FOR OFFICIAL USE ONLY, 20365 THE WHITE HOUSE WASH INGTON May 22, 1998 PRESIDENTIAL DECISION DIRECTIVE/NSC-63 MEMORANDUM FOR THE VICE PRESIDENT THE SECRETARY OF STATE THE SECRETARY OF THE'TREASURY THE SECRETARY OF DEFENSE THE ATTORNEY GENERAL THE SECRETARY OF COMMERCE THE SECRETARY OF HEALTH AND HUMAN SERVICES THE SECRETARY OF TRANSPORTATION THE SECRETARY OF ENERGY THE SECRETARY OF VETERANS AFFAIRS ADMINISTRATOR, ENVIRONMENTAL PROTECTION AGENCY THE DIRECTOR, OFFICE OF MANAGEMENT AND BUDGET THE DIRECTOR OF CENTRAL INTELLIGENCE THE DIRECTOR, FEDERAL EMERGENCY MANAGEMENT AGENCY THE ASSISTANT TO THE PRESIDENT FOR NATIONAL SECURITY AFFAIRS THE ASSISTANT TO THE PRESIDENT FOR ECONOMIC POLICY THE ASSISTANT TO THE PRESIDENT FOR SCIENCE AND TECHNOLOGX THE CHAIRMAN, JOINT CHIEFS OF STAFF THE DIRECTOR, FEDERAL BUREAU OF INVESTIGATION THE DIRECTOR, NATIONAL SECURITY AGENCY SUBJECT: Critical Infrastructure Protection I . . A Growing Potential Vulnerability The United States possesses both the world's strongest military and its largest national economy. Those two aspects of our power are mutually reinforcing and dependent. They are also increasingly reliant upon certain critical infrastructures and upon cyber-based information systems. Critical infrastructure~ are those physical and cyber-based systems essential to the minimum operations of the economy and government. They include, but are riot limited to, telecommunications, energy, banking and finance, transportation, FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 2 water systems and emergency services,both governmental and private. ManY,Df the nation's critical infrastructures have historically been physically and logically ,separate systems that had little interdependence. As a result of advances in information technology and the necessity of improved efficiency, however" these infrastructures have become increasingly automated and·interlinked. These same advances have created new vulnerabilities to equipment failures, human error, weather and other natural causes, and physical and cyb'er attacks: Addressing these vulnerabilities will necessarily require exible, evolutionary approaches that span both the public and private sectors, and protect both domestic and international security. Because of our military strength, future enemies, whether nations, 'groups or individuals, may seek to· harm us in non­ traditional ways including attacks within the United st es. Because our economy is increasingly reliant upon interdependent and cyber-supported infrastructures" non-traditional attacks on our infrastructure and information systems may be capable of significantly harming both our military power and our economy. II. President's Intent It has long been the policy of the United States to assure the continuity and viability of critical infrastructures. I intend that the United States will take all necessa~y measures to swiftly eliminate any significani vultierability to both physical and cyber attacks on our critical infrastructures, luding especially our cyber systems. III. A National Goal No later than the year 2000, th~ Unit~d States shall have achieved an initial operating capability and no later than five years from today the United States shall pave achieved and shall maintain the ~bility to. protect our nation's critical infrastructures from intentional 'acts. that would significantly diminish theabiliti~s of: ' o the Federal Government to perform essentia'l national securi ty missions and to ensure .the general public hea~th and ~afety; , • state and local governments to maintain order and to deliver minimum essential public services; . FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 3 • the private sector to ensure the orderly functioning of the economy and the delivery of essential telecommunications, energy, financial and transportation services. Any interruptions or manipulations of these critical functions must be brief, infrequent, manageable, geographically isolated and minimally detrimental to the welfare of the United States. IV. A Public-Private Partnership to Reduce Vulnerability Since the targets of attacks on o~i'critical infrastiucture would likely include both facilities iri the economy and those in the government, the elimination -of our potenti vulnerability requires a closely co6rdinat~d'effort of both the government and· the private sector. To succeed, this partnership must be genuine, mutual and cooperat In seeking to meet our national goal to eliminate the vulnerabiltt s of our critical infrastructure, therefor~, we ~hould, to the extent feasible, seek to avoid ·outcomes that increaS~ governmerit regulatiori or expand unfunded government mandates to the private sector. For each of the or sectors of our economy that are vulnerable to infrastructure attack, the ,Federal Gove.rnment will appoint from a designated Agency a senior officer of that agency as the Sector Liaison Official. to work with the private sector. Sector Liaison Of cials, after disc~ssions and coordination with private sector entities ·of their infrastructure sector, will identify a private sector counterpart (Sector. Coordinator) to represent their sector. Together these two individuals and the departments and corporations they represent shall contribute to a sectoral National Infrastructure Assurance Plan by: • assessing the vulnerabilities of the sector to cyber or physical attacks; • recommending a plan to eliminate significant vulnerabilities; u proposing a system for identifying and preventing attempted. major