Montgomery County Critical Infrastructure and Key Resource Assessment

Updated August 2014 Final Version

Executive Summary

The Montgomery County Office of Emergency Management and Homeland Security (OEMHS) has prepared the Montgomery County Critical Infrastructure and Key Resources (CIKR) Assessment for Montgomery County, Maryland in its efforts to circumvent further damage followed by a natural or manmade disaster. The purpose of the CIKR Assessment is to respond to all disasters and emergencies and ensure the safety and protection of its citizens. The plan also establishes the policies, plans, guidelines and procedures that will allow for the preservation, maintenance or reconstitution of the County’s ability to carry out its responsibilities under all circumstances that may disrupt normal governmental operations. The CIKR Assessment will assist the County leadership in its protection of citizens, property, and businesses; and the restoration of County operations. It is the policy of Montgomery County Government to provide essential services to the citizens of this County with regard to any manmade or natural disaster. Therefore in accordance with US Department of Homeland Security’s National Infrastructure Protection Plan (NIPP) guidance, this assessment was developed so that the County can continue to serve and protect its citizens during a disaster. With the disruption of essential services such as public health, transportation, police, fire and rescue, County Executive and Council, and other critical municipalities; the CIKR Assessment will enable the County to restore these crucial entities safely and effectively. The CIKR Assessment will map out the County’s critical infrastructure, its key resources and ensuring backup systems for the essential functions. The CIKR Assessment applies the functions, operations, and resources necessary to ensure the continuation of the Montgomery County Government to normal operations if threatened with a crisis.

Introduction The CIKR Assessment presents an executive structure establishing operational procedures to sustain essential measures if normal operations have been devastated, and offers a guide to restore government functions to full normal operations. When and where a disaster will occur is never known; however, the County may be able to reduce the impact through preparedness and planning. The purpose of the CIKR Assessment will assist the County in its response and recovery during the post-disaster phase. The Assessment will make clear what actions the County will take in order to sustain operations resulting from a weather related emergency, public health epidemic, or a manmade disaster. The County’s critical infrastructure has been broken into three tiers based on their criticality and significance towards restoring Montgomery County’s normal operations. The first tier is focused on immediate response and recovery, and the preservation of property. The second tier focused on provision of critical services, and the restoration of services needed for day to day operations within 72 hours. The third tier’s agencies are mainly focused on long term recovery issues. During the response and recovery efforts, the CIKR Assessment should also work in conjunction with the County’s Hazard Mitigation Plan, Pre-Disaster Recovery Plan, Continuity of Government (COG) Plan, the County’s Continuity of Operations Plans (COOP), the Emergency Operations Plan (EOP), and the County’s Crisis Communications Plan. Purpose The Montgomery County Office of Emergency Management and Homeland Security (OEMHS) is providing a resource for Montgomery County leadership to manage and sustain the County’s level of preparedness in an all hazards environment. The CIKR Assessment will provide a guideline for County’s leadership to minimize the loss of life, injury, and property damage.

Objective Create a standard operating guide identifies Montgomery County’s critical infrastructure and key resources (CIKR); distinguishing those owned by the County, private companies, non-profit groups, and regional/state owned entities, by identifying assets within the County that directly or indirectly impact CIKR. Another key element is to assign roles and responsibilities for various CIKR, both within the County, and partners throughout the region that will have a direct impact on Montgomery County.

Scope Montgomery County’s CIKR Guidance should include the steps outlined in the National Infrastructure Protection Plan (NIPP); the process outlined in this document will reduce the vulnerabilities in CIKR through a data driven analysis of cross-sector assets and systemic dependencies and interdependencies.

