text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: •private sector aid to private sector •private sector aid to public sector •public sector aid to private sector •public sector aid to public sector

text: •contracted (formal) •equipment •combinations of informal and •services formal •manpower

text: •all network access types •cable (coaxial cable)

text: •optical (fibre optic cable) •wireless (air interface) •local •wireline (copper wire) •national •all technologies (ATM, BWA, DOCSIS, •regional (within Europe) CDMA, GSM, IN, IP, IMS, MPLS, SIP, •international C7, SS7, SONET, SDH, 3G, 4G, TDM, WIFI, WLAN, WIMAX, …) •all services types (data, hosting, Internet, test, video, voice …)

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: cell on wheels

text: (COW) This section presents twelve observations that are pivotal in understanding the situation in Europe for why Mutual Aid Assistance are program on hardware Software underutilised as a strategy for preparing for provided (above) catastrophic events. Other relevant observations could be spare critical presented here, but these are the crucial ones Network ingress or egress on which the recommendations have been capacity made during the Phase 2 part of this initiative. It should also be noted that there are existing, see Key good examples of private-sector led formal Payload Observation 7 Mutual Aid Assistance and their model can be a useful example as the recommendations are developed. Human cable splicer In addition to its brief title, each observation is composed of three elements: its Essence, an Examination, and its Effect. The first provides a concise statement of the heart of the matter. see Key ASPR The second, an analysis to enhance Observation 8 understanding of why the observation is what it is. The third element underscores the significance of the insight. The twelve Key Observations are summarised below. Their order is significant as there is a progressive logical flow for most of them. Observations 1 through 5 deal progressively with the environment that affects decision-making in emergency preparedness. Observations 6 through 8 address the prioritisation of actual shared resources.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: •Mutual aid provides high value for emergency situations that are typically of (a) low frequency and (b) of very high impact.

text: •Corporate and Member States emergency preparedness is often reactive in nature, and little forethought is usually given to low frequency, catastrophic events.

text: •The degree of planning for low frequency catastrophic events suffers from diminished responsibilities for managing responses for these types of events, as they are treated as out of scope.

text: •Critical emergency preparedness planning neglects low-probability events that have a high impact due to the very natures of these two distinguishing attributes.

text: •Emergency response and restoration capabilities are usually considered successful based on best effort with available resources, and especially so for rare, unexpected events.

text: •Resource sharing is possible for six of the eight ingredients that constitute information and communication technology (ICT) infrastructure: power, environment, hardware, software, networks and human.

text: •The ultimate support is provided when the responsibility for completing services is transferred between contracted parties.

text: •Mutual Aid Assistance are an advanced means of extending resilience through the use of mutual common interests.

text: •Perceived and real constraints regarding competitive and legal issues impede early and sustained dialogue with potential mutual aid partners.

text: •Mutual aid agreement activity in Europe has been largely uncelebrated and therefore general awareness suffers.

text: •Mutual Aid Assistance are essential for critical infrastructure operators that need to be prepared for the full range of crisis scenarios.

text: •The utilization of Mutual Aid Assistance for managing low frequency, high impact events is an emergency preparedness ROI breakthrough.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Table 1: Summary of Recommendations and Primary Leadership Roles

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Key Observation No. 9, Resource Sharing Constraints, Section 3.9. Key Observation No. 10, Unsung Mutual Aid Successes, Section 3.10. Key Observation No. 2, Tail Event Syndrome, Section 3.2.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Key Observation No. 6, Ingredient Transfer Potential, Section 3.6. Key Observation No. 7, Transfer of Responsibility, Section 3.7. Key Observation No. 5, Best Effort Acceptance, Section 3.5.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Key Observation No. 4, Economic Considerations, Section 3.4. Key Observation No. 8, Mutual Aid Is Good Policy, Section 3.8. Key Observation No. 12, Smart Planning, Section 3.12. Key decision makers in critical infrastructure operations should consider applying for priority communications schemes, where available. Rauscher, Karl Frederick and Goldman, Stuart, Priority International Communications (PIC) – Staying Connected in Times of Crisis, EastWest Institute, 2012; www.ewi.info/pic . Key Observation No. 3, Planning, Section 3.3.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Must be done with legal consideration depending on the jurisdictions involved.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Key Observation No. 12, Smart Planning, Section 3.12.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Key Observation No. 1, Maximum Opportunity for Mutual Aid Assistance, Section 3.1.