attacks; o developing a plan for alerting, containing and rebuffing an attack in progress and then, in coordination with FEMA as appropriate, rapidly reconstituting minimum essential capabilities in the aftermath of an attack. FOR OFFICIAL USE ONLY '. FOR OFFICIAL USE ONLY 4 During the preparation of the sectoral plans, the National Coordinator (see section VI), in conjunction with the Lead Agency Sector Liaison Of cials and a repr!,=sentative fr.om the National Economic Council, shall ensure, their overall' cbordination and the integration of various s~~toral plans, with a particular focus on interdependenciesi , . V. Guidelines In addressing this pot~ntial v~lnerability and the means of eliminating it, I want those involved to ~e mindful of the following general principles and concerns. • We shall' consult with, and seek input from, the Congress on approaches and programs to meet the obj ives set forth in this directive. • The protection of our critical infrastructures is necessarily a shared responsibility and partnership between owners, operators and the government. Furthermore, the Federal Government shall encourage internationa:l cooperation to help ,manage this increasingly global problem. • Frequent assessments shall be made of our tical tructures' existing reliability, vulnerability and environment because, as technology and the nature of threats to our critical infrastructures will continue to change rapidly, so must our protective measures and responses be robustly adaptive. • The incentives that the market provides are the first choice for addressing the problem of critigal infrastructure protection; regulation will be used only iri the of a mat al failure of the ~ark~t to protect the health, safety or well-being of the American people. ;In such cases, agencies shall identify and assess available alternatives to direct regulation, including providing economic incentives to encourage the desired behavior, or providing' information upon which choices can be made by the private sector. The~e incent s, along with other actions, shall be designed to help harness the latest technologies, bring about global solutions to ernational problems, apd enable private sector owners and operators to achieve and maintain the maximum feasible security. FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 5 • The full authorities, capabilities and resources of the government, including'law·enforcement, regulation, foreign intelligence and, defense preparedness shall. be available, as appropriate, to ensure that critical infrastructure protection is achieved and maint • Care must be taken to respect privacy righ~s. Consumers and operators must have confidence' that information will be handled accurately, confident ly and reliably . . ' • The F~deral Government shall, through i research, development and procurement, encourage introduction of increasingly capable methods of tructure protection. • The Federal Government shall serve as a model to the private sector on how infrastructure assurance is best achieved and shall, to the extent feasible, distribute the results of its endeavors. • We must focus on preventative measures as well as threat and crisis management. To that end, private sector owners and operators should be encouraged to provide maximum asible security for the infrastructures they. control and to provide the government necessary information to assi them in that task. In order to engage the private sector fully, it is preferred that participation by owners and operators a national infrastructure protection system be voluntary. • Close cooperation and coordination with state and local governments and first responders is. essential a robust and flexible infrastructure protection program. All crit infrastructure protection plans and action shall. take into consideration the needs, activities and responsibilit s of state and local governments and first responders. VI. Structure and Organization The Federal Government will be organized for the purposes of this endeavor around four components (ela;borated in Annex A) . 1. Lead s for Sector Liaison: For each infrastructure sector that could be a target for significant cyber or physical attacks, there will bea 's~ngle;U.S. Government department which will serve as the lead agency for liaispn. Each Lead Agency will design~te one tndividual of Assistant FOR OFFICIAL USE'ONLY FOR OFFICIAL USE ONLY 6 Secretary rank or higher to be the Sector Liaison Official for that area and to cooperate with the priVate sector representat s (Sector Coordinators) in addressing problems related to critical infrastructure protection and, in particular, in recommending components, of the National Infrastructure Assurance Plan. Together, the Lead Agency and the private sector counterparts will develop and implement a Vulnerability Awareness and Education Program, for their sector. 2. Lead Agencies for Special Functions: There are, in addition, certain functions related t6 critical infrastructure protec~ion that must be chiefly performed by the Federal Government (national fense, foreign affairs, intelligence, law enforcement). For each of those special functions, ther~ shall be a Lead Agency which will be responsible for c00rdinating all of the activities of the United States Government in that area. Each lead agency will appoint a senior 0 cer of Assistant Secretary rank or higher to serve as the Functional Coordinator for that function for the Federal Government. 