Infrastructure Dependency Template

• Document No.

• Audit Title

• Client / Site

• Conducted on

  Date

• Prepared by

• Asset Personnel

Infrastructure Dependency Sections

• Complete sections indicated as critical to assets core operations in the AMQ. Check all sections that have been completed during the IAV.

• Electric Power Dependency

• Natural Gas Dependency

• Communications Dependency

• Information Technology Dependency

• Water Dependency

Electric Power Dependency

• Asset Name/Critical Node Name

• Is the electric power required for the facility for core operations (produce key services, goods)?

  Yes

  No

  N/A

General Electric Power Detail

• What is the primary use for electric power?

  On-Site Heat / Hot Water

  Core Operations (including lighting, IT, telecom, etc.)

  Security Operations (eg. CCTV, scanners, sensors, etc)

• Describe

• What primary electric power sources apply?

  Internal

  External

Internal Electric Power Sources

• What is the Internal source?

  Power Plant on-site

  Cogeneration Unit on-site

• What type of power cycle is used by the cogeneration unit? <br><br>* Enter only when you select “Cogeneration Unit on –site” for the types of internal electric power sources?

  Yes

  No

  N/A

• Which fuel(s) are used by the Power Plant/Cogeneration Unit?

  Natural

  Petroleum

  Other

• Specify

• Does Power Plant/Cogeneration Unit generate enough electricity to handle full facility load?

  Yes

  No

  N/A

• Percent of Peak Facility Demand generated.

• Does Power Plant/Cogeneration unit provide electricity externally (i.e. the facility has the right to sell energy and capacity to its host utility or the grind)?

  Yes

  No

  N/A

• Electric Power Internal Source Briefing Notes

External Electric Power Sources

• Electric Power Provider/Supplier Name

• Unknown

  Yes

  No

  N/A

• Name or Location

• Describe

• Name or location (2nd substation)

Electric Power Protective Measures

• How many electric service connections are there for the facility?

  One

  More than one

• Can each service connection handle entire facility load?

  Yes

  No

  N/A

• If there are multiple service connections handle entire facility?

  Same Location

  Different Geographic Location

• Describe

• Service connections into the facility are located?

  Aboveground (Power Poles)

  Buried

  Mixed (both aboveground & buried)

• Are there service connections co-located with other utilities (e.g. utility corridors for natural gas, telecommunications, fiber, water, etc?)

  Yes

  No

  N/A

• Describe

• Are there protective measures in place inside the building supporting the electrical system (e.g., locked electrical cabinet or room)?

  Yes

  No

  N/A

• Describe

• Are there protective measures in place outside the building supporting the electrical system (but still within control of facility, e.g., bollards or box around facility-owned transformer)?

  Yes

  No

  N/A

• Describe

• Electric Power Protective Measures Briefing Notes

Electric Power Back-Up Generation

• On-Site Back-Up Generation

  Yes

  No

  N/A

• Backup Generator Exists?

  Yes

  No

  N/A

• Type of backup generator (diesel generator, natural gas, other)?

  Diesel

  Natural Gas (pipeline)

  Propane

  Other

• Specify

• Is refueling necessary?

  Yes

  No

  N/A

• Fuel Supplier Name

• Contracts or procedures are in place for refuel in emergency?

• Duration of backup generation without refueling?

• Refuel Unit

  Hours

  Days

• What is the purpose of backup generation?

  Life Safety

  Graceful Shutdown

  Core Operations

  Entire Facility Load

• Is back up routinely tested under load (e.g., with facility functions being served off of the generator in real-time, not just tested to see if it turns on)?

  Yes

  No

  N/A

• How often?

• Describe

• Uninterrupted Power System (UPS)/Battery back-up exists on site?

  Yes

  No

  N/A

• Duration of UPS/Battery back-up?

• Duration Unit

  Hours

  Days

• What is the purpose of the UPS/Battery back-up?

  Life Safety

  Graceful Shutdown

  Core Operations

  Entire Facility Load

• Back Generation Briefing Notes

Electric Power Loss of Service

• Has the facility experiences electric service outages within the last year?

  Yes

  No

  N/A

• Is there a Contingency/Business Continuity Plan with provider for restoration?