Critical Infrastructure Sectors DHS Critical Infrastructure Sectors as Defined in the NIPP is a coordinated process to synthesize the 16 sector-specific plans issued by the US Department of Homeland Security (DHS), an action plan accounting for the distinctive

US DHS Critical Infrastructure Sectors as Defined in the NIPP Critical Infrastructure Sector Examples of Assets Agriculture and Food Food processing plants, Farm facilities Commercial Facilities Sports stadiums, Shopping malls Banking and Finance Stock Exchanges, Federal Reserve Communications Telephone switching stations, Satellite receivers Chemical Chemical manufacturing plants Critical Manufacturing Primary metal manufacturing, Engine manufacturing Dams Major dams Energy Power plants, Substations Information Technology Fiber optic lines, Server farms Defense Industrial Base Facilities supporting DoD operations Government Facilities Government office buildings Transportation Systems Train stations, Bridges, Tunnels, Ports Emergency Services Fire stations, Police stations Healthcare and Public Health Hospitals, Strategic National Stockpile sites Nuclear Reactors, Materials and Nuclear facilities Waste Water Water treatment plants, Reservoirs, Boundary valves

Concept Montgomery County Office of Emergency Management and Homeland Security is looking to build a set of County specific critical infrastructure and resilience assets. These efforts build on critical infrastructure efforts already undertaken in the state and are based on economic and vital information, County stakeholder input, and state and local best practices. The guide will prioritize infrastructure in terms of recovery and implement current County plans which are pertinent to the County’s critical infrastructure. Montgomery County’s Infrastructure Montgomery County’s critical infrastructure have been broken into two tiers based on the essential services provided enable County government to provide vital services, exercise civil authority, maintain safety and well-being of the general populace, and what functions must continue in order to continue to serve Montgomery County residents by sustaining government operations. Tier I’s critical infrastructure are focused on the County’s life sustaining and civil order, and will be critical to the first 72 hours post disaster and be sustainable for up to 30 days. Tier I functions also concentrate on the leadership of the County emergency support functions (ESF), and the ability to implement emergency plans and procedures accordingly without delay.

Tier I: . Communications . Energy . Information Technology . Dams . Transportation Systems . Emergency Services . Healthcare and Public Health . Water

Tier I CIKR are focused on post-disaster assessment and recovery: communications equipment, re-establishment of IT systems, data lines, telephone lines, accounting software, email software, and vital records are only some of the examples of the communication tools required for Tier II agencies, and typically within 72 hours post-disaster. The functions within Tier II identified CIKR will have the knowledge of the County’s Emergency Operations Center (EOC), the County’s Pre-Disaster Recovery Plan, and the County’s Crisis Communications Plan. These County plans will be critical in ensuring the quick response to disaster recovery, and the following agencies will have the expertise in carrying out the tasks required to restore these functions. Tier II CIKR Include: . Agriculture and Food . Commercial Facilities . Banking and Finance . Chemical . Critical Manufacturing . Defense Industrial Base . Government Facilities . Nuclear Reactors, Materials and Waste

Regional Partners

The roles and responsibilities as identified will be incumbent on County agencies’ relationship with many of the private sector companies that control Montgomery County’s critical infrastructure. Many of the owners and operators of these critical assets should have their own relationships established with County partners and community work groups. First responders should have data readily available to them in terms of the location and capacity of key critical infrastructure, and the data should be available to all county agencies so that any entity may access.

Many of the key players and offices that directly impact Montgomery County’s infrastructure are not located within Montgomery County. Although the owners and operators of these key resources are within the County, these critical assets impact the whole State of Maryland and the

entire NCR. Many of the subject matter experts are a part of the committees, councils, and members of the state and federal partners. Throughout the National Capital Region and the State of Maryland offers programs that are closely tied in with federal, state, local, and private stakeholders. Many of these programs can be used as a resource for providers, and enable them to ascertain intelligence and share information. Departmental Operation Centers, Emergency Operation Centers, Local Recovery Committees, Maryland Coordination and Analysis Center, Washington Regional Threat and Analysis Center and Joint Field Offices: Provides a focal point for incident-related CI/KR identification, assessment, prioritization, protection, and restoration activities. Examples of these programs include:  ACAMS (Automated Critical Assets Management System);  iCAV (Integrated Common Analytical Viewer); and  National Operations Center (NOC) Common Operating Picture (COP).