3. Interagency Coordination: The Sector Liaison Officials and 'Functional Coordinators of the Lead Agencies, as well as representatives from other relevant departments and agencies, including the National Economic Council, will meet to coordinate the implementation of this directive under the auspices of a Critical Infras~ructure Coordination Group (CICGI, chaired by the National Coordinator for Security, Infrastructure Protect.1on"andCounter-Terrorism. The National Coordinator will be appointed by me and report to me through the Assistant to. the President for National Security Affairs, who shall assure appropriate coordination with the Assistant to the ·President for Economic Affairs. Agency representatives to. the CICG sl10uldbe at a senior policy level (Assistant· S,ecreta:r:-Y 0 higher)., Where.,. appropriate, the CICGwill be assisted by extant policy structur,es, such as the Security Po'licy Board.,' .Security Policy Forum and the National Security and Telecommunications· and ,Information System Security Committee. 4. National Infrastructure AssurahceCouncil: On ·the recommendation of the Lead AgeI?-cies, the National Economic Council and the National Coordinator, I will appoint a panel of major infrastructure providers and state ,and local government 9fficialsto serve as my National II).frastructure FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY , " 7 .. Assurance Council. I will appoint the Chairman. The National Coordinator will serve as the Council's Executive Director. The National Infrastructure Assurance Council will meet periodically to enhance the partnership of the public and private sectors in protecting our critical infrastructures and will provide reports to me as appropriate. Senior Federal Government officials will participate in the meetings of the National Infrastructure Assurance Council as appropriate. VII. Protecting Federal Government.Critical Infrastructures Every department and agency of the Federal Government shall be responsible for protecting its own critical infrastructure, especially its cyber-based systems. Every department and agency Chief Information Officer (CIO) shall be responsible for information assurance. Every department and agency shall appoint a Ch~ef Infrastructure Assurance Qfficer (CIAO) who 1 be responsible for the protection of all of the other aspects of that department's critical infrastructure. The CIO' may be double-hatted as the CIAO at the discretion of the individual department. ·These officials shall establish procedures for obtaining expedient and valid authorities to allow vulnerability assessments to be performed on government computer and physical systems. The Department of Jus ce shall establish legal guidelines for providing for such authorities. No later than 180 days from issuance of this directive,. every department and agency'shall develop a plan for protecting its own critical infrastructure, including but not limited to its cyber-based systems. The National Coordinator shall be responsible for coordinating anal es r~q~ired by the departments and agencies of~inter-governmental dependencies and the mitigation of those dependeticies~~'Th~ Critical Infrastructure Coordination Group (CICG) ,shall sponsor an expert review process for those plans. No later; than two years from today, those plans shall have been implemented and shall be.' updated every two years. In meeting this schedule; the,Federal Government shall present a model. to the private .sector on how . best to protect critical infrastructure. FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY VIII. 8 Tasks Within 180 days, the Principals Comniitteeshould submit to me a schedule for cqmpletion of a National Infrastructure Assurance Plan with milestones for accomplishing "the follow~ng subordinate and related tasks. 1. Vulnerability Analyses: For' each secto'r of the: economy and each sector of the government that might be a target of infrastructure, attack intended to significantly damage the Uni ted State's, there shall be an ial vulnerability assessment, llowed by periodic updates~ 'As appropriate, these assessments shall also include the determination of the minimum essential infrastructure in each s'ector. 2. Remedial Plan: Based upon the vulnerability assessment, there shall be a r,ecommended remed~al plan. The plan shall identify timeline.s for implementation, responsibilities and funding. 3. Warning: A national center to warn of ~ignificant infrastructure attacks will be established immediately (see Annex A). As soon thereafter as possible, we will put in place an enhanced system for detecting and analyzing such attacks, with maximum poss'ible participation of the private sector. 4. Response: We shall develop a system for responding to a. significant infrastructure attack while it is underway, with the goal 'of isolating and minimizing damage. 5. Recbnstitution: For varying levels of successful infrastructure attacks, we shall have'a system to' reconstitute minimum required capabili es rapidly. 6. Education and Awareness: There shall be Vulnerability Awareness and Education Programs within both the government and the private sector to sensitize people regarding the importance of security and to train them in security standards, particularly regarding cyber systems. 7. Research and Development: Federally-sponsored research and development in support of infrastructure protection shall be coordinated, be subj to multi~year planning, take into account private sector research, and be adequately funded to minimize our vulnerabilities on a rapid but achievable. timetable. FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 9 8. Intelligence: The Intelligence Community shall develop and implement a plan for enhancing collection and analysis of the foreign threat to our national infrastructure, to include but not be limited to the foreign cyber/information warfare threat. 