Use of Enterprise Architecture in the Critical National Infrastructure (CNI)

1. Use of Enterprise Architecture in the Critical National Infrastructure (CNI) Footer Area

2. What is the CNI?Individual asset to International ‘System of Systems’ International CNI ‘System of Systems’ National CNI ‘System of Systems’ Regional CNI ‘System of Systems’ Local CNI System Individual CNI Asset HMG & Public Services Emergency Services Energy Food Water Transport Telecoms Health Finance

3. What is the CNI?A Shared and Complex System of Systems The national infrastructure is the underlying framework of facilities, systems, sites and networks necessary for the functioning of the country and the delivery of the essential services which we rely on in every aspect of our daily life. Source: Centre for the Protection of National Infrastructure.

4. What is the CNI?80% + of the CNI is in the Private Sector! System of systems problems are a collection of trans-domain networks of heterogeneous systems that are likely to exhibit operational and managerial independence, geographical distribution, and emergent and evolutionary behaviours that would not be apparent if the systems and their interactions are modelled separately Source: Description in the field of National Transportation System, Integrated Military and Space Exploration.

5. Why is the CNI important ? Baroness Scotland to Parliament - 2004 “those assets, services or systems that support the economic, political and social life of the United Kingdom whose importance is such that any loss or compromise would have life-threatening, serious economic, or other grave social consequences for the community, or would otherwise be of immediate concern to the Government”.

6. Why is the CNI important ? Terrorism “Any purposeful terrorist attack will always happen to something, somewhere that constitutes part of the Critical National Infrastructure”. Fraser Sampson, CEO W. Yorkshire Police Authority / Former Executive Director Civil Nuclear Police Authority - Police Review July ’08.

7. Why is the CNI important ?Natural Hazards • “The National Security Strategy takes a holistic • approach, covering crime, pandemics and natural • hazards, such as flooding, in addition to traditional • security threats”; • “Natural hazards are a security issue on the basis • that they can affect large numbers of UK citizens and • demand some of the same responses as more • traditional security threats, including terrorism”. • Pitt Section 5, 14.22

8. Why is the CNI important ? Floods, Flu, Fire, Fuel, Finance………

9. Pitt ReportSystem approach to building resilience in the CNI • Pitt includes strong support for a systemic programme to reduce the disruption caused • by natural hazards to critical infrastructure • and essential services. • Pitt Section 5, 14.15

10. Pitt ReportSystem approach to building resilience in the CNI • Pitt includes strong support for a systemic programme to reduce the disruption caused • by natural hazards to critical infrastructure • and essential services. • Pitt Section 5, 14.15 • The adoption of a systemic approach needs • the adoption of an Enterprise approach!

11. Definition of Enterprise Source: Col. Luigi Gregori, DG Info MoD • An "enterprise" is any organisation or collection of organisations, that have a common set of business goals and / or a single bottom line; • Lack of an “Enterprise Vision” can result in: • Reduced Efficiency • Poor Investment Decisions • Duplication of Effort • Loss of agility • Increased risks, reduced resilience & slow recovery in a CNI System(s)

12. Common Operating Pictures (COP) Common Operating Plan Code of Practice Reducing Vulnerability – Increasing Resilience A ‘Joined-up, All Hazards Enterprise-Wide Approach MissionPlanning / Rehearsal Governance Workload Decision Quality Training Shared Situational Awareness IA / IM / IX Command & Control HMG & Public Services Emergency Services Energy Food Water Transport Telecoms Health Finance

13. Working across ‘stovepipes’ in complex, disparate and challenging environments Managing time sensitive information and time and safety critical decisions Similar operational issues: Information Management (IM) Information Exploitation (IX) Information Assurance (IA) Shared Situational Awareness (SSA) Common Operating Pictures (COP) Workload / Decision Quality Mission Planning/Mission Rehearsal (MP/MR) Training Difficult to identify, capture and share best practice ….there are Parallels with the Military

14. …including the benefits of adopting MODAF Liaising with DG Info There are already some positive industry led cross- sector coordination activities, such as the CNI Shared Capability Advisory Network (CNI Scan) Pitt Review, Cabinet Office ‘08