ACAMS is a secure, online database and database management platform that allows for the collection and management of CI/KR asset data; the cataloguing, screening, and sorting of these data; the production of tailored infrastructure reports; and the development of a variety of pre- and post-incident response plans useful to strategic and operational planners and tactical commanders. Email [email protected] if you have questions or need additional information.

The Constellation portion of ACAMS (C/ACAMS) is a Web-enabled information services portal that helps state and local governments build CI/KR protection programs in their local jurisdictions. Specifically, C/ACAMS provides a set of tools and resources that help law enforcement, public safety, and emergency response personnel to:  Collect and use CI/KR asset data;  Assess CI/KR asset vulnerabilities;  Develop all-hazards incident response and recovery plans; and  Build public/private partnerships.

DHS provides a free geospatial visualization tool, the Integrated Common Analytical Viewer (iCAV), to the state and local community that can be accessed via the Internet using Homeland Security Information Network (HSIN) credentials. iCAV allows state and local users to view a wide range of existing infrastructure data to inform infrastructure information collection activities, as well as an array of both static and dynamic feeds of live situational awareness information to support infrastructure analysis. iCAV also provides a limited capability to state and local users to ingest their own infrastructure data, along with DHS data and live feeds, to generate a comprehensive user- or jurisdiction-specific picture of infrastructure assets, networks, and systems. To learn how iCAV can support your organization’s homeland security efforts, contact [email protected]. Information is also available at www.dhs.gov/iCAV.

NOC COP – The COP is the core DHS situational awareness (SA) capability for effective decision making, rapid staff actions, and appropriate mission execution. It is an integrated SA application that supports the DHS mission of responding to threats and hazards to the nation by collecting, sharing and displaying multi-dimensional information that facilitates collaborative planning and responses to these threats. The NOC COP capability supports federal, state, tribal,

and local decision makers; and stakeholders by providing consistent, timely, and accurate reporting of critical information for events of national and international significance.1

DHS and the Sector Specific Agencies (SSAs), which populate the Infrastructure Data Warehouse (IDW) which uses virtual, federated database architecture to provide access to a more robust and complete infrastructure data set. The IDW provides a larger, virtual information technology (IT) architecture to link existing, noncontiguous databases, allowing infrastructure data to remain at the source. This architecture will reduce duplication of effort and improve robustness of existing information at a lower cost, while facilitating data maintenance and verification by numerous partners and entities within the homeland security community.

The Food and Agriculture Sector developed an assessment tool to document the most critical sector systems and subsystems. This tool is the Food and Agriculture Sector Criticality Assessment Tool (FASCAT). FASCAT helps state agencies and HSAs identify sector elements and systems that are critical to key commodity chains or food distribution systems in their state. In addition, FASCAT allows states to:  Prioritize vulnerability assessments and development of protective measures or mitigation strategies;  Document and improve the characterization of their Food and Agriculture Sector risk profile; and  Respond effectively to future DHS data calls for information on critical food and agriculture infrastructure components.

Because food and agriculture issues are often the responsibility of multiple state agencies, it is recommended that states and/or localities form multi-agency working groups to identify the sector commodity systems most vital to the state and/or localities. The complete FASCAT module, instructions, and an online tutorial are available at www.ncfpd.umn.edu.

