Cover: Identifying and Prioritizing Systemically Important Entities

Identifying and Prioritizing Systemically Important Entities

Advancing Critical Infrastructure Security and Resilience

Published Nov 20, 2023

by John Bordeaux, Jonathan W. Welburn, Sasha Romanosky, Benjamin Boudreaux, Aaron Strong, Shannon Prier, Cheryl K. Montemayor, Jhacova Williams, Jessica Welburn Paige, Michael J. D. Vermeer, et al.

Download

Download eBook for Free

FormatFile SizeNotes
PDF file 1.6 MB

Use Adobe Acrobat Reader version 10 or higher for the best experience.

Purchase

Purchase Print Copy

 Format Price
Add to Cart Paperback99 pages $28.00

Research Questions

  1. What are the definitions of systemic importance and SIEs?
  2. How can the size and interconnectedness of an SIE be used to prioritize SIEs?

In response to the mounting specter of systemic cyber risks, the Cyberspace Solarium Commission recommended that Congress codify the concept of Systemically Important Critical Infrastructure—later renamed Systemically Important Entities (SIEs)—and that the Cybersecurity and Infrastructure Security Agency (CISA) be resourced to identify SIEs and support in the mitigation of their risks to support a broader national strategy of layered deterrence. In support of the CISA National Risk Management Center (NRMC), this report clarifies the concepts of SIEs and introduces a data-driven methodology for their identification and prioritization. Specifically, the authors identify SIEs by their potential to affect national critical functions (NCFs) and prioritize SIEs by measures of their size and interconnectedness. This report builds on existing work regarding Critical IT Products and Services and extending the researchers' analysis to federal agencies and firms that install potentially vulnerable software, in addition to firms that write software. This report further documents systemic risks and cyber risks in software supply chains, past and ongoing analytical support to CISA, and current limitations, and it outlines a path for future work.

Key Findings

  • The authors examined previous discussions of systemic risk drawn from historical observations of economic crises and examinations of systemic cyber risk to develop definitions of systemic importance and SIEs.
  • The authors used these definitions in developing a transparent, data-driven methodology for identifying and prioritizing SIEs.
  • Specifically, the authors introduce a two-step process of (1) connecting NCFs to economic sectors and (2) connecting economic sectors to specific entities.
  • The authors also developed an analytic platform, the Systemic Importance Analytic Model (SIAM), to process initial lists of entities associated with NCFs.

Recommendations

  • This report provides NRMC with potential objective criteria for determining a prioritized list of SIEs—a list which can enable CISA to strengthen entity risk management and coordination, allocate resources, monitor threats and hazards, and prioritize planning in support of a broader national strategy of layered deterrence.
  • Significant work remains in developing concepts and modeling approaches for systemic risk to critical infrastructure, advancing NRMC's incorporation and stewardship of data sets for analysis and visualization, maturing the SIE Program Office processes and procedures for analysis and outreach, and advancing SIAM to reflect emerging perspectives for prioritization—including public health and safety, national security, equity, and other areas.
  • Several analysis needs that would help advance the NRMC's risk reduction mission include (1) advancing SIE concepts and modeling approaches, (2) developing data management methods and planning for analytic input data, (3) advancing SIE as a sustainable program, and (4) refining the SIE analytic platform.

This research was prepared for the National Risk Management Center, Cybersecurity and Infrastructure Security Agency and conducted within the Infrastructure, Immigration, and Security Operations Program of the RAND Homeland Security Research Division.

This report is part of the RAND research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.