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: Phase II: Recommendations Report

text: 1.0, November 2013

identifier: Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.) - Phase II: Recommendations Report

title: Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.) - Phase II: Recommendations Report

text: Phase II: Recommendations Report

text: 1.0, November 2013

text: European Union Agency for Network and Information Security www.enisa.europa.eu

text: Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: The Electronic Infrastructure Integrity Institute (EIII) of Plazion, Inc. has prepared this document for the European Network and Information Security Agency (ENISA). The authors of this document are:  Karl Frederick Rauscher  Stuart Goldman  Lionel Dupré, ENISA.

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: ENISA thanks the following individuals for their contributions to this Report: - Richard E. Krock (Bell Labs, Alcatel-Lucent). - The organisers, hosts and expert participants of the ARECI Workshops: London (2007), Amsterdam (2008), Lisbon (2009); of note these include:  Valerie Andrianavaly, European Commission (Belgium)  Pedro Manuel de Barros, ANACOM (Portugal)  David Corrie, BT (U.K.)  José Fino Gomes, PT Comunicações (Portugal)  Thomas Kristmar, National IT and Telecom Agency (Denmark)  Pierre-Dominique Lansard, France Telecom (France)  Noel Lindford, BT (U.K.)  Simon van Merkom, Ministrie van Economische Zaken (The Netherlands)  Jonny Nilsson, PTS (Sweden)  Hakon Styri, Post-og teletilsynet (Norway)  John Vanleeuwen KPN (The Netherlands) - The emergency preparedness planners and crisis responders across Europe’s ICT industry. - The European Public-Private Partnership Task Force on Mutual Aid Strategies.

text: Legal notice

text: Copyright Notice

text: Executive Summary

text: The Mutual Aid for Resilient Infrastructure in Europe (MARIE) Issue 1 Report (2011) , which reflects the Phase 1 effort of this initiative, presented twelve Key Observations about Mutual Aid Assistance (MAA) which will be summarised later in this document. The objective of this initiative is to promote the resilience of European ICT infrastructures through the use of MAA strategies. To accomplish this, the value of mutual aid assistance will be described, insights into challenges in implementing MAAs will be captured and guidance will be articulated that will lead to greater utilisation of this advanced emergency preparedness measure. In presenting those Key Observations lays the foundation for actionable recommendations, which are included in this Report, and reflects work done during this initiative. This MARIE Issue 2 Report adds five actionable recommendations;

text: 1. Member States Level the Road

text: 2. A Mutual Aid Agreement Template

text: 3. Critical Information Infrastructure Provider Due Diligence for Stakeholders

text: 4. Scarce Resource Strategy

text: 5. Local Communities Self-Reliance

text: The approach used by the MARIE Study and Report builds upon existing progress made. It extends this progress by conducting analyses of the current situation that would lend insights into how best to move forward, providing guidance to achieve further MAA deployments and creating an environment in Europe that will continue to sustain long term utilisation of mutual aid strategies that greatly enhance European critical Information infrastructures.

text: 1 Introduction

text: One of the most prominent obstacles to further utilisation of Mutual Aid Assistance (MAAs) is that organisations which embrace emergency preparedness responsibilities may not correctly take account of low probability and high impact events. Most of the observations presented here tightly couple with emergency preparedness motivation,with the primary concern leaning towards those types of large-scale incidents.

text: 1.1 Goal

text: This report presents 5 main recommendations which will –if implemented- improve emergency preparedness for ICT Stakeholders. The results of the preliminary study performed in 2011 showed that the preparedness for Black Swan events (low probability / high impact) cannot be handled in isolation, and that one of the possible responses to this issue could be the use of Mutual Aid Agreements. The recommendations intend to provide a high level coverage to raise awareness and encourage their development.

text: 1.2 Target audience

text: The 2007 ARECI Report called on the private sector across Europe to take the initiative to establish formal Mutual Aid Assistance in order to enhance existing resilience capabilities. As a result, some notable progress has been made, however there are many more opportunities for Mutual Aid Assistance to be implemented. The European private sector could champion the available opportunities: the difference between getting, and not getting this done, can mean the continued operation, or failure, of critical information infrastructure in the times when it is most needed by society. The first phase of this initiative has presented twelve Key Observations that concisely capture the most important aspects of the current landscape in Europe regarding the state of MAAs. These observations are foundational for these recommendations.