Roles and Responsibilities/ Key Offices and Players

Although many of the CIKR sectors impact many of the County agencies, County leadership would most likely benefit with one County agency being considered the lead of the CIKR sector. The County sector specific agencies will provide assistance to leadership during response and recovery efforts, post disaster or event, and provide updates to the County’s Emergency Operations Center (EOC). Examples of the sector Montgomery County specific agencies include:

1 U.S. Department of Homeland Security, IT Program Assessment: Department of Homeland Security (DHS) Analysis and Operations (A&O) Common Operating Procedure (COP) (2012), available at http://www.dhs.gov/xlibrary/assets/mgmt/itpa-ao-cop2012.pdf

Critical Lead Department/Agency County Sector Specific Infrastructure/ Key Departments/Agencies (As assigned Resources (CIKR) by OEMHS) Sector Food and Agriculture Department of Health and Department of Health and Human Human Services Services Office of Consumer Protection Office of Emergency Management and Homeland Security Montgomery County Police Department Office of Economic Development Banking and Finance Department of Finance Department of Finance Chemical Department of Department of Transportation Transportation Department of Fire and Rescue Services Office of Emergency Management and Homeland Security Department of Environmental Protection Washington Suburban Sanitary Commission Commercial Facilities Department of General Department of General Services Services Department of Permitting Services Department of Transportation Office of Economic Development Communications Department of Technology Department of Technology Services Services Department of Fire and Rescue Services Montgomery County Police Department Office of Emergency Management and Homeland Security Public Information Office Critical Department of General Department of General Services Manufacturing Services Department of Permitting Services Dams Department of Department of Environmental Environmental Protection Protection Maryland National Capital Park and Planning Commission Washington Suburban Sanitary Commission Defense Industrial National Guard National Guard Base Emergency Services Office of Emergency Office of Emergency Management and Management and Homeland Homeland Security

Security Department of Fire and Rescue Services Montgomery County Police Department Department of Health and Human Services Energy Department of General Department of General Services Services Department of Environmental Protection Washington Gas PEPCO BG&E First Energy Constellation Energy Government Facilities Department of General Department of General Services Services Montgomery County Public Schools Montgomery College Maryland National Capital Park and Planning Commission Department of Recreation Department of Libraries Healthcare and Public Department of Health and Department of Health and Human Health Human Services Services Fire and Rescue Services Information Department of Technology Department of Technology Services Technology Services Department of General Services Office of Emergency Management and Homeland Security National/State Department of General Department of General Services Monuments and Icons Services Strathmore Hall Office of Economic Development – North Bethesda Conference Center Glen Echo Nuclear Reactors, Department of Department of Environmental Materials and Waste Environmental Protection Protection Department of Fire and Rescue Services Montgomery County Police Department Department of Health and Human Services Office of Emergency Management and Homeland Security Montgomery County Police Department Postal and Shipping Department of Department of General Services

Transportation Transportation Department of Department of Transportation Systems Transportation Department of Environmental Protection Department of Finance Department of General Services Department of Liquor Control Office of Emergency Management and Homeland Security Montgomery County Police Department Department of Fire and Rescue Services Water Department of Department of Environmental Environmental Protection Protection Washington Suburban Sanitary Commission City of Rockville and City of Poolesville

Identify County Assets Many assets in Maryland and the region may be critical to the County’s continued functioning in an emergency, but may not reach the state or federal level of concern. Thus, the first step in this process was defining CIKR.

The Maryland Emergency Management Agency’s (MEMA) define CIKR as: “Any Maryland assets whose impaired functioning may impact the State’s ability to function, respond, or recover from an incident or event, or that may impact the health, safety, or economic well-being of Maryland and its citizens.”

The County can use MEMA’s terms to define its own CIKR assets to ensure it is County specific with dates and locations of these assets. Key components in identify CIKR are those that provide essential functions to Montgomery County; regulations, supply chain, technology, public safety, interoperability, banking, are only to name a few. Assets within the County include:

Business Location City Phone Number

Agriculture and Food Farm Service Agency 18410 Muncaster Derwood 301-590-2846 Road, Suite 134 Natural Resources 18410 Mucaster Road Derwood 301-590-2855 Conservation Service Montgomery Blair High 51 University Blvd E Silver Spring (301) 649-2800 School Commercial Facilities Mall, Westfield 7101 Democracy Bethesda 301-469-6025 Montgomery Blvd

