DHS Releases NIPP IT Sector Plan: Start Reading

  The Department of Homeland Security officially announced the release of Sector-Specific Plans on May 21. These plans provide important details to the National Infrastructure Protection Plan (NIPP) which was released last year. The Information Technology (IT) plan breaks important new ground. My advice: start reading.

 First, you can download the NIPP IT Sector Plan from the National Association of State Chief Information Officers (NASCIOs) Security Committee’s website.  NASCIO’s security website also has links to the overall NIPP Plan as well as some helpful background information on the documents.

 So why is this important? Should you care? As I said in a blog at the beginning of the year, I think this is a big deal. (OK, so it was released a few months later than I thought.)

 This document addresses many essential topics that IT Sector professionals have been asking about for years – especially after September 11, 2001. There are chapters on key definitions, risk management, developing and implementing protective programs, information sharing, research and development, and implementing specific near term and long-term technology tasks.

 Over the coming weeks, I intend to blog about some of the items in the plan, so I won’t dive in too deep here. Needless to say, I think it is important. Yes, I must admit my bias. As the primary NASCIO representative to the IT-Government Coordinating Council (IT-GCC), I did help a little in writing the document. As you will see at the beginning of the plan, the majority of the contributors and buy-in came from the private sector. They really stepped up in developing this plan.

 On Thursday, May 31, NASCIO held a national call on this topic, where DHS and private-sector professions briefed state CIOs and CISOs from 34 states and Washington DC on the NIPP IT Sector Plan.  More rollout briefings are planned around the country, and this is really just the beginning. Now we get to implement the plan. Yes, we need help, so stay tuned.

 Although media coverage has been sparse on this topic, there are a few articles out about this plan. Computerworld’s article summarized various components.   

“It’s not just a puff piece,” said John Sabo, president of the IT-Information Sharing and Analysis Center (IT-ISAC) and director of global government relations at CA Inc. “Planning is very, very important. But without effective implementation in an operational environment, such plans will have no value. We believe that operational capability is the end game,” he said.

A very high level overview of the key NIPP terms and groups can also be found at this US-CERT site.