Resilience Guidebook for State of Idaho

There is no one-size-fits-all approach to resiliency. National resilience requires asset owners, especially of lifeline systems, to be deliberate about the resilience of the infrastructure within their direct control. They also must be conscious of their dependence upon infrastructure out of their direct control. Resilience planning should be scaled and bound to an asset owner’s finite resources (time, budget and staffing), its risk profile and critical operations.

In addition to its DHS ties, INL has deep and long-standing experience with the U.S. departments of Defense and Transportation. In the private sector, the lab has worked with companies critical to the United States energy sector and with public power utilities that possess fossil fuel, nuclear, hydro-electric and renewable assets.

Both the government and private sector have a shared responsibility to prevent and reduce the risks of disruptions to critical infrastructure.

The vast majority of critical infrastructure in the United States is privately owned and operated. Whether it’s the energy that lights our homes and drives commerce, the water we drink and use to irrigate crops, the transportation systems that move us and our goods, or the communication networks that connect us all, critical infrastructure provides the essential services that underpin our society.

Managing the risks associated with these systems requires an integrated approach among public and private partners to identify threats and hazards, reduce vulnerabilities, and mitigate the potential consequences.

A U.S. Army veteran and former Maryland state trooper, in 2012, Wilson became a Protective Security Advisor for DHS’s Cybersecurity and Infrastructure Security Agency, first in Washington, D.C., then in San Diego.

While at DHS, she took part in the Regional Resiliency Assessment Program (RRAP), a nonregulatory assessment program aimed at addressing hazards that can have significant consequences, both regionally and nationally. RRAPs can incorporate various components, including voluntary facility vulnerability assessments, targeted studies and modeling, first responder capability evaluations, subject matter expert workshops, and other valuable information-exchange forums.

Wilson has been coordinating the guidebook project with the Idaho Office of Emergency Management and its director, Brad Richy. “I think it should give us an opportunity to look at what we have and where we can build resilience,” he said. Flooding, wildfires and earthquakes are nothing new in the state, but resilience is getting more attention.

At a retreat in November 2018, in partnership with the National Governors Association Center for Best Practices (NGA Center), Idaho officials participated in a two-day forum focused on policies and strategies to improve disaster resilience planning. Among the presenters, INL offered an assessment of cyber interdependencies, indicating that only 5% of critical infrastructure owners/operators have physical security, cybersecurity and business continuity plans that they use for training or annual exercises.

Richy said Idaho has had a long-standing relationship with INL that has offered advantages on many fronts. “To have a national laboratory in your backyard is an amazing opportunity,” he said. “Their capabilities are extraordinary. They definitely make good neighbors, wherever you are.”

In Idaho, where agriculture and food play a major role in the economy, Wilson’s focus has been on a “Wired Farmer“ resiliency study proposal, dealing with precision agriculture and its reliance on lifeline infrastructure, particularly communications and information technology systems. Along with the Idaho guidebook and the GIS guide, the Wired Farmer study will be a resource for planning outreach and research, while helping analysts keep track of assets ranging from dams to data centers.

“The infrastructure footprint is changing all the time, including dependencies between assets and associated consequences of disruption,” Wilson said.

In both the public and private sectors, true resiliency requires commitment from everyone. In her experience, Wilson said, she has found more than a few infrastructure owners and operators unwilling to share information with the government “until they are in trouble.”

“Where is it? Who owns it? What is the capacity?” she said. The irony is, because of the internet, “The information is already out there in the world.” But the response to any emergency can be mounted much faster if the information is integrated and a plan has been put together.