text: 2 Scope

text: Mutual Aid Assistance is an arrangement entered into by two or more parties that make provision for lending assistance across normal boundaries during an emergency situation. The types of mutual aid with the scope of this study include:

text: Sector orientation Formality •ad hoc (informal) Types of assistance Network and Technology Geographical range

text: 2.1 Ingredients

text: Ingredients are usual “components” which space in a contribute to the overall Resilience of a given Environ- strategically ment located data Critical Inforamtion Infrastructure. A set of 2 centre suggested ingredients were initially devised in a Bell-Labs publications for the enhancement of Networks Reliability and Security. diesel generator Power The diagram below shows these 8 ingredients, and provides one example for each.

text: 2.2 Key Observations Hardware

text: Karl F. Rauscher, Richard E. Krock, and James P. Runyon, 2006, Eight Ingredients of Communications Infrastructure: A Systematic and Comprehensive Framework for Enhancing Network Reliability and Security, Bell Labs Technical Journal, (c) Lucent Technologies Inc.

text: Maximum Opportunity for Mutual Aid Assistance Tail Event Syndrome Planning Economic Considerations Best Effort Acceptance Ingredient Transfer Potential Transfer of Responsibility Mutual Aid Is Good Policy Resource Sharing Constraints Unsung Mutual Aid Successes Full Spectrum Emergency Preparedness Smart Planning

text: 3 Recommendations

text: This section presents 5 actionable recommendations that, if implemented, will greatly enhance the resilience of European critical information infrastructure in the midst of a crisis. The recommendations are presented to Member States and the Private sector. Each recommendation is presented with supporting material, such as the Key Observations of the previous section, required commitments, benefits of implementation, alternatives and their consequences, next steps and measures of success. With the underpinning of the Key Observations generated from the MARIE Phase I effort, a solid foundation was laid for this Phase 2 work, which focused on developing guidance that can effectively establish a trajectory for on-going, sustained mutual aid agreements.

text: Recommendation Private Member Sector States

text: 1. Member States Level the Road X

text: 2. A Mutual Aid Agreement Template X 3. Critical information infrastructure Provider Due Diligence for X Stakeholders 4. Scarce Resource Strategy X X

text: 5. Local Communities Self-Reliance X X

text: 3.1 Member States Level the Road

text: 3.1.1 Background

text: Regulations and Fragmentation may have imposed hurdles along the path to private sector mutual aid agreements. These hurdles may be generic legacy wording that may be silent on emergency situational exemptions. An excess of regulation may discourage companies from pursing mutual aid agreements. This report presents an opportunity for new awareness of the benefits of mutual aid as an option for resilience of critical information infrastructure. Member States can “shine a spotlight” on good corporate emergency preparedness by applauding examples that should serve as role models. When elevating the level of visibility of mutual agreements, Member States should include options that are both cross-industry and cross-border. Thus, mutual aid agreement discussions should identify areas where the Member States – at the local, national and international levels - need to address and resolve impediments to industry collaboration for the purpose of critical information infrastructure resilience. In addition to removing obstacles to collaboration, Member States can also move to strengthen mutual aid agreement potentials by providing a way to address specific issues such as temporary Recommendation No. 1 waivers of certain rules in a crisis. There are other rules for commerce that need to be identified and Governments should be responsive in addressed so that a rule does not block the rapid creating an environment that supports flow of aid. private sector initiatives that seek to establish Mutual Aid Assistance by reducing Because Member States have unique roles in regulatory obstacles and by raising protecting economic stability, national security awareness about agreements that clearly and public safety, they should be most conscious provide added safety and security to the of the very real possibility of rare but devastating public. events that could impair critical information infrastructure functionality.

text: 3.1.2 Required Commitments

text: Private industry needs to produce an outline of the most effective mutual aid models and then identify Laws and Regulation changes that will be necessary for implementation. Member States at all levels (local, national, and international) need to be responsive to the identified modifications requested and balanced by good governance to avoid abuse, while providing the flexibility needed during times of crisis. Private industry then needs to draft and execute the agreements.