  Yes

  No

  N/A

• Explain

• Does the facility participate in provider priority plan for restoration?

  Yes

  No

  N/A

• Explain

• If all electric service is lost (without considering any back-up or alternative mode), how soon would the facility be severely impacted?

  Less than 15 mins

  15 mins - 4 hrs

  4 - 8 hours

  Greater than 8 hours

• Once electric service is lost (and any back-up or alternative fuel is employed), what percentage of normal business functions are lost or degraded?

  None

  1 - 33%

  34 - 66%

  67 - 100%

• Electric Power Loss Briefing Notes

Overall Electric Power Comments

• Overall Electric Power Comments

Electric Power Commendable

• Electric Power Commendable

• Add an additional Electric Power Commendable record

Electric Power Commendable

• Electric Power Commendable

Natural Gas Dependency

• Asset Name/Critical Node Name

• Is natural gas required for the facility for core operations (produce key services, goods)?

  Yes

  No

  N/A

General Natural Gas Detail

• What is the primary goal for natural gas?

  Select On-site heat/hot water Food Preperation Facility power Steam Generation (cogeneration) Heat/Energy for Core Operations Used as raw material Other

  • On-site heat/hot water
  • Food Preperation
  • Facility power
  • Steam Generation (cogeneration)
  • Heat/Energy for Core Operations
  • Used as raw material
  • Other

• Describe

External Natural Gas Sources

• Natural Gas Supplier

• How many natural gas service connections are there for the facility?

  One

  More than one

• Can each service connection handle entire facility load?

  Yes

  No

  N/A

• If there are multiple service lines, where do the lines enter the facility?

  Same Location

  Different Geographic Location

• Describe

• Are the main service lines collocated with other utilities (e.g. water utility corridors with eclectic, communications, fiber, water, etc.)?

  Yes

  No

  N/A

• Components of the natural gas supply located inside the building (but within control of facility) are protected from vandalism or accidental damage?

  Yes

  No

  N/A

• Components of the natural gas supply located outside of the building (but still within the control of facility) are protected from vandalism or accidental damage?

  Yes

  No

  N/A

• What is the natural gas distribution system?

  Loop

  Radial

  Unknown

• Natural Gas protective Measures Briefing Notes

Natural Gas Back-Up

• Is there backup gas or an alternative fuel source (e.g. propane or electricity)?

  Yes

  No

  N/A

• Describe

Natural Gas Loss of Service

• Has the facility experienced natural gas service outages within the last five years?

  Yes

  No

  N/A

• Is there a Contingency/Business Continuity Plan with provider for restoration?

  Yes

  No

  N/A

• Explain

• Does the facility participate in provider priority plan for restoration?

  Yes

  No

  N/A

• Explain

• If all natural gas service is lost (without considering any back-up or alternative mode), how soon would the facility be severely impacted?

  Less than 1 hr

  1 - 4 hrs

  4 - 8 hrs

  Greater than 8 hours

• Once natural gas service is lost (and any back­ up or alternative fuel is employed), what percentage of normal business functions are lost or degraded?

  None

  1 - 33%

  34 - 66%

  67 - 100%

• Natural Gas Loss Briefing Notes

Overall Natural Gas Comments

• Overall Natural Gas Comments

Natural Gas Commendables

• Natural Gas Commendable

• Add an additional Natural Gas Commendable

Commendable

• Natural Gas Commendable

Communications Dependency

• Asset Name/Critical Node

• Are communications required for the facility for core operations (produce key services, goods)?

  Yes

  No

  N/A

General Communications Detail

• Which of these communication services are critical to facility operations?

  Select Telephone Data (inclu. networking & VOIP) Radio LInk

  • Telephone
  • Data (inclu. networking & VOIP)
  • Radio LInk

• What is the primary critical communications mode (mode the loss of which would result in the most severe impact to facility functions)?

  Telephone

  Data (inclu. networking & VOIP)

  Radio LInk

Telephone Mode

• What is the primary critical telephone usage?

  General Business/Admin/Customer Service

  Command, control, interrogation, monitoring equip & processes

  Dispatch functions

• What is the primary off-premises communications service is utilized?

