The Cybersecurity and Infrastructure Security Agency (CISA) is resourced to support a broad national strategy of layered deterrence by identifying systemically important entities and supporting in the mitigation of risks to national critical functions. This report documents systemic risks, cyber risks in software supply chains, past and ongoing analytical support to CISA, current limitations, and also outlines a path for future work.
Identifying and Prioritizing Systemically Important Entities
Advancing Critical Infrastructure Security and Resilience
Download
Download eBook for Free
| Format | File Size | Notes |
|---|---|---|
| PDF file | 1.6 MB | Use Adobe Acrobat Reader version 10 or higher for the best experience. |
Purchase
Purchase Print Copy
| Format | List Price | Price | |
|---|---|---|---|
| Add to Cart | Paperback99 pages | $28.00 | $22.40 20% Web Discount |
Research Questions
- What are the definitions of systemic importance and SIEs?
- How can the size and interconnectedness of an SIE be used to prioritize SIEs?
In response to the mounting specter of systemic cyber risks, the Cyberspace Solarium Commission recommended that Congress codify the concept of Systemically Important Critical Infrastructure—later renamed Systemically Important Entities (SIEs)—and that the Cybersecurity and Infrastructure Security Agency (CISA) be resourced to identify SIEs and support in the mitigation of their risks to support a broader national strategy of layered deterrence. In support of the CISA National Risk Management Center (NRMC), this report clarifies the concepts of SIEs and introduces a data-driven methodology for their identification and prioritization. Specifically, the authors identify SIEs by their potential to affect national critical functions (NCFs) and prioritize SIEs by measures of their size and interconnectedness. This report builds on existing work regarding Critical IT Products and Services and extending the researchers' analysis to federal agencies and firms that install potentially vulnerable software, in addition to firms that write software. This report further documents systemic risks and cyber risks in software supply chains, past and ongoing analytical support to CISA, and current limitations, and it outlines a path for future work.
Key Findings
- The authors examined previous discussions of systemic risk drawn from historical observations of economic crises and examinations of systemic cyber risk to develop definitions of systemic importance and SIEs.
- The authors used these definitions in developing a transparent, data-driven methodology for identifying and prioritizing SIEs.
- Specifically, the authors introduce a two-step process of (1) connecting NCFs to economic sectors and (2) connecting economic sectors to specific entities.
- The authors also developed an analytic platform, the Systemic Importance Analytic Model (SIAM), to process initial lists of entities associated with NCFs.
Recommendations
- This report provides NRMC with potential objective criteria for determining a prioritized list of SIEs—a list which can enable CISA to strengthen entity risk management and coordination, allocate resources, monitor threats and hazards, and prioritize planning in support of a broader national strategy of layered deterrence.
- Significant work remains in developing concepts and modeling approaches for systemic risk to critical infrastructure, advancing NRMC's incorporation and stewardship of data sets for analysis and visualization, maturing the SIE Program Office processes and procedures for analysis and outreach, and advancing SIAM to reflect emerging perspectives for prioritization—including public health and safety, national security, equity, and other areas.
- Several analysis needs that would help advance the NRMC's risk reduction mission include (1) advancing SIE concepts and modeling approaches, (2) developing data management methods and planning for analytic input data, (3) advancing SIE as a sustainable program, and (4) refining the SIE analytic platform.
Table of Contents
Chapter One
Introduction
Chapter Two
Background and Motivation on Systemic Importance
Chapter Three
Systemically Important Entities: Identification and Prioritization
Chapter Four
Systemic Cyber Risk
Chapter Five
Future Research
Appendix A
Systemic Importance Analytic Model
Appendix B
Cybersecurity and Infrastructure Security Agency Strategic Intent and National Risk Management Center Missions and Objectives
Appendix C
Cyber Data and Software Dependencies
Appendix D
Analytical Support for the Cybersecurity and Infrastructure Security Agency
Research conducted by
This research was prepared for the National Risk Management Center, Cybersecurity and Infrastructure Security Agency and conducted within the Infrastructure, Immigration, and Security Operations Program of the RAND Homeland Security Research Division.
This report is part of the RAND Corporation Research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.
The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.