1
500
2
-
https://clinton.presidentiallibraries.us/files/original/e536b8b9a6e99b1efce357b8bb81b95c.pdf
02ec7a9e88dbc1ed9839fe7e1b57daa0
PDF Text
Text
Case Number: 2010-1225-F
FOIA·
MARKER
This is not a textual record. This is used as an
administrative marker by the Clinton Presidential
Library Staff.
,.
Original OAIID Number:
4120
Document ID:
.
[PDD-63 Critical Infrastructure Protection, May 20, 1998]
.
..
,
Stack:
Row:
Section: '
Shelf:,
Position:
v
43
6
9
2
�FOR OFFICIAL USE ONLY,
20365
THE WHITE HOUSE
WASH INGTON
May 22, 1998
PRESIDENTIAL DECISION DIRECTIVE/NSC-63
MEMORANDUM FOR THE VICE PRESIDENT
THE SECRETARY OF STATE
THE SECRETARY OF THE'TREASURY
THE SECRETARY OF DEFENSE
THE ATTORNEY GENERAL
THE SECRETARY OF COMMERCE
THE SECRETARY OF HEALTH AND HUMAN SERVICES
THE SECRETARY OF TRANSPORTATION
THE SECRETARY OF ENERGY
THE SECRETARY OF VETERANS AFFAIRS
ADMINISTRATOR, ENVIRONMENTAL PROTECTION AGENCY
THE DIRECTOR, OFFICE OF MANAGEMENT AND BUDGET
THE DIRECTOR OF CENTRAL INTELLIGENCE
THE DIRECTOR, FEDERAL EMERGENCY MANAGEMENT AGENCY
THE ASSISTANT TO THE PRESIDENT FOR
NATIONAL SECURITY AFFAIRS
THE ASSISTANT TO THE PRESIDENT FOR
ECONOMIC POLICY
THE ASSISTANT TO THE PRESIDENT FOR
SCIENCE AND TECHNOLOGX
THE CHAIRMAN, JOINT CHIEFS OF STAFF
THE DIRECTOR, FEDERAL BUREAU OF INVESTIGATION
THE DIRECTOR, NATIONAL SECURITY AGENCY
SUBJECT:
Critical Infrastructure Protection
I . . A Growing Potential Vulnerability
The United States possesses both the world's strongest military
and its largest national economy. Those two aspects of our
power are mutually reinforcing and dependent. They are also
increasingly reliant upon certain critical infrastructures and
upon cyber-based information systems.
Critical infrastructure~ are those physical and cyber-based
systems essential to the minimum operations of the economy and
government. They include, but are riot limited to,
telecommunications, energy, banking and finance, transportation,
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
2
water systems and emergency services,both governmental and
private. ManY,Df the nation's critical infrastructures have
historically been physically and logically ,separate systems that
had little interdependence. As a result of advances in
information technology and the necessity of improved efficiency,
however" these infrastructures have become increasingly
automated and·interlinked. These same advances have created new
vulnerabilities to equipment failures, human error, weather and
other natural causes, and physical and cyb'er attacks:
Addressing these vulnerabilities will necessarily require
exible, evolutionary approaches that span both the public and
private sectors, and protect both domestic and international
security.
Because of our military strength, future enemies, whether
nations, 'groups or individuals, may seek to· harm us in non
traditional ways including attacks within the United st es.
Because our economy is increasingly reliant upon interdependent
and cyber-supported infrastructures" non-traditional attacks on
our infrastructure and information systems may be capable of
significantly harming both our military power and our economy.
II.
President's Intent
It has long been the policy of the United States to assure the
continuity and viability of critical infrastructures. I intend
that the United States will take all necessa~y measures to
swiftly eliminate any significani vultierability to both physical
and cyber attacks on our critical infrastructures,
luding
especially our cyber systems.
III.
A National Goal
No later than the year 2000, th~ Unit~d States shall have
achieved an initial operating capability and no later than five
years from today the United States shall pave achieved and shall
maintain the ~bility to. protect our nation's critical
infrastructures from intentional 'acts. that would significantly
diminish theabiliti~s of: '
o the Federal Government to perform essentia'l national securi ty
missions and to ensure .the general public hea~th and ~afety;
,
• state and local governments to maintain order and to deliver
minimum essential public services;
.
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
3
• the private sector to ensure the orderly functioning of the
economy and the delivery of essential telecommunications,
energy, financial and transportation services.
Any interruptions or manipulations of these critical functions
must be brief, infrequent, manageable, geographically isolated
and minimally detrimental to the welfare of the United States.
IV.