text: 3.1.3 Benefits

text: The ‘levelling of the field’ to reduce hurdles to collaboration for mutual aid will enable many more Mutual Aid Assistance agreements to be established and thus greatly improve resilience. The

text: resolution of regulatory impediments prior to a crisis will allow the mutual aid to flow immediately during a crisis.

text: 3.1.4 Alternatives and their Consequences

text: The sole alternative consists actually in leaving the current situation to continue, and slow down the development of Mutual Aid Assistance in Europe. Consequences of mutual aid can restrict and/or delay the resolve of a crisis because of regulatory barriers.

text: 3.1.5 Next Steps

text: Member States should initiate reviews to determine what, if any, policies or regulations pose impediments to private sector progress in developing mutual aid agreements.

text: 3.1.6 Measures of Success

text: The ultimate goal is for Member States here to make way for the development of more mutual aid agreements. However, specific improvements in the regulatory landscape are tangible, midway, measures of success. Also, having the aid agreements in place and documented before a crisis occurs is another important measure of midway progress. The final measure of success occurs after the agreements are invoked during a crisis.

text: 3.2 A Mutual Aid Agreement Template

text: 3.2.1 Background

text: Fortunately, there are existing models of Mutual Aid Assistance that have proven effective. This recommendation is aimed at capturing a framework for proven elements of Mutual Aid Assistance for critical information infrastructures. The template should be flexible and should include the widest possible set of combinations, e.g., intra-sector and inter-sector, within private sector and with public sector, national and international. Once created, the template should be maintained and should be enhanced with new learning from experiences. The mutual aid agreement will include the terms and conditions that are explicitly spelled out and agreed to before a crisis occurs. This is imperative so that aid not be delayed while seeking internal approvals from someone in the lending entity beyond the initial agreement. Little benefit comes from last minute negotiations or clarifications. The plan must be complete enough to simply be invoked. Thus, the mutual aid template should strive to be as complete as possible to anticipate the parameters and details that will be most effective when the Mutual Aid Assistance that are derived 6 7 from it become operational. This recommendation is about optimum preparation

text: Recommendation No. 2

text: that is still cost effective. This is in stark contrast to The private sector should develop and an ad hoc “best effort” approach to mutual aid, if maintain a standard mutual aid any effort at all, that surprisingly dominates many 8 agreement template for reference that critical information infrastructure cultures. outlines the essential elements of a comprehensive mutual aid agreement.

text: 3.2.2 Required Commitments

text: The private sector, as the owner of most of Europe’s critical information infrastructure, must take the initiative for generating the first mutual aid template, making sure to include all critical template elements. The private sector should work with the various industries to extend the template to be inclusive of cross-industry and cross-border opportunities and must collaborate to develop an acceptable template, i.e. one with broad appeal. The template must be stored and maintained as the process matures.

text: 3.2.3 Benefits

text: Having a reference template will expedite the development of Mutual Aid Assistance between the parties by providing a standardised framework. A readily available template will lower the barrier to entry for organisation seeking to improve their resilience posture.

text: 3.2.4 Alternatives and their Consequences

text: If this recommendation is not implemented, fewer Mutual Aid Assistance agreements will be developed. Those that are developed without such template will take longer to create and will likely be less complete, not having the benefit of a previous editions. Also the agreements will be less uniform, leading to concerns of unfairness and confusion as to the terms when many entities are involved. The end result will be less resilience and delayed restoration of critical functions during a crisis.

text: 3.2.5 Next Steps

text: The next steps begin with the private sector gathering existing templates and then beginning to develop a common template derived from the best elements of those aggregated. This template development exercise is extended to explicitly address intra-industry, inter-industry and crossborder aspects.

text: 3.2.6 Measures of Success

text: The first key measures of success is the development of a mutual aid template with broad appeal. A second key measure of success is a long term sustainable process to manage enhancements. This is best performed by the private sector because of the private sector ownership reality and therefore private sector cultural orientation. The third key measure of success is the realisation of complete Mutual Aid Assistance documented and executed between partners prior to a crisis occurring.

