I enjoyed reviewing the President’s Council of Advisors on Science and Technology (which boasts some big name institutions), “Report to the President” on “Strategy for Cyber-Physical Resilience”.
The Strategy offers a total of 14 recommendations across four categories:
- Establish performance goals
- 1.A Define sector minimum viable operating capabilities and minimum viable
delivery objectives - 1.B Establish and measure leading indicators
- 1.C Commit to radical transparency and stress testing
- 1.A Define sector minimum viable operating capabilities and minimum viable
- Bolster and coordinate research and development
- 2.A Establish a National Critical Infrastructure Observatory
- 2.B Formulate a national plan for cyber-physical resilience research
- 2.C Pursue cross-ARPA coordination
- 2.D Radically increase engagement on international standards
- 2.E Embed content on cyber-physical resilience skills into engineering professions
and education programs
- Break down silos and strengthen government cyber-physical resilience capacity
- 3.A Establish consistent prioritization of critical infrastructure
- 3.B Bolster Sector Risk Management Agencies staffing and capabilities
- 3.C Clarify and strengthen Sector Risk Management Agency authorities
- 3.D Enhance the DHS Cyber Safety Review Board (CSRB)
- Develop greater industry, board, CEO and executive accountability and flexibility
- 4.A Enhance Sector Coordinating Councils
- 4.B Promote supply chain focus and resilience by design
The report provides some context and insight on each of these. I can’t help but comment on 1.A. “Define sector minimum viable operating capabilities and minimum viable delivery objectives”.
I really like this idea because it shifts focus from the system itself (networks, software, process equipment) to the delivery of the critical function (power, water, food, etc). This is a great step in thinking through what matters most.
My observation is that in a highly interconnected world, with global supply chains, setting a scope for performance for an entire sector seems challenging because sectors don’t really “exist”. They are not monoliths. Their value is the service they provide to various users and customers, rather than to themselves.
Consider that the number and size of infrastructure service providers can vary greatly depending on geography. What is the minimum level of electricity or water to sustain quality of life for Southeast Idaho? For the city of Los Angeles? For the state of Texas? So the approach has got to include both sector and geography.
And within those geographies, various organizations rely on infrastructure services. Who should receive those services first?
Then, we have to recognize that sources of communications, energy, food, water, and medicine frequently (most frequently?, almost always?) operate across geographic boundaries — including in some (many?) cases across national boundaries.
Finally, each sector is not truly independent of other sectors. One geo-sector’s minimum viability may depend upon and/or conflict with that of another geo-sector.
I am pleased that the PCAST took up this topic. I am very optimistic about incorporating function-centered thinking. I find intriguing the idea of establishing minimum viable operating capabilities and objectives. However, I remain concerned that administrative constructs based primarily on sectors and geographies leave significant gaps.
There are some words in the strategy, such as “enhance supply chain focus” and “enhance cross-sector coordinating councils” that could address this concern, but I found this presented as “do this too” rather than as an indispensable component of CPS robustness and resiliency.
I am not advocating abandonment of sector and geography thinking, but I believe we will need some additional paradigms and/or alternative perspectives to do this well.