9. International Cooperation: There sha be a plan to expand cooperation on critical infrastructure ion with like~, minded and friendly nations, international,organizations and mUltinational corporations. 10. Legislative and Budgetary Requirements: shall be an , evaluation of the executive branch's legis ive authorities and budgetary priorities regarding critical infrastructure, and ameliorative recommendations shall be made to me as necessary. The evaluations and recommendat , if any, shall be coordinated with the Director of OMB. The CICG shall also review and schedule, the taskings listed in Annex B. IX. Implementation In addition to the l80-day report, the National Coordinator, working with the National Economic Council, shall provide an annual report on the implementation of this di to me and the of departments and agencies, through Assistant to the President for National Security Affairs. The report should inc an updated threat assessment, a status 'report on achieving the milestones identified for the National Plan and additional policy, legislative and budgetary recommendations. The evaluations and recommendations, if any, shall coordinated with the Director of OMB. In addition, lowing the establishment of an initial oper~ting capability in the year 2000, National Coordinator shall conduct a zero-based review. FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY Annex A: 10 structure and Organization Lead Agencies: Clear accountability within the U.S. Government must be designated for specific sectors and functions. The following assignments of responsibility will apply. Lead Agencies Sector Li son: Commerce Information and communications Treasury Banking and finance EPA Water supply Transportation Aviation Highways (including trucking and intelligent transportation systems) Mass transit Pipelines Rail Waterborne commerce Justice/FBI Emergency' law enforcement services FEMA Emergency fire service Continuity of government services HHS Public health services, including prevention, surveillance, laboratory services and personal health services Energy Electric power Oil and gas. production Law enforcement and CIA Foreign intelligence State Foreign affairs Defense National defense storage ., Lead Agencies for Special. Functions: ..:' Justice/FBI ~nd intern~l security In addition, OSTP shall be responsib for 600rdinating ~esearch and development agendas and programs for the government through' the National Science and Technology Council. Furthermore, while FOR OFFICIAL USE ONLY .' , FOR OFFICIAL USE ONLY 11 Commerce is the lead agency for information and communi ion, the Department of Defense. will retain its Executive Agent responsibilities for the National Communications System and support of the President's National Security Telecommuni ions Advisory Commit National The National Coordinator fqr Security, Infrastructure ion and Counter-Terrorism shall be ' responsible coordinating the implementation of this directive. The Nat Coordinator will report to me through the Assistant to President for National Security Af The National Coordinator will also participate as a full member of Deputies or Principals Committee meetings when they meet to consider infrastructure issues.. , Although the National· Coordinator will not direct Depart~ents and Agencies, he or she will ensure interagency coordination for policy development and implementation, and will review.crisis activities concern,ing infrastructure events with significant foreign involvement. The National Coordinator ~ill provide advice, in the context of the established annual budget process,. regarding agency budgets for critical infrastructure piot ion. The.N~tional Coordinator will .chair the Critical iucture Coordination. Group (CrCG), reporting to Deputies Committee (or, at the call of its chair, the Principals' Committee). The Sector Liaison Officials and Spe6ial Function Coordinators shall attend the CIGC's·meetings. Departments and ~gencies shall each appoint to the CIGC a senior al (Assista~t Secrefary level o~higher) who will regularly attend meetings. : The National Security Advisor shall appoint a Senior for Infrastructu~e Protection on' the NSC st A National Plan Coordination (NPC) staff will be contributed on a non-reimbursable basis by the departments and agencies, consistent with law. The NPC ~~ll ~ntegrate the various sector· plans into a National tructure Assurance Plan and. coordinate analyses of the U.S. Government's own dependencies on critical infrastructures. The NPC sta will also help coordinate a national education and awareness program, and legislative and public affairs. The Defense Department shall continue to ,serve as Executive Agent for the Commission Transition Office, which will form the basis of the NPC, during the remainder of FY98. ~eginning in FY99, the NPC shall be an office of Commerce Department. The Office of Personnel Management shall provide the necessary assistance in facilitating the NPC's operations. The NPC will FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 12 terminate at the end of FY01, unless extended by,Presidential directive. Warning and Information Centers As part of a national warning and: information sharing system, I', immediately authorize the FBI to expand its