  Select Company owned & managed fiber loop Company owned & managed direct fiber link Leased public network fiber loop (i.e. AT&T) Leased direct fiber link (i.e. AT&T) General plain old telephone service network (unknown fiber or copper) Wireless

  • Company owned & managed fiber loop
  • Company owned & managed direct fiber link
  • Leased public network fiber loop (i.e. AT&T)
  • Leased direct fiber link (i.e. AT&T)
  • General plain old telephone service network (unknown fiber or copper)
  • Wireless

Data Mode

• What is the primary critical data services usage?

  General Business/Admin/Customer Service

  Command, control, interrogation, monitoring equip & processes

  Dispatch functions

• What is the primary off-premises communications service is utilized?

  Select Company owned & managed fiber loop Company owned & managed direct fiber link Leased public network fiber loop (i.e. AT&T) Leased direct fiber link (i.e. AT&T) General plain old telephone service network (unknown fiber or copper) Wireless

  • Company owned & managed fiber loop
  • Company owned & managed direct fiber link
  • Leased public network fiber loop (i.e. AT&T)
  • Leased direct fiber link (i.e. AT&T)
  • General plain old telephone service network (unknown fiber or copper)
  • Wireless

Radio Mode

• What is the primary critical radio usage?

  General Business/Admin/Customer Service

  Command, control, interrogation, monitoring equip & processes

  Dispatch functions

• What is primary communication service utilized?

  Select Company owned & managed system Leased public network Cell phones with radio line (ie. Nextel) Cell phones without radios Wireless (eg. WiMax) SAT Phones

  • Company owned & managed system
  • Leased public network
  • Cell phones with radio line (ie. Nextel)
  • Cell phones without radios
  • Wireless (eg. WiMax)
  • SAT Phones

Protective Measures for Primary Critical Communications Mode and Service

• What protective measures are employed for the primary telecommunication service?

  Select More than 1 connection (eg. telephone line, data cable or radio tower) at facility If more than 1 connection, they are in different locations More than one inside terminal/Communications room Service connections are located underground Service connections terminate in a protected facility/building Service connections are not located in a joint, co-located utility corridor None

  • More than 1 connection (eg. telephone line, data cable or radio tower) at facility
  • If more than 1 connection, they are in different locations
  • More than one inside terminal/Communications room
  • Service connections are located underground
  • Service connections terminate in a protected facility/building
  • Service connections are not located in a joint, co-located utility corridor
  • None

• Describe

Impact of Loss of Primary Communications Mode & Service

• Has the facility experienced telecommunication service outages within the last year?

  Yes

  No

  N/A

• Is there a Contingency/Business Continuity Plan with provider for restoration?

  Yes

  No

  N/A

• Explain

• Does the facility participate in provider priority plan for restoration?

  Yes

  No

  N/A

• Explain

• If all primary telecommunications service is lost (without considering any back-up or alternative mode), how soon would the facility be severely impacted?

  Less than 1 hr

  1 - 4 hrs

  4 - 8 hrs

  Greater than 8 hours

• If primary mode of telecommunication service is lost, what would you use as back-up?

  Direct transfer to like center (Auto or Manual switch)

  Telephone

  Radio Link

  Data Link

  No backup mode

• Once the facility is on back-up telecommunications service mode, what percentage of normal business functions are lost or degraded?

  None

  1 - 33%

  34 - 66%

  67 - 100%

Communications Briefing Notes

• Communications Briefing Notes

Overall Communications Comments

• Communications Briefing Notes

Communications Commendables

• Communications Commendable

• Add an additional Communication Commendable

Commendable

• Communications Commendable

Information Technology Dependency

• Asset Name/Critical Node Name

• Is Information Technology required for the facility for core operations (produce key services, goods)?

  Yes

  No

  N/A

General Information Technology Detail

• Do you report cyber security events to external parties (e.g., State Computer Security Incident Response Teams, US-CERT, law enforcement, information sharing forums, others)?

  All the time

  Sometimes

  No

• Do you consult external sources of vulnerability information and solutions (e.g., United States Computer Emergency Readiness Team (US-CERT), Computer Emergency Response Team Coordination Center (CERT/CC), SysAdmin, Audit, Network, Security (SANS) Institute, system vendors, etc.)?

  Yes

  No

  N/A

• How often are external sources consulted?

  Regularly

  Occasionally

Internet Services

• Are Internet services required for facility core operations?

