This report presents best practices in risk assessment; challenges in implementing the National Critical Function (NCF) risk assessment framework to characterize risk that the coronavirus disease 2019 (COVID-19) pandemic poses to critical infrastructure; recommendations for improving the framework; and suggestions for further characterizing NCFs' interdependence, vulnerability, and geographic variation to improve risk assessment processes.
- What are the challenges and opportunities related to use of the NCF risk assessment framework?
- How might the framework be improved?
The Homeland Security Operational Analysis Center (HSOAC) was tasked with using the National Risk Management Center's (NRMC's) National Critical Function (NCF) risk assessment framework to assess risk to each NCF and complete individual risk analyses for the 55 NCFs. The NRMC also requested that HSOAC perform additional tasks, including providing a report on emerging lessons learned from risk management efforts to limit the impact and disruption that coronavirus disease 2019 (COVID-19) had on the 55 NCFs.
This report presents insights into best practices in risk assessment; challenges in the implementation of the NCF risk assessment framework to characterize risk to critical infrastructure associated with the COVID-19 pandemic; recommendations for improving the framework; and suggestions for further characterization of NCFs' interdependence, vulnerability, and geographic variation that could improve risk assessment processes.
- Challenges in implementing the framework include persistently high risk ratings, difficulty in assessing risk to some NCFs in isolation from other NCFs, separating out national from regional impacts, and identifying NCFs that are especially vulnerable to disruption from COVID-19.
- Recommendations for improving the framework in future iterations include opportunities to review and refine the drivers of risk examined, the indicators used to monitor risk, and the time scale used in assessing risk. The NRMC might also consider stress-testing the framework against other potential threats.
- Future risk assessments can also be enhanced through a better understanding of interdependence, vulnerability, and geographic variation among NCFs. Finally, the NRMC might consider opportunities to enhance dissemination by documenting successful mitigation activities and improving the two-way flow of risk information for different audiences.