15. Our System Level Approach… ‘capturing interdependencies’ across the Enterprise-wide supply chain

16. Human Factors Visualisation & Experimentation Systems Engineering Processes Using an Interoperable Toolkit…. Best Practice, Benchmarks, Standards Best Practice, Benchmarks, Standards Training & Exercises Training & Exercises Risk & Resilience Methodology Risk & Resilience Methodology Human Factors Human Factors Visualisation & Experimentation Systems Engineering System Dynamics Processes Architecture Framework (MODAF) Civilianised MODAF

17. Human Factors Visualisation & Experimentation Systems Engineering Processes Using an Interoperable Toolkit….To capture, identify, visualise and support Best Practice Best Practice, Benchmarks, Standards Best Practice, Benchmarks, Standards Individual organisation Good Practice Training & Exercises Training & Exercises Risk & Resilience Methodology Risk & Resilience Methodology Individual organisation Good Practice Whole System Best Practice Approach Human Factors Human Factors Individual organisation Good Practice Organisational Differences Visualisation & Experimentation Individual organisation Good Practice Systems Engineering System Dynamics Processes Individual organisation Good Practice Architecture Framework (MODAF) Civilianised MODAF

18. Social & Physical Networks Lines of Development To simplify & visualise the complexity of the SystemComponent Parts – Functional Areas Social & Physical Networks Lines of Development Organisational & Resilience Boundaries System Functional Areas eg: Tourism, Refining, Major Events etc Local Resilience Forum Components Parts e.g: Police, EA, MCA, FRS, Utilities, Transport etc

19. Social & Physical Networks Lines of Development To simplify & visualise the complexity of the SystemComponent Parts – Functional Areas - Effect EFFECT Social & Physical Networks Lines of Development Organisational & Resilience Boundaries System Functional Areas eg: Tourism, Refining, Major Events etc Local Resilience Forum Components Parts e.g: Police, EA, MCA, FRS, Utilities, Transport etc

20. Effect & Validation by Gold StandardWorking with the Civil Contingencies Secretariat Project Gold Standard, part of the Cabinet Office programme that strategically supports UK national security and resilience, is exploring how the work of CNI Scan might assist the Scenarios and exercises Gold Standard generates. RUSI Monitor, Protect & Prepare Sept ‘08

21. Effect & Validation by Gold StandardWorking with the Civil Contingencies Secretariat ‘To enhance UK resilience by providing the multi-agency civil command team training necessary for the effective management of the consequences of major emergencies and disasters’.

22. Working at the Local Resilience Forum ‘System’ LevelMilford Haven Feasibility Study, Exercise and Full Study In taking forward the Protect and Prepare strands there are some impressive examples of what can be achieved when all relevant partners join forces. One example is the work being done by the CNI SCAN Programme. In collaboration with Local Resilience Forums, the programme sets out to capture, understand and visualise the complex and often lengthy network of systems, supply chains and interdependencies that support critical infrastructure at a local level. RUSI Monitor Protect & Prepare Sept ‘08

23. Using MODAF – Milford Haven Feasibility StudyOV-02 Context Diagram <<Back

24. Using MODAFOV-02 Fuel Distribution Operational Node Connectivity Information Exchanges Operational Nodes

25. Lessons identified Lessons Learnt A Framework for Continuous Improvement Knowledge Transfer Users Improvement (Metric) Lessons Learned Lines Of Development (LoD) Resilience Model Effect Industry in LoD Framework CNI SCAN Gold Standard ITN/ RFQ Silver/Bronze Gold Change Management Plan Lessons Identified Funding Stream

26. Reducing Vulnerability – Increasing ResilienceAcross the System Lines of Development Training Logistics Equipment Infrastructure Personnel Concepts & Doctrine Organisation Information I N T E R O P E R A B I L I T Y HMG & Public Services Emergency Services Energy Food Water Transport Telecoms Health Finance

27. Use of Enterprise Architecture in the Critical National Infrastructure (CNI) Charles Le Gallais CBE Gold Standard, Cabinet office Charles.legallais@selex-si-uk.com +44 (0) 7825 500896 Laurence Marzell CNI Scan Programme Lead, Serco laurence.marzell@serco.com ##44 (0)7718 195339 Footer Area