current~1 organization to a full scale National tructure Protect Center (NIPC). This organiz~tion shall serve as a national critical infrastructure threat assessment, warning, vulnerability, and law' enforcement investigation and response entity .. ' During the initial period of six to twelve months, I also direct the National Coon;iinator and the S Liaison Officials, working together with the Sector Coordinators, the Special Function Coordinators and representatives from the.National Economic Council, as appropriate, to consult with owners and operators of the critical infrastructures to enc?uragethe creation of a private sector sharing and analysis center, as described below. National Infrastructure Protection Center (NIPC): The NIPC will include FBI, USSS, and other investigators experienced in computer crimes' and infrastructure protection, as well as representatives detailed from the Department of Defense, the Intelligence Community and Lead Agencies. It will be linked electronically to the rest of the Government, including other warning and operations centers, as well as any private sect0r sharing and analysis centers. Its mission will include providing timely warnings of intentional threats, comprehensive analyses and law enforcement investigation and response. All executive departments and agencies shall cooperate with the NIPC and provide such assistance, information and advice that the NIPC may request, to the extent permitted by law. All executive departments shall'also share with the NIPC information about threats and warning of attacks and about actual attacks on critical government and private sector infrastructures, to the extent permitted by law. The NIPC will lude elements responsible for warning, analysis, computer inves gation, coordinating emergency response, training, outreach and, development and application of technical too In addition, it will establish its own relations directly with others in the private sector and with any information sharing qnd analysis ity that the private sector may create, such as the Information Sharing and Analysis Center described below. The NIPC, in conjunction with the information originating agency, will sanitize law enforcement and intelligence FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 13 information for inclusion into analyses and reports that it will provide, in appropriate form, to relevant federal, state and local agencies; the relevant owners and operators of critical infrastructures; and to any private sector information sharing and analysis entity. Before disseminating national's~curity or other information that originated from the intelligence' commun'i ty, the NIPC will coordinate fully with the intelligence, community through existing procedures. Whether as, s~nitlz~ci or unsanitized reports, the NIPC will issue attack w~rniQg~'or alerts t6 increases in threat condition to any pri~at~ sector '. information sharing and analysis entity and to the owners,and operators. These warnings may also include guidance ieg~,r.di-ng additional protection measures to be taken by owners an~'; ; operators. Except in extreme emergencies, the NIPC shall coordinate with the National Coordinator before issuing public ,~ warnings of imminent attacks by international terrorists, foreign states or other malevolent foreign powers. The NIPC will provide a national focal point for gathering information on threats to the infrastructures. Additionally, the NIPC will provide the principal means of facilitating and coordinating the Federal Government's response to an incident, mitigating attacks, investigating threats and monitoring reconstitution efforts. Depending on the nature and level of a foreign threat/attack, protocols established between special function agencies (DOJ/DOD/CIA), and the ultimate decision of the President, the NIPC may be placed in a direct support role to either DOD or the Intelligence Community. Information Sharing and Analysis Center (ISAC): The National working with Sector Coordinators, Sector Liaison Officials and the National Economic Council, shall consult with owners and operatqrs of the critical infrastructures to strongly encourage the creation of a private sector information sharing ) and analy~is center. The actual desi~n and functions of the center and its relation to the NIPC will bedetermiried by the private sector, in consultation with and with assistance from the Federal Government. Within 180 days of this directive" the National Coordinator, with the assistance of the CICGincluding the National Economic Council, shall identify possible ~ethods of providing federal assistance to facilitate the startup :of ah ISAC. Co~rdinator, I, Such a center could serve as the mech~nism for gathering, "'. analyzing, appropriately sanitizing and disseminating private sector information to both industry and the NIPC. The center could also gather, analyze and disseminate information from the ". FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY 14 NIPC for further distribution to the private sector. While' . crucial toa successful government-industry partnership, this mechanism for sharing important information about vulnerabilities, threats, intrusions and anomalies is not to interfere. with direct information exchaJ;lge::;; betwee.ncompanies . ,. and t~e government. '" ; -: . ,': -'. : .. '. As ultimately designed by private sector representatives,;" the· ISAC may emulate particular aspects of such insti tut.ions,·as the·,.". Centers for Disease Control and Prevention that ·have'proye