text: 3.3 Critical Information Infrastructure Provider Due-Diligence for Stakeholders

text: 3.3.1 Background

text: The owners and operators of critical functions play a vital role in society, with dependencies on them for national security, economic stability and public safety. As such, there are high expectations on these critical information infrastructure owners and operators to keep critical functions running – especially during times of crises. However, all systems have limitations and the cost for providing functions in crises, when stress is above normal, can often be above the cost of what the market will bear, particularly in a competitive free market environment. Fortunately, MAAs offer a way of providing greatly increased resilience at very little additional cost. In fact, it is rare that such ROIs are possible to achieve. Both direct customers, as well as other stakeholders, will benefit from the added robustness provided from MAAs. In order to achieve its potential for resilience with existing cost structures, the private sector can implement many more Mutual Aid Assistance agreements than has been done in the past. In pursuing this goal, options should not be restricted to those within a given industry, but rather also between industries since much of the equipment is common. MAAs can be created between different industries to take advantage of diversity, that when one industry is Recommendation No. 3 stressed, a dissimilar industry may have The private sector entities with critical less pressure on its resources (e.g., water infrastructure functions should establish formal and power industries have common Mutual Aid Assistance with industry peers, crossresources such as trucks, backhoes fuel, sector entities and governments, as appropriate, in some craft). order to ensure appropriate levels of resilience of their operations. Plans that do not explicitly address all of the potential resources are simply incomplete and may be regretted during a major crisis. This recommendation is about companies that provide critical information infrastructure functions to society taking new steps to ensure their due diligence in planning for worst case (i.e. “rainy day”) scenarios.

text: 3.3.2 Required Commitments

text: Individual private sector companies should implement MAAs with peers, cross sector entities. The role of Member States is to eliminate obstacles to private sector creation of MAAs.

text: 3.3.3 Benefits

text: The implementation of this recommendation will enhance business continuity of the participating organisations, avoid costly alternatives with unattractive ROIs, make unnecessary additional government oversight and regulation and improve the resilience of the organisations, sectors and nation-states.

text: 3.3.4 Alternatives and their Consequences

text: Without formal MAAs, aid can be restricted and or delayed during a crisis by unresolved concerns, jeopardising public safety, economic stability or even national security.

text: 3.3.5 Next Steps

text: Private sector companies should identify potential partners for mutual beneficial arrangements. Like other private sector agreements, these arrangements may be a private matter. Thus it is not necessary for Member States to be aware of them, though critical information infrastructure operators may choose to advise key stakeholders.

text: 3.3.6 Measures of Success

text: The direct measure of success is having an industry with abundant MAAs in place and documented before a crisis occurs.

text: 3.4 Scarce Resource Strategy

text: 3.4.1 Background

text: Some rare crises will place such severe stress on specific resources that competition for them may prevent their utilisation. Resources that are susceptible to this problem include fuel, generators, vehicles and anything else that can be essential for the operation of multiple critical information infrastructures. Thus, in considering possible crisis scenarios, Mutual Aid Assistance agreements need to explicitly address the rare cases where multiple parties are in need of the same scarce resource. Allocation schemes are needed to define frameworks for working through conflicts of interests. The method in which they are invoked is also important. Member States should be involved to ensure that the framework being used will provide the most relief for the affected public. Therefore, there is a need for the identification of both potential critical resources and general policies for handling those scenarios that may be otherwise unanticipated. Both issues need to be communicated with, and agreed with, the appropriate Member States. Because critical information infrastructure operation is typically not the primary function of the government entities being engaged, Member States should not be expected to immediately understand the implications of a scarce resource on critical information infrastructure operations Recommendation No. 4 The private sector, in consultation with Potentially, this will prove to be a difficult government, should develop strategies to recommendation to achieve, but its value can be manage the scarcest resources in order to inestimable during massive crises. Mutual Aid provide opportunities for their use in a Assistance can break down when both parties way that will provide the most relief for have urgent need for the same resources at the the affected public(s). same time, which can be the situation during a large crisis. In a massive crisis at the level where Member States may need to step in and declare Emergency law, having such an agreement may provide for the common good of the citizen without the otherwise interminable delay while Member State officials try to determine resource allocations without the aid of such prior agreements.

