Prepared for the Joint Meeting of the

1

• Water and Wastewater Sector-
• Specific RAMCAP Guidance

Prepared for the Joint Meeting of the Water
Sector Coordinating Council and the Government
Coordinating Council November 2,
2006 Washington, DC
2
Acknowledgements

• The project well be discussing is supported by
  the Risk Management Division, Infrastructure
  Protection, Preparedness Directorate, U.S.
  Department of Homeland Security
• Contract number is GS 10-F-035R Order number is
  HSHQDC-06-F-00256
• Matt Bettridge is the COTR for DHS
• The U.S. Environmental Protection Administration,
  Office of Water, Office of Water Security in
  its role as Sector Specific Agency is
  collaborating with DHS
• Curt Baranowski is the primary EPA representative

3
Challenges and Concerns

• RAMCAP is duplicative the sector has already
  completed vulnerability assessments.
• There is no inherent value in completing a RAMCAP
  assessment.
• If RAMCAP data are used to obtain grant money,
  small utilities will be left out.
• Employees in the sector are already overburdened
  they cant possibly undertake a new assignment
  or task.
• Terrorism is not high on the list of concerns for
  individual utilities.
• If the program is voluntary, utilities wont
  submit their RAMCAP data.
• This is a DHS program without any benefits to the
  water/wastewater sector.

These will be addressed today or in the course
of the project.
4
Key Questions

• What is RAMCAP?
• Whats this project all about?
• What is its benefit to a water or wastewater
  utility? What incentives are there to using
  RAMCAP?
• What does RAMCAP mean? Will
  existing tools be accepted or amended to be
  RAMCAP
• How are DHS and/or EPA actually going to use the
  RAMCAP data? Who will maintain and safeguard the
  data? How?
• Will DHS or EPA force utilities to use RAMCAP?
• What are the main technical features of RAMCAP?
• Who is ASME Innovative Technologies Institute?

• consistent

compliant
compliant?
consistent?
5
Q1. What Is RAMCAP?
A risk management process that

• Provides a common framework for evaluating
  consequences, vulnerability and risk due to
  terrorism.
• Includes a common terminology, common metrics for
  comparing risks across sectors and a common basis
  for reporting results.
• Incorporates results from prior risk assessment
  methodologies RAMCAP consistent.
• Provides essential information to government
  decision-makers about consequences and
  vulnerabilities in the private sector.
• Provides insights to owners and operators of
  critical assets
• Measures consequences in dollars, fatalities and
  injuries, as well as other concerns (impact on
  symbolic targets, military operability, etc.).

6
Q2. Whats This Project All About?

• Goal
• Produce a technical process to quantify key
  metrics for the Water and Wastewater Sectors,
  comparable to other sectors, to support Federal
  decision-making and to encourage owners and
  operators in the sector to manage their terrorism
  risks.
• Objectives
• Evaluate existing sector-specific methodologies
  for compatibility with RAMCAP and integrate to
  make them RAMCAP consistent or incorporate
  their methods into the RAMCAP process.
• Draft the RAMCAP process and metrics or
  variations on existing tools and pilot test
  them in selected utilities.
• Tailor the process to the specific technologies,
  practices and culture of the respective sectors
  refine through a series of stakeholder reviews,
  seeking consensus.
• Assure explicit alignment and full consistency
  with the RAMCAP Framework and the Screening
  Guide/Sector Specific Guidances for other sectors.

7
Sector-Specific Module Process
DHS, EPA, Government Water Coordinating Council
Subject Matter Experts
Water Sector Coordinating Council Associations
Other Interested Stakeholders
Owner/ Operators for Pilot SVAs

• Consistency
• Consensus
• Robustness
• Public/private cooperation
• Potential standard

8
Water/Wastewater Project Organization
DHS with EPA
ASME-ITI Reese Meisinger, President
Project Admin. Michael Tinkleman
Chief Tech. Off. Bill Jones
Project Management Jerry Brashear Jake Stenzler
Steering Committee DHS, EPA, Jones, Brashear,
Stenzler
Subject Matter Experts Olstein, Baecher, Others
Voluntary Stakeholder Committee EPA, DHS,
Utilities, Associations, Outside Experts, Others
Pilot Test Companies
Suggestions for membership are requested.
9
Roles of Key Organizational Units

