ICI-REF (The IMPROVER Criticial I n frastructure R E silience management Framework)

1. ICI-REF (The IMPROVER Criticial Infrastructure REsilience management Framework) LESSON 2

2. Lessonoverview • Background • The ICI-REF • Scaling ICI-REF up to IS-REF • Summary www.improverproject.eu

3. 1.Background The IMPROVER Critical Infrastructure REsilience management Framework www.improverproject.eu

4. Risk assessment Adapted from: Linkov I. et al. Changing the resilience paradigm Nature Climate Change 4, 407–409(2014) Risk is a product of the vulnerability of infrastructure to a threat, and the consequences Risk analysis focusses on the impact of an incident It does not give information about the recovery or adaptability of infrastructure from an interruption www.improverproject.eu

5. From Risk Management to Resilience Management Adapted from: Linkov I. et al. Changing the resilience paradigm Nature Climate Change 4, 407–409(2014) • Resilience focusses on the delivery of services by critical infrastructures • It deals with known and unknown emerging risks • It focusses on the preservation of key societal functions • Resistance • Absorption • Restoration • Adaptation www.improverproject.eu

6. Integration with existing activities “The successful implementation of the concept of resilience to CI … relies on its successful integration in existing security activities; including the risk assessments at a CI operator, a system and a national level.” www.improverproject.eu

7. The national risk assessments All-hazards, multi-risk, systemic approach Focus on major accidents or energy failures Infrastructure failure is often identified as a hazard on its own or as the consequence of other hazards www.improverproject.eu

8. The national risk assessments National risk assessments are usually done by civil protection agencies Infrastructure risk assessments are usually done by operators There is an opportunity to: Enrich NRA’s with additional information from CI operators, and Enrich in turn CI Risk management with information about the resilience of CI www.improverproject.eu

9. 2.ICI-REF The IMPROVER Critical Infrastructure REsilience management Framework www.improverproject.eu

10. The ICI-REF framework • The ICI-REF framework for resilience assessment of CI is compatible with the current guidelines for National Risk Assessments • The framework integrates the paradigm of resilience into the Risk Assessment process according to ISO 31000 • Outputs risk and resilience treatment plans on both an asset and a system level • The framework is based on a formalisation of key definitions associated with resilience management • The framework is flexible – it is not dependent on: • The domain of analysis (organisational , technological , economic or societal) • The methodology chosen for the analysis (it is compatible with any methodology for assessing resilience, or • The sector under study ( it is applicable as a high level framework independent of the sector under study) www.improverproject.eu

11. Resilience analysis • Resilience analysis: Resilience analysis is the process to comprehend and to determine the level of resilience, based on selected resilience indicators www.improverproject.eu

12. Resilience evaluation • Resilience evaluation: Resilience evaluation is the process of comparing the results of resilience analysis with criteria or objectives to determine whether resilience level is acceptable and identify areas for improvement www.improverproject.eu

13. Resilience assessment • Resilience assessment: Resilience assessment is the overall process of resilience analysis and evaluation www.improverproject.eu

14. Resilience treatment • Resilience treatment: the process to modify resilience, focusing on the absorptive, adaptive or restorative capacity www.improverproject.eu

15. Resilience management • Resilience management: Coordinated activities to direct and control an organization with regard to its resilience, including the above processes www.improverproject.eu

16. Resilience management tools ICI-REF is intended for application by a CI operator, or other organisation, to a CI asset or system The use of the ICI-REF requires a number of different tools which fulfil the different parts of the framework These tools have been developed elsewhere in IMPROVER and are the subject of future lessons www.improverproject.eu

17. 3.Scaling it up The IMPROVER Critical Infrastructure REsilience management Framework www.improverproject.eu

18. Compatibility with NRA’s When we introduced the ICI-REF we said that it was compatible with the current guidelines for National Risk Assessments The following slides shows how this compatibility is achieved www.improverproject.eu

19. Societal resilience management Societal resilience treatment National risk treatment Institutional capital Human capital Social capital Societal resilience assessment National risk assessment Economic capital Natural capital Physical capital Sector 2 Sector n Sector 1 CI Resilience management CI Risk management … CI Resilience treatment CI Risk treatment www.improverproject.eu

20. IS-REF • The IMPROVER Societal REsilience management Framework has a similar structure to the ICI-REF www.improverproject.eu

21. 4.Summary The IMPROVER Critical Infrastructure REsilience management Framework www.improverproject.eu

22. Summary Resilience assessment goes beyond risk assessment and focusses on the services provided by infrastructure Incorporating resilience management into the activities of infrastructure operators requires it to account for existing activities The ICI-REF is based on formalised definitions related to resilience and enables the enrichment of risk management activities with resilience management The framework can inform societal risk and resilience assessments www.improverproject.eu

23. Improved risk evaluation and implementation of resilience concepts to critical infrastructure www.improverproject.eu

24. Discussionquestions 2 3 1 • What are the key differences and benefits of moving from risk management to resilience management? • Why is it important to integrate resilience into the existing activities of operators? • How can CI resilience management be used to improve the national risk assessments? www.improverproject.eu