text: 3.4.2 Required Commitments

text: The private sector must consider the most severe crises that can occur and be willing to commit their resources for the public good even to the detriment of a particular sector. The role of the Member States will be decisive in prioritising the general public’s interests.

text: 3.4.3 Benefits

text: The benefits from implementing this recommendation are that the MAAs developed will be even more valuable as they will now be prepared for two of the most common obstacles to effective mutual aid: i) limited resources and ii) indecision in the midst of a crisis response that prevents much needed resources from being utilised. This approach allows the industries to use their vast

text: experience to create a mutually beneficial plan for the public good well in advance of the time when decisions are needed.

text: 3.4.4 Alternatives and their Consequences

text: The absence of such a plan may result in the declaration of martial law and attempts to create a plan from scratch by officials lacking the intimate knowledge necessary to properly deploy limited resources.

text: 3.4.5 Next Steps

text: Each industry should identify and then rank the resources that could be under heavy pressure during a crisis. Additional steps include engaging other industries and Member States to agree on both frameworks for decision making and specific policies for specific resources. Each crisis should be a trigger for a revision of the framework’s flexibility and actual usability, and the update may also be planned on a regular basis as a complement.

text: 3.4.6 Measures of Success

text: The key measure of success here is to the most critical resources identified and a framework established and agreed to with key industries and the appropriate Member States.

text: 3.5 Self-Reliance of Local Communities

text: 3.5.1 Background

text: It is important for the general public to be reminded from time to time of their dependence on critical information infrastructure functions and the possibility of their temporary unavailability. Because losing such critical support only occurs rarely, such reminders and self-reliance education are needed from those who understand the real possibility and consequences on public safety. Experience has taught us that the first 72 hours after an event are often the most difficult hours for the public. The types of local communities that can be engaged include schools, shopping malls, business areas, housing complex communities and others. The types of critical services include water, food, medical care, power, police, transportation, and communication. Without communities that are well informed and that can withstand outages for a limited time, restoration resources would be redirected away from fixing the problems and would be too focused on providing temporary help to the public. For example, if the general public is encouraged to have plans that include a 72-hour supply of potable water per household, then resources can be devoted to fixing a pipe break rather than passing out bottled water to the public, and thereby delaying the repair.

text: Recommendation No. 5

text: 3.5.2 Required Commitments

text: The public and private sectors should European institutions, Member States and cooperate with local organisations to Industries are all key in taking the initiative to raise the awareness of the need for identify the important messages to be given to specific plans for the temporary local communities. The identification and unavailability of critical infrastructure engagement of local communities is also a key functions. component of this recommendation. The private sector’s contribution will be to provide professional knowledge and required skills to ensure the plans are comprehensive and viable.

text: 3.5.3 Benefits

text: Having disaster plans in each community will reduce the adverse impacts on the public during a temporary absence of the normal support services. This reduction will facilitate the critical information infrastructure operators to invoke their recovery plans (including the specific recommendations in this report) with a better balance of optimising the permanent restoration of services rather than redirection of limited resources to first provide emergency services to the public at the expense of further delaying normal restoration.

text: 3.5.4 Alternatives and their Consequences

text: Without communities that are well informed and that can withstand outages for a limited time, restoration resources would be redirected away from fixing the most important problems.

text: 3.5.5 Next Steps

text: European institutions, Member States and industries should work together to identify the few key messages to send to local groups. The same would identify potential recipients of such guidance and education. Templates are developed that include flexible components for customisation of communication based on group type or other pertinent factors. Local community groups develop plans sites. The template is stored and maintained by an appropriate entity as the process matures. Select community leaders are encouraged to subscribe to priority communications schemes if available.

text: 3.5.6 Measures of Success

text: The key measure of success is individuals and local community groups that are prepared for short term crises.

text: 4 Conclusion

text: The recognised main issue of Mutual Aid in Europe lays in the fact that working agreements are not well publicised. To date, there has been no platform that has enabled the creation of the necessary bonds between key players of Crisis Management at Pan-European level. An initial attempt to bring this topic to discussion was made in an EP3R (European Public-Private Partnership) Task Force, which has concluded based on the early recommendations of this research. Still, the road ahead for sound European implementation of such mechanism is still to be crossed, and should not be overlooked at the profit of more trendy topics: such a voluntary approach where Member States would be seen as facilitators and coordinators is not an immense obstacle, and yet could allow a much faster recovery of large-scale incidents (cross border or not), and therefore the saving of a significant amount of money.

