operations, and mission accomplishment.

As part of the CIP process, especially for local entities, threat analysis occurs when organization or agency officials determine precisely what infrastructures are threatened and how they may be attacked by terrorists, weather, etc. This determination enables leaders to focus on the guiding principle for threat analysis: Apply precious resources to protect only those infrastructures against which a credible threat exits. Despite the attention given to terrorism, this nation's history unmistakably verifies that nature (e.g., wildfires, hurricanes, floods, tornadoes, and earthquakes) is the most frequent source of probable threat against local critical infrastructures.

NIMCAST

Previous InfoGrams by the EMR-ISAC substantiated the relationship between the National Incident Management System (NIMS) and critical infrastructure protection (CIP). NIMS aims to provide a consistent nationwide approach to preparing for, responding to, and recovering from domestic disasters. There is a direct positive correlation between NIMS and CIP when CIP is appropriately considered in the approaches to preparing for and responding to disasters.

Because state, tribal, and local responders must adopt NIMS as a condition for receiving federal assistance, the Federal Emergency Management Agency (FEMA) launched a web-based, self-assessment tool so that local organizations can determine what actions they must take to comply with NIMS requirements. The voluntary self-assessment system is called: National Incident Management Compliance Assessment Support Tool (NIMCAST).

NIMCAST intends to assist state, local, tribal, private-sector, and nongovernmental agencies when evaluating their jurisdiction's ability to effectively prepare for, respond to, and recover from domestic incidents, regardless of cause, size, or complexity. Using the NIMCAST as a method of identifying weaknesses in incident preparedness will assist incident and resource managers to become compliant with NIMS. This tool also helps leaders and managers to enhance and maximize the effectiveness of their incident preparedness as a central point for identifying and acquiring resources.

For more information about NIMCAST, interested personnel can contact (voice) 202-646-3850, (Email) NIMS-Integration-Center@dhs.gov, (web) www.fema.gov/nimcast.

Sustained Viability

Recent world events have challenged municipalities and their first responders to prepare to manage previously unthinkable situations that may threaten the future of a community and its resident organizations. It is no longer enough to draft emergency response plans that anticipate intentional, natural, and accidental causes of catastrophic scenarios. Today's threats require the creation of an on-going, interactive process that serves to assure the continuation of core activities of cities and local emergency organizations before, during, and after a major crisis event. Such is why the EMR-ISAC will persist in recommending appropriate actions to ensure sustained viability in an "all-hazards" environment.

The Business Continuity Guideline: A Practical Approach for Emergency Preparedness, Crisis Management, and Disaster Recovery is a free resource to assist local government and private organizations to consider the factors and steps necessary to prepare for a crisis. This no-cost tool provides a series of interrelated processes and activities to manage and survive disastrous events and take essential actions to guarantee continuity of operations and services. The Business Continuity Guideline additionally offers step-by-step preparation and activation guidance, including readiness, prevention, response, recovery, testing, training, evaluation, and maintenance.

This January 2005 document of 48 pages can be seen or downloaded from the following link: http://www.asisonline.org/guidelines/guidelinesbc.pdf (PDF, 714 Kb, Adobe Acrobat (PDF) Help).