Making the Financial Services Sector Stronger and Safer

1. Financial Services Information Sharing and Analysis CenterFS-ISACNovember 15, 2006William Nelson, Executive DirectorFS-ISAC Making the Financial Services Sector Stronger and Safer Helping to Protect the Critical Infrastructure of the United States

2. Critical Infrastructure Protection Congress DHS Pandemic Planning Tabletop Exercise October 18, 2006

3. Financial Services IT Multi-state Emergency Management and Response Electricity Telecom Public Transit Surface Transportation Supply Chain Water Critical Infrastructure Protection Congress– 10 ISACs Represented

4. Methodology Overview • 4 groups • 2 scenarios • Human-to-human outbreak in Asia • Outbreak occurs in U.S. • Exercise objectives to identify the following: • Potential business impacts • Cross-sector dependencies • Roles of government to assist businesses • Key questions: • What are your concerns? • What actions should your company/sector take? • What actions are needed from government?

5. Key Findings-- Concerns • Scenario 1, outbreak in Asia, there is no 30 day “warning period” due to extensive media coverage. • Compromised supply chain– global and interstate • Cross-sector dependencies– Electricity, Telecom, Food & Agriculture, Water, Energy, Transit • Telecom– the last mile • Some businesses’ lack of planning could negatively impact those who have prepared • Opportunistic fraud or terrorism • Reduced capacity of law enforcement • Attitude of “everyone for themselves” • Run on cash, other types of hoarding

6. Key Findings– Worst Government Actions • Closing borders interrupts supply chain and cross-sector interdependencies • Politicized process-- unilateral actions without input from sectors • Lack of coordination with other levels of government • Poor communication with sectors and public leads to confusion and panic • Unresponsive or slow regulatory relief • Lack of liquidity in the markets • Foreign government reactions– impact on global trade and commerce

7. Key Findings– Industry Actions • Sectors need to have prepared messages in place through SCCs, distributed through ISACs • Distribute DHS, CDC and WHO materials through ISACs • Participate in forums that allow industry to communicate needs to government (e.g., ISACs, SCCs, regional coalitions, trade associations, etc.) • Define inter-dependency needs now and work with other sectors to develop joint/multilateral response plans • Conduct tests of the “last mile” telecom issue • Identify criteria for triggering actions

8. Key Findings– Company Actions • Educate staff of your pandemic plan, guidance on basic hygiene and social distancing prevention steps • Assess how suppliers are prepared for pandemic • Ensure that management understands the priority of pandemic planning • Test telecommuting plan in advance; streamline/reduce security restrictions for access • Implement system to profile and track employees (e.g., sick, exposed, etc.) • Provide incentives, such as bonus pay, to discourage absenteeism • Cross-train employees and shift responsibilities as appropriate

9. Key Findings– Government Actions • Deliver credible and timely information through a consistent and credible source (e.g., instantly recognizable CDC/HHS spokesperson) • Grant immediate regulatory relief (e.g., traders ability to work remotely, suspend HIPAA, regulatory reporting) • Ensure strategy is consistent across states and regions • Launch public awareness campaign of scenarios, planning assumptions, and effective prevention/treatment practices • Provide security and enable personnel credentialing • Ensure continuity of fuel delivery, electricity, telecom, food, water, transit, and financial services • Educate Congress, state and local government– depoliticize the issue