text: References Related ENISA publications

text: Mutual Aid For Resilient Infrastructure In Europe (MARIE) - Key Observations Report – Available online at: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-andservices/mutual-aid-assistance

text: References Cited

text: Achievements and Next Steps: Towards Global Cyber-Security, European Commission Communication on Critical Information Infrastructure Protection, Brussels, March 2011. Andrianavaly, Valerie, Security & Resilience in Information Society, Proceedings from ARECI Mutual Aid and Emergency Preparedness Workshops, London, December 2007. Fallout Protection: What To Know And Do About Nuclear Attack, United States Department of Defense and The Office of Civil Defense: December 1961. Gomes, Jose Fino, Emergency Preparedness and Network Infrastructures, Proceedings from ARECI Workshop on Resilience of Electronic Communications Infrastructures, Lisbon, Portugal, May 2009. Krock, Richard E., Lack of Emergency Recovery Planning Is a Disaster Waiting to Happen, IEEE Communications Magazine, Volume: 49 Issue: 1, ISSN: 0163-6804, January 2011, pages 48-51. Krock, Richard E., Recent Disasters and Lessons Learned, Proceedings from ARECI Workshop on Resilience of Electronic Communications Infrastructures, Lisbon, Portugal, May 2009. Lindford, Noel, A BCM Network Proposal, Proceedings from ARECI Mutual Aid, Information Sharing, and Emergency Preparedness Workshops, Lisbon, Amsterdam, April 2008. Nillson, Jonny, Preparing for Incidents in Sweden, Proceedings from ARECI Workshop on Resilience of Electronic Communications Infrastructures, Lisbon, Portugal, May 2009. NRSC Pandemic Planning Checklist, Version 1, ATIS, August 2009. Rauscher, Karl F., Availability and Robustness of Electronic Communications Infrastructures (ARECI) Report, European Commission-sponsored Bell Labs Study, March, 2007. ec.europa.eu/information_society/policy/nis/strategy/activities/ciip/areci_study/index_en.htm Rauscher, Karl Frederick, The Reliability of Global Undersea Communications Cable Infrastructure (ROGUCCI), The Report, IEEE: 2010. www.ieee-rogucci.org Rauscher, Karl Frederick and Goldman, Stuart, Priority International Communications (PIC) – Staying Connected in Times of Crisis, EastWest Institute, 2012. www.ewi.info/pic . Verwaayen, Ben, Remarks at the EU Ministerial Conference on Critical Information Infrastructure Protection (via video recording), Tallinn, April, 2009.

text: Annex A: Acronyms

text: 3G Third Generation Wireless 4G Fourth Generation Wireless 8i Eight Ingredient (Framework for ICT Infrastructure) ARECI Availability and Robustness of Electronic Communications Infrastructure (Report) ATM Asynchronous Transfer Mode ASPR Agreements, Standards, Policy and Regulation BWA Broadband Wireless Access C7 Signalling System 7 CDMA Code Division Multiple Access COW Cell on Wheels CIIP Critical Information Infrastructure Protection DOCSIS Data Over Cable Service Interface Specification EC European Commission EIII Electronic Infrastructure Integrity Institute ENISA European Network and Information Security Agency EU European Union GSM Global System for Mobile GUCCI Global Undersea Communications Cable Infrastructure ICT Information and Communications Technology IEEE Institute of Electrical and Electronics Engineers IMS IP Multimedia Subsystem IN Intelligent Network IP Internet Protocol MAA Mutual Aid Agreement MPLS Multiprotocol Label Switching NATO North Atlantic Treaty Organisation NGN Next Generation Networks NRSC Network Reliability Steering Committee

text: PIC Priority International Communications ROI Return on Investment SDH Synchronized Digital Hierarchy SIP Session Initiation Protocol SONET Synchronised Optical Networking SS7 Signalling System 7 TDM Time-Division Multiplexing WIFI Wireless Fidelity IEEE 802.11 WIMAX Worldwide Interoperability for Microwave Access WLAN Wireless Local Area

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu