Lakhasly

Figure 3-2: NIPP Risk Management Framework: Set Security Goals
�����
�����
��������
�����������������������������������������������������
Feedback
loop
Set
Security
Goals
Prioritize
Implement
Protective
Programs
Measure
Effectiveness
Identify Assets,
Systems,
Networks, and
Functions
Assess
Risks
(Consequences,
Vulnerabilities,
and Threats)
• Supporting the development of the national risk profile
presented in the National CI/KR Protection Annual Report
described in chapter 7. This is a high-level summary of
the aggregate risk and the protective status of all sectors.
It is developed by DHS in collaboration with other secu
rity partners, updated on an ongoing basis, and used to
support strategic decisionmaking, planning, and resource
allocation;
• Enabling DHS, SSAs, and other security partners to deter
mine the best courses of action to reduce potential conse
quences, threats, or vulnerabilities. Some available options
include encouraging voluntary implementation of focused
risk management strategies (e.g., through public-private
partnerships), pursuing economic incentive-related policies
and programs, and undertaking regulatory action if appro
priate; and
• Using prioritized information to identify, or create,
specific protective programs for CI/KR of the highest
criticality based on risk. Depending on the protective
program, resource allocation may occur at the Federal,
State, Territorial, local, or tribal level, or may be solely the
responsibility of CI/KR owners and operators. International
outreach and collaboration also may be required in many
circumstances.
From a sector perspective, security goals or their related sup
porting objectives:
• Define the protective (and, if appropriate, the response or
recovery) posture that security partners seek to attain;
• Express this posture in terms of objective metrics and
the time required to attain it through specific supporting
objectives;
• Consider distinct assets, systems, networks, operational
processes, business environments, and risk management
approaches; and
• Vary according to the specific business characteristics and
security landscape of the affected sector, jurisdiction, or
locality.
Taken collectively, these goals guide all levels of government
and the private sector in tailoring protective programs and
activities to address CI/KR protection needs.
3.2 Identify Assets, Systems, Networks,

and Functions
To meet its responsibilities under the Homeland Security
Act and HSPD-7, DHS maintains a comprehensive national
inventory of the information needed to identify those assets,
systems, networks, and functions that make up the Nation’s
CI/KR. This information may be different for each sector
because it is collected on an asset, system, network, or func
tion basis, as determined by the fundamental characteristics
of each sector.
3.2.1 National Infrastructure Inventory
The inventory addresses the physical, cyber, and human
elements of each asset, system, network, or function under
consideration. The compilation process relies on the substan
tial body of previous assessments that have been completed
for natural disasters, industrial accidents, and other incidents.
The inventory includes basic information on the relation
ships, dependencies, and interdependencies between various
assets, systems, networks, and functions; on service provid
ers, such as schools and businesses, that may be of relevance