• Pilot Test Companies Facilities where the
  developing process and documents can be tested
• Approximately 2 days of on-site visit with
  manager, security officer, engineer, others as
  company determines, plus time to compile needed
  information (prior SVAs, etc.)
• A de-briefing report to the Voluntary
  Stakeholders Committee, oral or written
• Subject Matter Experts Committee Technical
  working core of project, responsible for
  drafting, pilot-testing and refining the
  deliverables
• Independent experts (3 5) in the water
  industry, water security, risk management
• Commitments range from 20 75 time,
  compensated
• Voluntary Stakeholder Committee Industrys
  decision input to the project, responsible for
  reviewing, critiquing, suggesting refinements and
  developing an industry consensus
• Representatives (7 10 each, water wastewater,
  for a total of 15-20) of the industry,
  associations and others with a vital stake in the
  products
• Deeply knowledgeable about water wastewater
  security
• Commitment is for four or five 2-day meetings in
  D.C. (about 2 months apart) and 3-hour conference
  calls (in alternate months), plus time to review
  150 200 page drafts (building on earlier
  drafts, so its not all new material)

10
Scope of Work

• Set-up
• Designate the Subject Matter Expert (SME) Team
• Compare major risk analysis methodologies used in
  the Water Sector, e.g., RAM-W, VSAT and SEMS,
  with RAMCAP Framework and other SSGs.
• Develop a draft roster for the Voluntary
  Stakeholders Committee in consultation with EPA,
  DHS, Water Sector Coordinating Council.
• Convene the Volunteer Stakeholders Committee
  initial briefing and identify additional members.
• Development
• Adapt/draft a preliminary Screening Tool and SSG
  building on earlier tools review with
  Stakeholders Committee.
• Define pilot assessment and identify
  participants.
• Perform pilot assessment review results with
  Stakeholders Committee, DHS and EPA revise as
  needed.
• Alignment consistency with the RAMCAP
  Framework and other SSGs
• Final Products

11
RAMCAP Project Deliverable Schedule
(9/06/07)
12
Q3. What Are the Benefits or Incentives to Use
RAMCAP?

• RAMCAP will take less than two days on-site
  effort by on-site staff, so the cost of
  participation is limited.
• Use of RAMCAP (or a RAMCAP-consistent version of
  an existing tool) will
• Provide insights to utilities owners and
  operators of their vulnerabilities, consequences
  and risks as support for internal decisions.
• Lower risks, increase resilience to attack.
• Improve reliability of service.
• Improve ability to communicate risk.
• Assist in rate and fee setting to pay for
  reliability.
• Possibly reduce insurance costs and/or improve
  credit ratings, etc.

13
Benefits and Incentives (Continued)

• Use of RAMCAP data may be an eligibility
  requirement for future targeted State and
  Federal grants.
• RAMCAP can serve as a consensus-based standard
  for self-regulation.
• If congress forces further regulation, a Water
  Wastewater RAMCAP standard could serve as the
  industrys mechanism for shaping and updating the
  regulation.

14
Q4. What Does RAMCAP Consistent Mean?

• Common terminology on key definitions, e.g.,
  asset, risk, threat, vulnerability, consequences
• Common metrics for recording consequences,
  vulnerabilities, etc.
• Screening process to focus on highest priority
  assets (optional)
• Common threat scenarios as defined by DHS/RMD
• Common assumptions
• Vulnerability evaluation
• Threat (attractiveness) assessment
• Reporting in or translatable to RAMCAP results
  format
• Sector-specific modules

15
Q5. How Are DHS and/or EPA Going to Use the
RAMCAP Data?

• DHS plans to use the data to estimate the levels
  of nationally critical risk borne by the water
  sector compared to other sectors for use in
  program design.
• DHS may use the data to target grant programs to
  the water systems with greatest national
  priority.
• The data will be classified as Protected Critical
  Infrastructure Information (PCII) or other
  classification and reside in the National Asset
  Data Base under a number of safeguards, e.g.,
• No FOIA access
• Not discoverable in civil actions

16
Q6. Will DHS or EPA Force Utilities to Use
RAMCAP?

• Present plans do not include requiring water and
  wastewater utilities to use RAMCAP.
• The NIPP makes use of RAMCAP discretionary to the
  respective sectors.
• The benefits and direct incentives should be
  sufficient to persuade enough of the critical
  water and wastewater systems to participate to
  permit the needed analyses for internal
  decision-making and national analysis.
• No one can predict Congressional mandates or
  regulatory preferences.

17
Q7.What Are the Main Technical Features of
RAMCAP?
18
Risk Definition
Conditional Risk Consequences x Vulnerability,
given attack threat
Benefit Definition

• The reduction in risk due to implementation of
  specific preparedness program, measured in, e.g.,
  
• Fatalities and injuries avoided
• Financial and economic losses avoided
• Other benefits, e.g., national defense
  readiness, public confidence

19
The RAMCAP 7- Step Process
1) Asset Characterization
2) Threat Characterization
3) Consequence Analysis
4) Vulnerability Analysis
5) Threat Assessment
6) Risk Assessment
7) Risk Management
20
RAMCAP Risk Scenarios
DHS/RMD Defined Threat Scenarios

• Others may be added or changed by DHS over time.
• Additional threat scenarios may be used for the
  operators own
• decision-making.

21
RAMCAP Scales

• Categories, or bins, are used to classify
  consequences (economic loss, fatalities,
  injuries) and vulnerability.
• Other consequences are noted qualitatively
  military readiness, government functionality and
  psychological impacts.

22
Completed Ongoing Work

• RAMCAP Framework 2.0 completed will continue to
  evolve
• Sector-Specific Guidance documents completed for
  five sectors/subsectors
• Chemical Manufacturing
• Petroleum Refining
• Liquefied Natural Gas (LNG)
• Nuclear Power
• Nuclear Spent Fuel
• and Transportation
• Sectors now starting
• Dams, Locks and Levees
• Water/Wastewater

23
Q8. Who is ASME Innovative Technologies
Institute?

• From its founding in 1880, ASME (formerly
  American Society of Mechanical Engineers) has
  sought to enhance public safety and contribute
  to the well-being of humankind.
• Now numbering 127,000 professional members, it is
  one of the worlds largest
• Standard Developing Organizations,
• Technical publishing operations,
• Organizer of numerous technical conferences and
  hundreds of professional development courses
  worldwide.
• After 9/11, ASME through its Innovative
  Technologies Institute made a special
  commitment to reducing risks and increasing
  resilience of the Nations infrastructure, e.g.,
• Supporting numerous ASME Fellowships in the White
  House, DHS, Congress
• Sponsoring conferences and workshops, e.g.,
  regional resilience and London Resilience
• Completing the RAMCAP Framework, referenced in
  the National Infrastructure Protection Plan as
  meeting the baseline criteria for risk
  assessments
• Development of concepts for extending RAMCAP to
  other to other challenges to the nations
  homeland security
• Initiating and coordinating a formal voluntary
  consensus standard based on the RAMCAP Framework

24
Consensus RAMCAP Standard

• RAMCAP Standard under development, based on
  RAMCAP Framework
• Process involves diverse stakeholders for open,
  voluntary consensus under ANSI rules, including
• Benefits of a RAMCAP Standard
• Formally defines and communicates the elements of
  RAMCAP, promoting uniform application while
  permitting consistent tailoring for individual
  industries.
• Enables industry self-regulation, accreditation
  and consistent reference for legislation or
  regulation when self-regulation is insufficient.
• Establishes a formal mechanism for revisions
  living documents.
• As SSGs are completed, their working groups at
  their own discretion can become Standards
  Consensus Committees to convert SSGs into
  sector-specific standards

Asset owners Regulatory agencies
Risk Professionals Academia Public
safety Insurance Companies
Utilities Banking and Finance
General Public
25
Jerry Brashear jbrashear_at_asme-iti.org 202.785.7480
(principal office) 301.704.8030
(mobile) 703.262.7978 (alternate office)
Jake Stenzler jstenzler_at_asme-iti.org 202.785.7385
(office) 646.369.4521 (mobile)