A Public-Private Partnership to Reduce Vulnerability
Since the targets of attacks on o~i'critical infrastiucture
would likely include both facilities iri the economy and those in
the government, the elimination -of our potenti
vulnerability
requires a closely co6rdinat~d'effort of both the government and·
the private sector. To succeed, this partnership must be
genuine, mutual and cooperat
In seeking to meet our
national goal to eliminate the vulnerabiltt s of our critical
infrastructure, therefor~, we ~hould, to the extent feasible,
seek to avoid ·outcomes that increaS~ governmerit regulatiori or
expand unfunded government mandates to the private sector.
For each of the
or sectors of our economy that are vulnerable
to infrastructure attack, the ,Federal Gove.rnment will appoint
from a designated
Agency a senior officer of that agency as
the Sector Liaison Official. to work with the private sector.
Sector Liaison Of cials, after disc~ssions and coordination
with private sector entities ·of their infrastructure sector,
will identify a private sector counterpart (Sector. Coordinator)
to represent their sector.
Together these two individuals and the departments and
corporations they represent shall contribute to a sectoral
National Infrastructure Assurance Plan by:
• assessing the vulnerabilities of the sector to cyber or
physical attacks;
• recommending a plan to eliminate significant vulnerabilities;
u
proposing a system for identifying and preventing attempted.
major attacks;
o developing a plan for alerting, containing and rebuffing an
attack in progress and then, in coordination with FEMA as
appropriate, rapidly reconstituting minimum essential
capabilities in the aftermath of an attack.
FOR OFFICIAL USE ONLY
�'.
FOR OFFICIAL USE ONLY
4
During the preparation of the sectoral plans, the National
Coordinator (see section VI), in conjunction with the Lead
Agency Sector Liaison Of cials and a repr!,=sentative fr.om the
National Economic Council, shall ensure, their overall'
cbordination and the integration of
various s~~toral plans,
with a particular focus on interdependenciesi
, .
V.
Guidelines
In addressing this pot~ntial v~lnerability and the means of
eliminating it, I want those involved to ~e mindful of the
following general principles and concerns.
• We shall' consult with, and seek input from, the Congress on
approaches and programs to meet the obj
ives set forth in
this directive.
• The protection of our critical infrastructures is necessarily
a shared responsibility and partnership between owners,
operators and the government. Furthermore, the Federal
Government shall encourage internationa:l cooperation to help
,manage this increasingly global problem.
• Frequent assessments shall be made of our
tical
tructures' existing reliability, vulnerability and
environment because, as technology and the nature of
threats to our critical infrastructures will continue to
change rapidly, so must our protective measures and responses
be robustly adaptive.
• The incentives that the market provides are the first choice
for addressing the problem of critigal infrastructure
protection; regulation will be used only iri the
of a
mat
al failure of the ~ark~t to protect the health, safety
or well-being of the American people. ;In such cases, agencies
shall identify and assess available alternatives to direct
regulation, including providing economic incentives to
encourage the desired behavior, or providing' information upon
which choices can be made by the private sector. The~e
incent
s, along with other actions, shall be designed to
help harness the latest technologies, bring about global
solutions to
ernational problems, apd enable private sector
owners and operators to achieve and maintain the maximum
feasible security.
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
5
• The full authorities, capabilities and resources of the
government, including'law·enforcement, regulation, foreign
intelligence and, defense preparedness shall. be available, as
appropriate, to ensure that critical infrastructure protection
is achieved and maint
• Care must be taken to respect privacy righ~s. Consumers and
operators must have confidence' that information will be
handled accurately, confident
ly and reliably . . '
• The F~deral Government shall, through i
research,
development and procurement, encourage
introduction of
increasingly capable methods of
tructure protection.
• The Federal Government shall serve as a model to the private
sector on how infrastructure assurance is best achieved and
shall, to the extent feasible, distribute the results of its
endeavors.
• We must focus on preventative measures as well as threat and
crisis management. To that end, private sector owners and
operators should be encouraged to provide maximum
asible
security for the infrastructures they. control and to provide
the government necessary information to assi
them in that
task.
In order to engage the private sector fully, it is
preferred that participation by owners and operators
a
national infrastructure protection system be voluntary.
• Close cooperation and coordination with state and local
governments and first responders is. essential
a robust and
flexible infrastructure protection program. All crit
infrastructure protection plans and action shall. take into
consideration the needs, activities and responsibilit s of
state and local governments and first responders.
VI.
Structure and Organization
The Federal Government will be organized for the purposes of
this endeavor around four components (ela;borated in Annex A) .
