The Cybersecurity and Infrastructure Security Agency (CISA) is resourced to support a broad national strategy of layered deterrence by identifying systemically important entities and supporting in the mitigation of risks to national critical functions. This report documents systemic risks, cyber risks in software supply chains, past and ongoing analytical support to CISA, current limitations, and also outlines a path for future work.
Identifying and Prioritizing Systemically Important Entities
Advancing Critical Infrastructure Security and Resilience
- What are the definitions of systemic importance and SIEs?
- How can the size and interconnectedness of an SIE be used to prioritize SIEs?
In response to the mounting specter of systemic cyber risks, the Cyberspace Solarium Commission recommended that Congress codify the concept of Systemically Important Critical Infrastructure—later renamed Systemically Important Entities (SIEs)—and that the Cybersecurity and Infrastructure Security Agency (CISA) be resourced to identify SIEs and support in the mitigation of their risks to support a broader national strategy of layered deterrence. In support of the CISA National Risk Management Center (NRMC), this report clarifies the concepts of SIEs and introduces a data-driven methodology for their identification and prioritization. Specifically, the authors identify SIEs by their potential to affect national critical functions (NCFs) and prioritize SIEs by measures of their size and interconnectedness. This report builds on existing work regarding Critical IT Products and Services and extending the researchers' analysis to federal agencies and firms that install potentially vulnerable software, in addition to firms that write software. This report further documents systemic risks and cyber risks in software supply chains, past and ongoing analytical support to CISA, and current limitations, and it outlines a path for future work.
- The authors examined previous discussions of systemic risk drawn from historical observations of economic crises and examinations of systemic cyber risk to develop definitions of systemic importance and SIEs.
- The authors used these definitions in developing a transparent, data-driven methodology for identifying and prioritizing SIEs.
- Specifically, the authors introduce a two-step process of (1) connecting NCFs to economic sectors and (2) connecting economic sectors to specific entities.
- The authors also developed an analytic platform, the Systemic Importance Analytic Model (SIAM), to process initial lists of entities associated with NCFs.
- This report provides NRMC with potential objective criteria for determining a prioritized list of SIEs—a list which can enable CISA to strengthen entity risk management and coordination, allocate resources, monitor threats and hazards, and prioritize planning in support of a broader national strategy of layered deterrence.
- Significant work remains in developing concepts and modeling approaches for systemic risk to critical infrastructure, advancing NRMC's incorporation and stewardship of data sets for analysis and visualization, maturing the SIE Program Office processes and procedures for analysis and outreach, and advancing SIAM to reflect emerging perspectives for prioritization—including public health and safety, national security, equity, and other areas.
- Several analysis needs that would help advance the NRMC's risk reduction mission include (1) advancing SIE concepts and modeling approaches, (2) developing data management methods and planning for analytic input data, (3) advancing SIE as a sustainable program, and (4) refining the SIE analytic platform.
Table of Contents
Background and Motivation on Systemic Importance
Systemically Important Entities: Identification and Prioritization
Systemic Cyber Risk
Systemic Importance Analytic Model
Cybersecurity and Infrastructure Security Agency Strategic Intent and National Risk Management Center Missions and Objectives
Cyber Data and Software Dependencies
Analytical Support for the Cybersecurity and Infrastructure Security Agency