Mall, Lakeforest 701 Russell Ave Gaithersburg 301-840-5840 Mall, Wheaton 11160 Viers Mill Rd Wheaton 301-942-3200 Discovery 1 Discovery Pl Silver Spring 240-662-2000 Communications Maryland SoccerPlex 18031 Central Park Boyds 301-528-1480 Circle JCC of Greater 6100 block Montrose Rockville Washington Campus Rd Muslim Community 15200 New Silver Spring 301-384-3454 Center Campus Hampshire Ave Communications Emergency 1300 Quince Orchard Gaithersburg 240-777-2300 Communications Center Blvd ECC Backup 120 Maryland Ave Rockville Intelsat 7900 Tysons One McLean, VA 703-559-6800 Place Global SATCOM 9141 Arbuckle Dr. Gaithersburg 301-963-0088 Technology, Inc Montgomery County 101 Monroe Street Rockville 240-777-2898 Office of Cable and Broadband Services Montgomery County 101 Monroe Street Rockville 240-777-2900 Department of Technology Services Chemical Maryland Chemical 3310 Childs Street Curtis Bay, 410-752-1800 MD Maryland Department of 1800 Washington Baltimore, 410-537-3000 the Environment Blvd MD Montgomery County 255 Rockville Pike Rockville, 240-777-7715 Department of MD Environmental Protection GEOMET Technologies 8577 Atlas Dr. Gaithersburg 301-428-9898 Human Genome 9910 & 9911 Gaithersburg 240-372-8487 Belward Campus Dr Neutron Industries 22301 Mt. Ephraim Dickerson Road

Dams (High Hazard) Dam Name Owner Brighton Dam WSSC Burnt Mills Dam M-NCPPC

Crabbs Branch SWM Dam DEP

Falls Road Golf Course Dam MCRA

Gudelsky Pond DEP Gunners Lake SWM Dam DEP Inspiration Lake Dam Gaithersburg

Lake Helene Dam Gaithersburg

Lake Lynette Dam Gaithersburg

Lake Needwood Dam M-NCPPC

Lake Nirvana Gaithersburg

Lake Placid Dam Gaithersburg Lake Walker Dam Private Lake Whetstone Dam Private Lake Bernard Frank M-NCPPC Little Seneca Dam WSSC Montgomery Auto Park Dam DEP Railroad Branch SWM Pond DEP Rattlewood Golf Course Irrigation Pond Dam MCRA Seneca Creek State Park Dam “Clopper Lake” DNR Summit Hall Park Dam Gaithersburg Wheaton Branch Regional Pond Dam DEP

Energy Power plants, 19901 Germantown Germantown 301-903-3000 Substations Road Dept. of Energy Headquarters PEPCO 201 West Gude Drive Rockville 1-877-737-2662 Pepco Substation 10611 Westlake Dr Bethesda Information Technology Fiber optic lines, 100 Bureau Drive Gaithersburg 301-975-2000 Server farms National Institute of Standards & Technology NATIONAL 9600 Gudelsky Rockville 240-314-6800 CYBERSECURITY Drive, CENTER OF EXCELLENCE (NCCOE)

Defense Industrial Base Naval Surface 9500 MacArthur Bethesda Warfare Center Blvd DHS Olney Federal 5321 Riggs Rd. Laytonsville 301-926-5393 Support Center Lockheed Martin 6801 Rockledge Dr Bethesda 301-897-6738 Campus Walter Reed 8901 Wisconsin Ave Bethesda (301) 295-4611 National Military Center Government Facilities City of Takoma 7500 Maple Ave Takoma Park (301) 891-7212 Park County Office 100 Maryland Ave Rockville Building EOB 101 Monroe St. Rockville (301)765-7049 FDA - Rockville 5600 Fishers Ln Rockville 301) 443-1544 FDA - White Oak 10903 New Silver Spring (888) 463-6332 Campus Hampshire Ave FEMA 5500 Riggs Rd Laytonsville District Court 191 East Jefferson Rockville 301-563-8800 Street District Court 8552 Second Silver Spring 301-563-8500 Avenue Montgomery 50 Maryland Rockville (240)777-7110 County Circuit Avenue Court WMATA Bethesda 7450 Wisconsin Bethesda 202-962-2121 Avenue WMATA Forest 9730 Georgia Silver Spring 202-962-2121 Glen Avenue WMATA Glenmont 12501 Georgia Wheaton 202-962-2121 Avenue WMATA 10300 Rockville Rockville 202-962-2121 Grosvenor Pike WMATA Medical 8810 Rockville Pike Rockville 202-962-2121 Center WMATA Rockville 251 Hungerford Rockville 202-962-2121 Drive WMATA Shady 15903 Somerville Rockville 202-962-2121 Grove Drive WMATA Silver 8400 Colesville Rd Silver Spring 202-962-2121 Spring WMATA 1600 Chapman Rockville 202-962-2121 Twinbrook Avenue

WMATA Wheaton 11171 Georgia Silver Spring 202-962-2121 Avenue WMATA White 5500 Marinelli Road Rockville 202-962-2121 Flint Emergency Services Poice & Fire 100 Edison Park Dr Gaithersburg Headquarters 5th District Station 20000 Aircraft Dr Germantown Rockville City Hall/ 111 Maryland Ave Rockville Police Healthcare and Public Health NIH 9000 Rockville Pike Bethesda 301-496-5685 NIH - 16701 Elmer School Road Poolesville 301-496-9550 Poolesville Campus Hospital, Holy 1500 Forest Glen Rd Silver Spring (301)754-700 Cross Hospital, 18101 Prince Phillip Dr Olney (301)774-8882 Montgomery General Hospital, 9901 Medicall Center Dr Rockville (240)826-6000 Shady Grove Adventist Hospital, 8600 Old Georgetown Rd Bethesda (301)896-3100 Suburban Hospital, 7600 Carroll Ave Takoma Park (301)891-7600 Washington Adventist Nuclear Reactor, Materials, and Waste Nuclear 11555 Rockville Pk Rockville 301-415-8200 Regulatory Commission Water Falls Road Water 11611 falls road Rockville Pumping Center Black Hills Resevoir 13340 West Old Clarksburg Baltimore Road Poolesville Sewage 19933 Fisher Poolesville Treatment Avenue Montgomery Airpark 7940 Airpark Gaithersburg Road Rockville Municipal 10700 Sandy Rockville Water Treatment Landing Wy Dalecarlia Water 5900 Macarthur Washington, DC 202-764-2702 Treatment Plant Blvd

Mirant Power Plant 21200 Dickerson Martinsburg Rd Potmac Water 12200 River Rd Bethesda Filtration Plant WSSC Seneca 12600 Great Germantown 301-206-7060 Wastewater Seneca Hwy Treatment Plant WSSC 2 Brighton Dam Brookeville 301-774-9124 Road American Legion I-495 Bethesda Bridge ACAMs data received from Montgomery County Police Department.

Incorporate County Plans Montgomery County’s Continuity of Government, COOP, Pre-Disaster Recovery Plan (PDRP), Hazard Mitigation Plan, THIRA, and the Core Capabilities Estimation Project, are examples of current plans that address CIKR, or have considered CIKR a critical component of the planning process. Incorporating those plans into this standard operating guide would be beneficial, and would enhance collaboration.

Information Sharing Environment

The following are information sharing tools available to partners within Montgomery County and throughout the National Capital Region, in regards to CIKR, and other intelligence.

Protected Critical Infrastructure Information (PCII) Program i. The Protected Critical Infrastructure Information (PCII) Program is an information- protection program that enhances voluntary information sharing between infrastructure owners and operators and the government. PCII protections mean that homeland security partners can be confident that sharing their information with the government will not expose sensitive or proprietary data. DHS and other federal, state, and local analysts use PCII to analyze and secure critical infrastructure and protected systems, identify vulnerabilities and develop risk assessments, and enhance recovery preparedness measures.2 ii. PCII is a category of Sensitive but Unclassified (SBU) information that is afforded protections from (a) disclosure under the Freedom of Information Act (FOIA) and similar state and local disclosure laws and (b) use in civil litigation or for regulatory purposes. The PCII Program is unique because it provides a method for critical infrastructure owners to submit information voluntarily to the federal government that the government would not otherwise have access to. Once information is submitted and validated by the PCII Program government entities at all levels can use the information to protect the nation’s critical infrastructure. PCII is accessed only by authorized users who have a need-to-know specified PCII.

2 U.S. Department of Homeland Security, Protected Critical Infrastructure Information (PCII) Program, available at http://www.dhs.gov/protected-critical-infrastructure-information-pcii-program

iii. The PCII Program provides protections used in various public-private infrastructure information-sharing programs, both within DHS and in other federal agencies. DHS information-sharing programs include: 1. Enhanced Critical Infrastructure Program’s (ECIP): Initiates focus for local response efforts to incidents on identified areas of criticality and assist in the prioritization of reconstruction efforts. Consists of site visits to assess overall site security, identify gaps, and suggest protective measures; 2. Infrastructure Survey Tool (IST): a web-based tool to be used in conjunction with ECIP visits, enabling effective data collection and advanced analytics. Tracks facility and sector trends over time 3. Infrastructure Information Collection Division’s Automated Critical Asset 4. Management System (ACAMS); and Buffer Zone Plans (BZPs) b. NIPP and the Federal Information Sharing Environment (ISE) i. The CI/KR ISE is a unique framework that provides the tools needed to allow security partners to share vital information, which in turn helps them manage their infrastructure security and risk, respond to events, and enhance resilience.

II. Tools Supporting Information Sharing DHS has established several operations and tools to support information sharing within and among the critical infrastructure sectors. These include3: i. Homeland Security Information Network-Critical Sectors (HSIN-CS) — HSIN is a secure Web-based platform that facilitates sharing of sensitive information and fosters collaboration among federal, state, local, tribal, private sector, and international partners. HSIN-CS is the section of HSIN that focuses on providing information sharing with the Department’s critical infrastructure protection partners. HSIN-CS also provides collaboration capabilities for the 16 critical infrastructure sectors. ii. Homeland Infrastructure Threat & Risk Analysis Center (HITRAC) — HITRAC is the joint fusion center of IP and the Office of Intelligence and Analysis. It contains both region and sector specific analysts and manages the advanced modeling, simulation, and analysis efforts of the National Infrastructure Simulation and Analysis Center (NISAC). HITRAC is the preeminent national center for the integration, analysis, and sharing of information regarding risk of terrorist attacks and other hazards to critical infrastructure. HITRAC analytic products are available on HSIN-CS. Partners can request subject matter expert support from HITRAC to supplement their own infrastructure analysis efforts. iii. National Infrastructure Coordinating Center (NICC) — The NICC is a 24-hour watch center that maintains situational and operational awareness, communication, and coordination among the critical infrastructure public and private stakeholders. iv. DHS Daily Open Source Infrastructure Report – The Daily Report is a summary of open-source published information about significant critical infrastructure issues. v. Protected Critical Infrastructure Information (PCII) Program — (See definition above).

3U.S. Department of Homeland Security, Information Sharing: A Vital Resource for a Shared National Mission to Protect Critical Infrastructure, available at http://www.dhs.gov/information-sharing-vital-resource-shared-national- mission-protect-critical-infrastructure

vi. IP is also working closely with state and major urban area fusion centers and regional partnerships and coalitions to ensure timely information is available to the communities and local responders who need it. Numerous states and large cities have established fusion centers to share information and intelligence.

