OECD Reviews of Risk Management Policies Good Governance for Critical Infrastructure Resilience

Critical infrastructures are the backbone of modern, interconnected economies. The disruption of key systems and essential services - such as telecommunications, energy or water supply, transportation or finance - can cause substantial economic damage. This report looks at how to boost critical infrastructure resilience in a dynamic risk landscape, and discusses policy options and governance models to promote up-front resilience investments. Based on an international survey, the report analyses the progressive shift of critical infrastructure policies from asset protection to system resilience. The findings are reflected in a proposed Policy Toolkit for the Governance of Critical Infrastructure Resilience, which can guide governments in taking a more coherent, preventive approach to protecting and sustaining essential services. Foreword Acknowledgements Executive Summary Key findings Towards a more structured approach: seven steps for critical infrastructure resilience policies 1. Making of critical infrastructure resilience a policy priority Multiple hazards and threats can disrupt critical infrastructure Natural hazards, industrial accidents, and pandemics can cause severe critical infrastructure disruptions These disruptions can lead to significant economic damages and losses Critical infrastructure can be targets for malicious attacks from terrorism to digital security threats Towards an all-hazards and threats approach to critical infrastructure risks A new landscape for investing in critical infrastructure resilience Interconnectedness and interdependencies of infrastructure assets and systems are on the rise Innovation and digitalisation are transforming infrastructure Rising investments in infrastructure provide opportunities for resilience References Annex 1.A. Lessons learned from past critical infrastructure failures Wannacry Ransomware Attack 2017 Tianjin Port Blast, 2015 Hurricane Sandy, United States 2012 The Great East Japanese Earthquake, 2011 Chile Earthquake 2010 Icelandic ash cloud, 2010 Northeast United States and Canadian Power Outage, 2003 2. Governance challenges for critical infrastructure resilience From critical infrastructure protection to resilience Rising uncertainties require more adaptive critical infrastructure policies Defining critical infrastructure resilience International frameworks supporting critical infrastructure resilience Adopting a system’s approach to critical infrastructure resilience Governance challenges for critical infrastructure resilience policies The multiple stakeholders for infrastructure resilience Which role for governments? Partnering for critical infrastructure resilience and related governance challenges References 3. State of play in the governance of critical infrastructure resilience Government critical infrastructure policies in OECD countries Critical infrastructure strategies and programmes Definitions of critical infrastructure vary across countries What are the critical infrastructure sectors? Identifying critical assets and assessing their vulnerabilities Identifying critical assets with criticality assessment Conducting vulnerability analysis to identify weak points Risk assessment as the basis for resilience investments Sharing information on risks and vulnerabilities Most OECD countries have established information-sharing platforms Challenges for effective information-sharing Prioritising resilience measures and policy instruments A large variety of policy tool to foster operators’ resilience investments exists Finding the right combination between mandatory and voluntary frameworks Cost-sharing arrangements for resilient investments References Annex 3.B. Definition of Critical Infrastructure in OECD countries Annex 3.C. List of critical sectors per OECD countries Annex 3.D. List and descriptions of policy tools to strengthen critical infrastructures resilience Annex 3.E. Country practices on critical infrastructure resilience identified in the OECD Toolkit on Risk Governance (TRIG) Trusted Information Sharing Network for Critical Infrastructure in Australia Rationale Objectives Results Lessons Learned Integrated approach for Critical Infrastructure Protection in the Netherlands Rationale Objectives Results Lessons Learned National Strategy for Critical Infrastructure Protection in Germany Rationale Objectives Results Lessons Learned Swiss Basic Strategy for Critical Infrastructure Protection Rationale Objectives Results Lessons Learned Public Private Partnerships for Critical Infrastructures Resilience in Finland Rationale Objectives Results Lessons Learned National Critical Infrastructure Protection Programme in Poland Rationale Objectives Results Lessons Learned Canada’s National Strategy for Critical Infrastructure Rationale Objectives Results Lessons Learned Rationale Objectives Results Lessons Learned UK Centre for the Protection of National Infrastructure (CPNI) Rationale Objectives Results Lessons Learned 4. Critical infrastructure resilience case-study: Electricity transmission and distribution in Finland Introduction Electricity transmission and distribution network as critical infrastructure in Finland Power supply is a priority in Finland Finnish electricity transmission and distribution system Main risks and vulnerabilities of the Finnish electricity transmission and distribution system Governance of electricity transmission and distribution resilience Finland has a well-established critical infrastructure policy Electricity market regulations are also a key tool used in Finland to foster resilience The system of sectoral pools coordinated by NESA was key to fostering trust among electricity stakeholders and build consensus on these resilience objectives Resilience measures and their implementation Risk assessments and information sharing across interdependent critical infrastructure An important investment plan to increase the robustness of the electricity network is underway to comply with the new regulation NESA’s support to business continuity planning and the organisation of joint exercises, trainings and lessons learning is highly valued by electricity operators to strengthen their resilience. Transboundary cooperation with Nordic countries and in Europe constitutes fundamental elements of Finland’s approach to security of supply in the electricity sector. Governance effectiveness for resilience and challenges for the future The revised governance model for power supply resilience in Finland shows great results in its first years of implementation As this approach starts having cost implications for customers, balancing public expectations on resilience versus price increase would require a close monitoring of the cost-effectiveness of resilience investments. Differences between transmission operators’ resources and capacities has implications on the way they implement resilience measures across the country and its overall resilience Future-proofing power supply in Finland would require more joint action with interdependent sectors, as well as to further connect policy agendas on innovation, climate and resilience. References 5. Policy Toolkit on Governance of Critical Infrastructure Resilience Context for the development of the OECD Policy Toolkit Policy challenges for critical infrastructure resilience Objectives of the Policy Toolkit Policy toolkit on governance of critical infrastructure resilience Definitions Seven steps for critical infrastructure resilience policies References