1. Lead
s for Sector Liaison:
For each infrastructure
sector that could be a target for significant cyber or
physical attacks, there will bea 's~ngle;U.S. Government
department which will serve as the lead agency for liaispn.
Each Lead Agency will design~te one tndividual of Assistant
FOR OFFICIAL USE'ONLY
�FOR OFFICIAL USE ONLY
6
Secretary rank or higher to be the Sector Liaison Official
for that area and to cooperate with the priVate sector
representat
s (Sector Coordinators) in addressing problems
related to critical infrastructure protection and, in
particular, in recommending components, of the National
Infrastructure Assurance Plan. Together, the Lead Agency
and the private sector counterparts will develop and
implement a Vulnerability Awareness and Education Program,
for their sector.
2. Lead Agencies for Special Functions: There are, in
addition, certain functions related t6 critical
infrastructure protec~ion that must be chiefly performed by
the Federal Government (national
fense, foreign affairs,
intelligence, law enforcement). For each of those special
functions, ther~ shall be a Lead Agency which will be
responsible for c00rdinating all of the activities of the
United States Government in that area. Each lead agency
will appoint a senior 0
cer of Assistant Secretary rank or
higher to serve as the Functional Coordinator for that
function for the Federal Government.
3. Interagency Coordination: The Sector Liaison Officials and
'Functional Coordinators of the Lead Agencies, as well as
representatives from other relevant departments and
agencies, including the National Economic Council, will meet
to coordinate the implementation of this directive under the
auspices of a Critical Infras~ructure Coordination Group
(CICGI, chaired by the National Coordinator for Security,
Infrastructure Protect.1on"andCounter-Terrorism. The
National Coordinator will be appointed by me and report to
me through the Assistant to. the President for National
Security Affairs, who shall assure appropriate coordination
with the Assistant to the ·President for Economic Affairs.
Agency representatives to. the CICG sl10uldbe at a senior
policy level (Assistant· S,ecreta:r:-Y 0 higher)., Where.,.
appropriate, the CICGwill be assisted by extant policy
structur,es, such as the Security Po'licy Board.,' .Security
Policy Forum and the National Security and
Telecommunications· and ,Information System Security
Committee.
4. National Infrastructure AssurahceCouncil: On ·the
recommendation of the Lead AgeI?-cies, the National Economic
Council and the National Coordinator, I will appoint a panel
of major infrastructure providers and state ,and local
government 9fficialsto serve as my National II).frastructure
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
,
"
7
..
Assurance Council. I will appoint the Chairman. The
National Coordinator will serve as the Council's Executive
Director. The National Infrastructure Assurance Council
will meet periodically to enhance the partnership of the
public and private sectors in protecting our critical
infrastructures and will provide reports to me as
appropriate. Senior Federal Government officials will
participate in the meetings of the National Infrastructure
Assurance Council as appropriate.
VII.
Protecting Federal Government.Critical Infrastructures
Every department and agency of the Federal Government shall be
responsible for protecting its own critical infrastructure,
especially its cyber-based systems. Every department and agency
Chief Information Officer (CIO) shall be responsible for
information assurance. Every department and agency shall
appoint a Ch~ef Infrastructure Assurance Qfficer (CIAO) who
1 be responsible for the protection of all of the other
aspects of that department's critical infrastructure. The CIO'
may be double-hatted as the CIAO at the discretion of the
individual department. ·These officials shall establish
procedures for obtaining expedient and valid authorities to
allow vulnerability assessments to be performed on government
computer and physical systems. The Department of Jus ce shall
establish legal guidelines for providing for such authorities.
No later than 180 days from issuance of this directive,. every
department and agency'shall develop a plan for protecting its
own critical infrastructure, including but not limited to its
cyber-based systems. The National Coordinator shall be
responsible for coordinating anal es r~q~ired by the
departments and agencies of~inter-governmental dependencies and
the mitigation of those dependeticies~~'Th~ Critical
Infrastructure Coordination Group (CICG) ,shall sponsor an expert
review process for those plans. No later; than two years from
today, those plans shall have been implemented and shall be.'
updated every two years. In meeting this schedule; the,Federal
Government shall present a model. to the private .sector on how
. best to protect critical infrastructure.
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
VIII.
8
Tasks
Within 180 days, the Principals Comniitteeshould submit to me a
schedule for cqmpletion of a National Infrastructure Assurance
Plan with milestones for accomplishing "the follow~ng subordinate
and related tasks.
1. Vulnerability Analyses:
For' each secto'r of the: economy and
each sector of the government that might be a target of
infrastructure, attack intended to significantly damage the
Uni ted State's, there shall be an
ial vulnerability
assessment,
llowed by periodic updates~ 'As appropriate,
these assessments shall also include the determination of the
minimum essential infrastructure in each s'ector.
2. Remedial Plan: Based upon the vulnerability assessment,
there shall be a r,ecommended remed~al plan. The plan shall
identify timeline.s for implementation, responsibilities and
funding.
3. Warning: A national center to warn of ~ignificant
infrastructure attacks will be established immediately (see
Annex A). As soon thereafter as possible, we will put in
place an enhanced system for detecting and analyzing such
attacks, with maximum poss'ible participation of the private
sector.
4. Response: We shall develop a system for responding to a.
significant infrastructure attack while it is underway, with
the goal 'of isolating and minimizing damage.
5. Recbnstitution: For varying levels of successful
infrastructure attacks, we shall have'a system to'
reconstitute minimum required capabili es rapidly.
6. Education and Awareness: There shall be Vulnerability
Awareness and Education Programs within both the government
and the private sector to sensitize people regarding the
importance of security and to train them in security
standards, particularly regarding cyber systems.
7. Research and Development: Federally-sponsored research and
development in support of infrastructure protection shall be
coordinated, be subj
to multi~year planning, take into
account private sector research, and be adequately funded to
minimize our vulnerabilities on a rapid but achievable.
timetable.
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
9
8. Intelligence: The Intelligence Community shall develop and
implement a plan for enhancing collection and analysis of the
foreign threat to our national infrastructure, to include but
not be limited to the foreign cyber/information warfare
threat.
9. International Cooperation: There sha
be a plan to expand
cooperation on critical infrastructure
ion with like~,
minded and friendly nations, international,organizations and
mUltinational corporations.
10. Legislative and Budgetary Requirements:
shall be an ,
evaluation of the executive branch's legis
ive authorities
and budgetary priorities regarding critical infrastructure,
and ameliorative recommendations shall be made to me as
necessary. The evaluations and recommendat
, if any,
shall be coordinated with the Director of OMB.
The CICG shall also review and schedule, the taskings listed in
Annex B.
IX.
Implementation
In addition to the l80-day report, the National Coordinator,
working with the National Economic Council, shall provide an
annual report on the implementation of this di
to me and
the
of departments and agencies, through
Assistant to
the President for National Security Affairs. The report should
inc
an updated threat assessment, a status 'report on
achieving the milestones identified for the National Plan and
additional policy, legislative and budgetary recommendations.
The evaluations and recommendations, if any, shall
coordinated with the Director of OMB.
In addition,
lowing
the establishment of an initial oper~ting capability in the year
2000,
National Coordinator shall conduct a zero-based
review.
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
Annex A:
10
structure and Organization
Lead Agencies: Clear accountability within the U.S. Government
must be designated for specific sectors and functions. The
following assignments of responsibility will apply.
Lead Agencies
Sector Li
son:
Commerce
Information and communications
Treasury
Banking and finance
EPA
Water supply
Transportation Aviation
Highways (including trucking and intelligent
transportation systems)
Mass transit
Pipelines
Rail
Waterborne commerce
Justice/FBI
Emergency' law enforcement services
FEMA
Emergency fire service
Continuity of government services
HHS
Public health services, including prevention,
surveillance, laboratory services and
personal health services
Energy
Electric power
Oil and gas. production
Law enforcement and
CIA
Foreign affairs
Defense
intern~l
Foreign intelligence
State
storage
.,
Lead Agencies for Special. Functions: ..:'
Justice/FBI
~nd
security
National defense
In addition, OSTP shall be responsib
for 600rdinating ~esearch
and development agendas and programs for the government through'
the National Science and Technology Council. Furthermore, while
FOR OFFICIAL USE ONLY
.'
,
�FOR OFFICIAL USE ONLY
11
Commerce is the lead agency for information and communi
ion,
the Department of Defense. will retain its Executive Agent
responsibilities for the National Communications System and
support of the President's National Security Telecommuni
ions
Advisory Commit
National
The National Coordinator fqr Security,
Infrastructure
ion and Counter-Terrorism shall be '
responsible
coordinating the implementation of this
directive.
The Nat
Coordinator will report to me through
the Assistant to
President for National Security Af
The National Coordinator will also participate as a full member
of Deputies or Principals Committee meetings when they meet to
consider infrastructure issues.. , Although the National·
Coordinator will not direct Depart~ents and Agencies, he or she
will ensure interagency coordination for policy development and
implementation, and will review.crisis activities concern,ing
infrastructure events with significant foreign involvement. The
National Coordinator ~ill provide advice, in the context of the
established annual budget process,. regarding agency budgets for
critical infrastructure piot
ion. The.N~tional Coordinator
will .chair the Critical
iucture Coordination. Group
(CrCG), reporting to
Deputies Committee (or, at the call of
its chair, the Principals' Committee). The Sector Liaison
Officials and Spe6ial Function Coordinators shall attend the
CIGC's·meetings. Departments and ~gencies shall each appoint to
the CIGC a senior
al (Assista~t Secrefary level o~higher)
who will regularly attend
meetings. : The National Security
Advisor shall appoint a Senior
for Infrastructu~e
Protection on' the NSC st
A National Plan Coordination (NPC) staff will be contributed on
a non-reimbursable basis by the departments and agencies,
consistent with law. The NPC
~~ll ~ntegrate the various
sector· plans into a National
tructure Assurance Plan and.
coordinate analyses of the U.S. Government's own dependencies on
critical infrastructures. The NPC sta
will also help
coordinate a national education and awareness program, and
legislative and public affairs.
The Defense Department shall continue to ,serve as Executive
Agent for the Commission Transition Office, which will form the
basis of the NPC, during the remainder of FY98. ~eginning in
FY99, the NPC shall be an office of
Commerce Department. The
Office of Personnel Management shall provide the necessary
assistance in facilitating the NPC's operations. The NPC will
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
12
terminate at the end of FY01, unless extended by,Presidential
directive.
Warning and Information Centers
As part of a national warning and: information sharing system, I',
immediately authorize the FBI to expand its current~1 organization
to a full scale National
tructure Protect
Center
(NIPC).
This organiz~tion shall serve as a national critical
infrastructure threat assessment, warning, vulnerability, and
law' enforcement investigation and response entity .. ' During the
initial period of six to twelve months, I also direct the
National Coon;iinator and the S
Liaison Officials, working
together with the Sector Coordinators, the Special Function
Coordinators and representatives from the.National Economic
Council, as appropriate, to consult with owners and operators of
the critical infrastructures to enc?uragethe creation of a
private sector sharing and analysis center, as described below.
National Infrastructure Protection Center (NIPC):
The NIPC will
include FBI, USSS, and other investigators experienced in
computer crimes' and infrastructure protection, as well as
representatives detailed from the Department of Defense, the
Intelligence Community and Lead Agencies.
It will be linked
electronically to the rest of the
Government, including
other warning and operations centers, as well as any private
sect0r sharing and analysis centers.
Its mission will include
providing timely warnings of intentional threats, comprehensive
analyses and law enforcement investigation and response.
All executive departments and agencies shall cooperate with the
NIPC and provide such assistance, information and advice that
the NIPC may request, to the extent permitted by law. All
executive departments shall'also share with the NIPC information
about threats and warning of attacks and about actual attacks on
critical government and private sector infrastructures, to the
extent permitted by law.
The NIPC will
lude elements
responsible for warning, analysis, computer inves gation,
coordinating emergency response, training, outreach and,
development and application of technical too
In addition, it
will establish its own relations directly with others in the
private sector and with any information sharing qnd analysis
ity that the private sector may create, such as the
Information Sharing and Analysis Center described below.
The NIPC, in conjunction with the information originating
agency, will sanitize law enforcement and intelligence
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
13
information for inclusion into analyses and reports that it will
provide, in appropriate form, to relevant federal, state and
local agencies; the relevant owners and operators of critical
infrastructures; and to any private sector information sharing
and analysis entity. Before disseminating national's~curity or
other information that originated from the intelligence'
commun'i ty, the NIPC will coordinate fully with the intelligence,
community through existing procedures. Whether as, s~nitlz~ci or
unsanitized reports, the NIPC will issue attack w~rniQg~'or
alerts t6 increases in threat condition to any pri~at~ sector '.
information sharing and analysis entity and to the owners,and
operators.
These warnings may also include guidance ieg~,r.di-ng
additional protection measures to be taken by owners an~'; ;
operators. Except in extreme emergencies, the NIPC shall
coordinate with the National Coordinator before issuing public ,~
warnings of imminent attacks by international terrorists,
foreign states or other malevolent foreign powers.
The NIPC will provide a national focal point for gathering
information on threats to the infrastructures. Additionally,
the NIPC will provide the principal means of facilitating and
coordinating the Federal Government's response to an incident,
mitigating attacks, investigating threats and monitoring
reconstitution efforts. Depending on the nature and level of a
foreign threat/attack, protocols established between special
function agencies (DOJ/DOD/CIA), and the ultimate decision of
the President, the NIPC may be placed in a direct support role
to either DOD or the Intelligence Community.
Information Sharing and Analysis Center (ISAC):
The National
working with Sector Coordinators, Sector Liaison
Officials and the National Economic Council, shall consult with
owners and operatqrs of the critical infrastructures to strongly
encourage the creation of a private sector information sharing
) and analy~is center.
The actual desi~n and functions of the
center and its relation to the NIPC will bedetermiried by the
private sector, in consultation with and with assistance from
the Federal Government. Within 180 days of this directive" the
National Coordinator, with the assistance of the CICGincluding
the National Economic Council, shall identify possible ~ethods
of providing federal assistance to facilitate the startup :of ah
ISAC.
Co~rdinator,
I,
Such a center could serve as the mech~nism for gathering,
"'.
analyzing, appropriately sanitizing and disseminating private
sector information to both industry and the NIPC.
The center
could also gather, analyze and disseminate information from the
".
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
14
NIPC for further distribution to the private sector. While' .
crucial toa successful government-industry partnership, this
mechanism for sharing important information about
vulnerabilities, threats, intrusions and anomalies is not to
interfere. with direct information exchaJ;lge::;; betwee.ncompanies
. ,.
and t~e government.
'"
;
-: .
,':
-'.
: .. '.
As ultimately designed by private sector representatives,;" the·
ISAC may emulate particular aspects of such insti tut.ions,·as the·,.".
Centers for Disease Control and Prevention that ·have'proye<i . · .
highly effectivej particularly its extensive inte~change~ with.
the private and non-federal sectors. Under such a model;' tne '
ISAC would pO$sess a large degree of technical focus and
expertise and non-regulatory and non-law enforcement missions.
It woulde.stablishbaseline statistics and patterns ontpe
various infrastructures, become a clearinghouse for information
within and among the various sectors, and provide a library for
historical data to be used be the private sector and, as' deemed
appropriate by the· ISAC, by the government. Critical to the
success of such an institution would be its timeliness,
accessibility, coordination, flexibility, utility and
acceptability.
,'1
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
Annex B:
15
Additional Taskings
studies
The National Coordinator shall commission studies on the
following subjects,:
-
Liability issues arising from partitipation by private' sector
companies in the information sharing' process ..
-
Existing legal impediments to
ion' sharing, with an eye
to proposals to remove these impediments, including through
the drafting of model codes
cooperation with the American
Legal Institute.
-The necessity of document and information
the impact of such classificatioI'l: on use
well as the methods and information systems
and vulnerability information can be shared
avoiding disclosu~e or unacceptable risk of
those who will misuse 'it.
sification and
dissemination, as
by which threat
securely while
disclosure to
-
The improved protection, including secure dissemination and
information handling systems, of '~ndustry trade secrets and
other confidential business data, law enforcement information
and evidentiary material, classi ed national security
rmation, unclassified materiai disclosing vulnerabilities
of privately owned infrastructures' and apparently innocuous
rmation that, in the aggregate,., .i t, 'is unwise to disclose,.
-
The implications of sharing information with
ign entities
where such sharing is deemed necessary to the $ecurity of
United States infrastructures.
-
The potential benefit to security standards of mandating,
subsidizing, or otherwise assisting
the provision of
insurance for selected critical infrastru,cture provide'rs and
requiring insurance tie-ins for foreign
t
1
ructure providers hoping to do bus
with the 'United
FOR OFFICIAL USE ONLY
�FOR OFFICIAL USE ONLY
16
Public outreach
In order to foster a climate of enhanced public sensitivity to .
the problem of infrastructure prot
ion, 'the following actions
shall be taken:
• The White House, under the oversight of the National
Coordinator, together wi.th the relevant Cabinet agencies shall
consider a series of conferences: .. (1) that wil~ bring
together national leaders in the public and private sectors to
propose programs to increase the commitment to information
security; (2) that convoke academic leaders from engineering,
computer science, business and law schobls to
ew the
status of education in information security and will identify
change~ in the crirricula and resources nece~
to meet the
national demand for professionals in this
eld;(3) on the
issues around computer ethics,as·these reI
to the K through
12 and general university populations.
• The National Academy of Sciences and the National Academy of
Engineering shall consider a round table bringing together
federal, state and local officials with~ industry ~nd academic
leaders to develop national strategies for enhancing
infrastructure security.
• The intelligence community and law enfo.rcement shall expand
existing programs for briefing infrastr,ucture owners and
operators and senior government 0
cials.
• The National Coordinator shall (1) establish a program
infrastructure assurance simulations involving senior public
and private officials, the reports Df which might be
distributed as part of an awareness' campaign; and (2) in
coordination with the private ~ector, launch a continuing
national awareness campaign, emphasizing improving
infrastructure security.
Internal Federal Government Actions
In order for the Federal Government to improve its
infrastructure security, these immediate steps shall he taken:
e The Department of Commerce, the General Services
Administration, and the Department of Defense shall assist
IAL USE ONLY
�FOR OFFICIAL USE ONLY
17 .
federal agencies . in the implementation of. best practices for
information assurance within, their individ~al.agencies.
• The National Coordinator shall coordiqate a review of existing
federal, state and local bodies c~arged with information
assurance tasks, and provide recommendations on how these
institutions can cooperate'most effectively.
• All federal agencie~ shall mak~ cl~ar d~signatidns regardin~
who may. authorize access to thei~ computer systems.
• The Intelligence Community shall elevate and formalize the·
priority for enhanced collection and analysis of information
on the foreign cyber/information warfare threat to our
critical infrastructure.
• The Federal Bureau of Investigation, the Secret Service and
other appropriate agencies shall:
(1) vigorously recruit
undergraduate and graduate students with the relevant
computer-rela.ted technical skills for full-time employment as
well as for part-time work with r~gional computer crime
squads; and (2) facilitate the hiring and retention of
qualified personnel for technical analysis and investigation
involving cyber attacks.
• The Department of Transportation, in consultation with the
Department of Defense, shall undertake a thorough evaluation
of the vulnerability of the national transportation
infrastructure that· relies on the Global Positioning System.
This evaluation shall include sponsoring an independent,
integrated assessment of risks to· civilian users of GPS-based
.systems, with a view to basing decisions.on the ultimate
architecture of the modernized NAS on these evaluations.
• The Federal Aviation Administration shall develop and
implement a comprehensive National Airspace System Security
Program to protect the modernized NAS from information-based
and other disruptions and attacks.
• GSA shall identify large procurements (such as the new Federal
Telecommunications System, FTS 2000) reiated to' infrastructure
assurance, study whether the procurement process reflects the
importance of infrastructure protection and propose, if
necessary, revisions to th~ overall procurement process to do
so.
FOR OFFICIAL USE ONLY
�FOR
O~FICIAL
USE ONLY
.18
• OMB shall dir.-ectfederal agencies to include assigned
infrastructure assurance functionswi.thin their Governme.nt
Performance and Results Ad:: strategic planning and performance
measure~ent framework.
,
• _The NSA, in accordanc~ with its National Manager
responsibilities in NSD-42, shall provide assessments
.encompassing examinations of U.S. Government systems to
interception and expl6itation; di~seminate threat and
vulnerability information; establish'st~ndardsi conduct
research -and development; and conduct issue. security product
evaluations.
Assisting the Private Sector
Iri~6±der to assist the private_sec~or in achieving and
maintaining infrastructure security:
• -The National Coordinator and the National Jnfrastructure
Assurance Countil shall propose and dev~lop ~ays to~ncourage
private industr~ to perform periodic risk assessm~~ts ~f
critic~lprocesses, including information and
te-Iecoinmunications' systems.
• The Department of Commerce and the Department of Defense 'shall
worktogetl1er, . in coordination with the private sector,' to
. offer their expertise to private owners and ot,)erators ·of
critical infrast±ucture to develop security-related best
practice standards.
• The Department of Justice and Department .of the Treasury shall
sponsor a -comprehensive study compiling! demographics of
compute"r crime, comparing state approaches to computer crime
and developing ways to deterring and responding to.computer
crime by juveniles .
~~
.
.
FOR OFFICIAL USE ONLY
PHOTOCOPY
WJC HANDWRmNG
�
Dublin Core
The Dublin Core metadata element set is common to all Omeka records, including items, files, and collections. For more information see, http://dublincore.org/documents/dces/.
Title
A name given to the resource
Office of Records Management - Presidential Decision Directives
Creator
An entity primarily responsible for making the resource
National Security Council
National Security Council Records Management Office
Date
A point or period of time associated with an event in the lifecycle of the resource
1993-2001
Is Part Of
A related resource in which the described resource is physically or logically included.
<a href="https://catalog.archives.gov/id/7585718" target="_blank">National Archives Catalog Description</a>
Description
An account of the resource
<p>Presidential Decision Directives communicate Presidential decisions concerning national security and U.S. foreign policy.</p>
<p>Presidential directives are signed or authorized by the President on issues of foreign policy and national security. The National Security Council gathers facts and views of appropriate government agencies, conducts analyses, determines alternatives, and presents policy choices to the President for decision. The President's decisions are announced by decision directives.</p>
Provenance
A statement of any changes in ownership and custody of the resource since its creation that are significant for its authenticity, integrity, and interpretation. The statement may include a description of any changes successive custodians made to the resource.
National Security Council Records Management Office
Publisher
An entity responsible for making the resource available
Clinton Presidential Library & Museum
Text
A resource consisting primarily of words for reading. Examples include books, letters, dissertations, poems, newspapers, articles, archives of mailing lists. Note that facsimiles or images of texts are still of the genre Text.
Original Format
The type of object, such as painting, sculpture, paper, photo, and additional data
Paper
Dublin Core
The Dublin Core metadata element set is common to all Omeka records, including items, files, and collections. For more information see, http://dublincore.org/documents/dces/.
Title
A name given to the resource
PDD-63 - Critical Infrastructure Protection, 5/20/1998
Creator
An entity primarily responsible for making the resource
National Security Council
National Security Council Records Management Office
Date
A point or period of time associated with an event in the lifecycle of the resource
5/20/1998
Is Part Of
A related resource in which the described resource is physically or logically included.
<a href="http://catalog.archives.gov/id/7585718" target="_blank">National Archives Catalog Description</a>
Provenance
A statement of any changes in ownership and custody of the resource since its creation that are significant for its authenticity, integrity, and interpretation. The statement may include a description of any changes successive custodians made to the resource.
Clinton Presidential Records: White House Staff and Office Files
Format
The file format, physical medium, or dimensions of the resource
Adobe Acrobat Document
Publisher
An entity responsible for making the resource available
Clinton Presidential Library & Museum
Medium
The material or physical carrier of the resource.
Reproduction-Reference
Source
A related resource from which the described resource is derived
2010-1225-F-pdd-63-critical-infrastructure-protection-may-20-1998
7585718
Declassified
Foreign Policy
Presidential Decision Directive
-
Dublin Core
The Dublin Core metadata element set is common to all Omeka records, including items, files, and collections. For more information see, http://dublincore.org/documents/dces/.
Title
A name given to the resource
Audio Recordings of the White House Communications Agency
Description
An account of the resource
<p>The White House Communications Agency was responsible for the audio and video documentation of the President and staff. The primary duties of the Agency involved the audio and video recording of the President and his staff during their official capacities. The Agency handled media requests for audiovisual material.</p>
<p>The White House Communications Agency recorded the President’s, First Lady, and staff speeches to audio cassette format. The size of the audio cassette collections are approximately over 11,000 tapes.</p>
Provenance
A statement of any changes in ownership and custody of the resource since its creation that are significant for its authenticity, integrity, and interpretation. The statement may include a description of any changes successive custodians made to the resource.
Audio Recordings of the White House Communications Agency
Audio Recordings Relating to William J. Clinton
Publisher
An entity responsible for making the resource available
Clinton Presidential Library & Museum
Sound
A resource primarily intended to be heard. Examples include a music playback file format, an audio compact disc, and recorded speech or sounds.
Duration
Length of time involved (seconds, minutes, hours, days, class periods, etc.)
0:22:00
Original Format
The type of object, such as painting, sculpture, paper, photo, and additional data
Audio Cassette
Dublin Core
The Dublin Core metadata element set is common to all Omeka records, including items, files, and collections. For more information see, http://dublincore.org/documents/dces/.
Title
A name given to the resource
Audio Recording of President Clinton's Remarks on Proposed Tobacco Legislation 5/20/1998
Date
A point or period of time associated with an event in the lifecycle of the resource
5/20/1998
Creator
An entity primarily responsible for making the resource
White House Communications Agency (WHCA)
William Jefferson Clinton
Provenance
A statement of any changes in ownership and custody of the resource since its creation that are significant for its authenticity, integrity, and interpretation. The statement may include a description of any changes successive custodians made to the resource.
Audio Recordings of the White House Communications Agency
Audio Recordings Relating to William J. Clinton
Publisher
An entity responsible for making the resource available
Clinton Presidential Library & Museum
Is Part Of
A related resource in which the described resource is physically or logically included.
<a href="https://catalog.archives.gov/id/192124145" target="_blank" rel="noreferrer">Link to Digital Audio File</a>
Format
The file format, physical medium, or dimensions of the resource
MP3
Type
The nature or genre of the resource
Audio
Medium
The material or physical carrier of the resource.
Preservation-Reference Reproduction
Source
A related resource from which the described resource is derived
PP_ROTP_Tobacco_20May1998.mp3
627802
Audio Visual
Audio-visual materials