Public-Private Partnerships a. Identified in County EOP b. Regional Directors (RDs): IP’s regional directors are the supervisory Protective Security Advisors (PSAs) that lead PSA activities in each region. c. Protective Security Advisors (PSAs): PSAs provide expert knowledge of the impacted infrastructure, maintain communications with critical infrastructure owners and operators, and prioritize and coordinate critical infrastructure response, recovery, and restoration. Located in all 50 states, they assist with state and local critical infrastructure security efforts by establishing and maintaining relationships with public and private sector partners, state Homeland Security Advisors, and critical infrastructure stakeholders. They serve as the Infrastructure Liaisons at the Federal Emergency Management Agency Joint Field Office (JFO) and in state and county emergency operations centers. d. Geospatial Analysts: Homeland Infrastructure Foundation Level Data (HIFLD) provides critical infrastructure data and visualization capabilities to the PSAs and serves as field extension support to the HIFLD working group. Partners in this program include the Department of Defense, the National Geospatial-Intelligence Agency, and the U.S. Geological Survey. e. Chemical Security Inspectors: Chemical Security Inspectors are positioned in 11 regional offices across the United States and conduct security inspections and/or audits at facilities covered by the Chemical Facility Anti-Terrorism Standards (CFATS). The Department inspects high-risk facilities at regular intervals, but inspectors from the Department may inspect a facility at any time based on new information or security concerns. To contact the Chemical Security Inspectors in your area, call the CFATS Help Desk at 866-323-2957. f. Regional Resiliency Assessment Program (RRAP): Evaluates critical infrastructure in specific geographic regions to examine vulnerabilities, threats, and potential consequences from an all-hazards perspective. Participation in RRAP is voluntary and the information collected is protected under the PCII Program.

Business Continuity Organizational disruption can result in loss of revenue. Organizations must develop a business continuity plan respective to its critical infrastructure. Begin by: Determine risk for the infrastructure; Risk = threat x vulnerabilities x consequences Conduct a business impact analysis to identify time-sensitive or critical functions, processes, and the resources that support them. Identify the operational and financial impacts resulting from the disruption of critical infrastructure functions and processes. Impacts to consider include:  Lost sales and income;  Delayed sales or income;  Increased expenses (e.g., overtime labor, outsourcing, expediting costs, etc.);  Regulatory fines;

 Contractual penalties or loss of contractual bonuses;  Customer dissatisfaction or defection; and  Delay of new business plans Identify and document resource requirements based on the business impact analysis and conduct gap analysis. Compose recovery strategies with management approval then implement those strategies. Utilize simple, measurable, achievable, realistic and task-oriented (SMART) objectives to ensure strategies are accurate. (1) Organize a County continuity team and compile a COOP to manage a disruption. (2) Conduct training for the continuity team; testing and exercising to evaluate recovery strategies and the plan.

III. Conclusion

The purpose of this CIKR Assessment is to respond to all disasters and emergencies and ensure the safety and protection of its citizens. The Assessment provides guidance for County’s leadership to minimize the loss of life, injury, and property damage after an emergency event by identifying assets within the County that directly or indirectly impact CIKR. Another key element is to assign roles and responsibilities for various CIKR, both within the County, and partners throughout the region that will have a direct impact on Montgomery County. The below lists the lead agencies for various sectors:

The sectors and lead agencies include: · Food and Agriculture: Department of Health and Human Services · Chemical: Department of Transportation · Commercial Facilities: Department of General Services · Communications: Department of Technology Services · Dams: Department of Environmental Protection · Defense Industrial Base: National Guard · Emergency Services: Office of Emergency Management and Homeland Security · Energy: Department of General Services · Government Facilities: Department of General Services · Healthcare and Public Health: Department of Health and Human Services · Information Technology: Department of Technology Services · National/State Monuments and Icons: Department of General Services · Nuclear Reactor, Materials and Waste: Department of Environmental Protection · Postal and Shipping: Department of Transportation · Transportation Systems: Department of Transportation · Water: Department of Environmental Protection

This CIKR Assessment also provides information about sharing tools/resources available to partners within Montgomery County and throughout the National Capital Region, in regards to CIKR, and other intelligence. This includes Public-Private Partnerships and Business Continuity.