  Yes

  No

  N/A

General Internet Services Detail

• What are the critical uses for Internet service?

  Business

  Control

• Business Network Description

• What types of control systems are used?

  Supervisory Control and Data Acquisition

  Process Control Systems

• SCADA Description

• PCS Description

• What is the primary critical Internet mode (mode the loss of which would result in the most severe impact to facility functions)?

  Business

  Control

• From which is acquisition of primary critical Internet access obtained?

  ISP

  Trunk to other organization

• Supplier

• Describe

Internet Services Protective Measures

• Have critical systems and components for providing Internet service been identified?

  Yes

  No

  N/A

• Describe

• Is there more than one service connection (location) at the facility?

  Yes

  No

  N/A

• Are they in different geo-locations?

  Yes

  No

  N/A

• Describe

• Is the internet service connection co-located with server room?

  Yes

  No

  N/A

• Are service connections located underground?

  Yes

  No

  N/A

• Service connection terminate in a protected room/facility/building?

  Yes

  No

  N/A

Internet Loss of Service

• Has the facility experienced Internet service outages within the last 6 months?

  Yes

  No

  N/A

• Is there a Contingency/Business Continuity Plan with provider for restoration?

  Yes

  No

  N/A

• Describe

• If primary mode of Internet access is lost completely (and no back-up is employed), within what time period would the facility be degraded?

  Less than 15 mins

  15 mins - 4 hrs

  4 - 8 hours

  Greater than 8 hours

• If primary Internet mode is lost, what would be used for back-up at this facility?

  Telephone/DSL

  Backup data link (ie. Comcast)

  Radio/Satellite Link (eg. mobile truck)

  Alternate Backup site (ie. relocation)

• Once the facility is on back-up mode, what percentage of normal functions are lost or degraded.

  None

  1 - 33%

  34 - 66%

  67 - 100%

Internet Service Briefing Notes

• Notes

Overall Internet Service Comments

• Comments

Internal IT Systems

• Are internal IT systems required for facility core operations?

  Yes

  No

  N/A

General Internal IT Systems Detail

• What are the critical uses for internal IT systems?

  Business

  Control

• Business Network Description

• What types of control systems are used?

  Supervisory Control and Data Acquisition

  Process Control Systems

• SCADA Systems

• PCS

• What is the primary critical internal IT mode (mode the loss of which would result in the most severe impact to facility functions)?

  Business

  Control

Primary Internal IT Systems protective measures

• Have critical systems and components been identified?

  Yes

  No

  N/A

• Describe

• Are there redundant separated critical servers or network components?

  Yes

  No

  N/A

• Does the facility use Back-up Data Storage?

  Yes

  No

  N/A

• How often are back-ups performed?

  Daily

  Weekly

  Monthly

• Are data restores performed and verified (e.g., back-up data is restored and checked to see if it works)?

  Yes

  No

  N/A

• Is access to control/computer rooms and remote equipment is controlled?

  Yes

  No

  N/A

• Describe

• Is there both a control and business network?

  Yes

  No

  N/A

• Is there network segmentation between control networks and business networks?

  Yes

  No

  N/A

• Describe Segmentation

  VLANs with ACLs (no additional firewall)

  Single firewall seperation

  DMZ with firewalls seperation

  Isolated networks

Remote Access Policy

• What is the remote access policy?

  Is not allowed

  Allowed only when needed, then disabled

  Is allowed at all times

• Are there user controls in place for staff?

  Yes

  No

  N/A

• Describe

• Are there user controls in place for vendors?

  Yes

  No

  N/A

• Describe user controls

• Can employees use remote access to continue operations during circumstances that may preclude access to the facility (e.g., hurricane aftermath or pandemic situations)?

  Yes

  No

  N/A

• Describe

Wireless Access Policy

• What is the remote access policy?

  Wireless not used

  Wireless private network (requires authentification)

  Wireless guest network only

  Wireless used, open to all, with access to company network

Administration Policy

• Has a cyber security assessment conducted? (internal only, external resources)?

  Yes

  No

  N/A

• Who conducted the cyber security assessment

• Describe

• How often?

  6 months

  Annually

  Less frequently than annually

• Is there a cyber security plan?

  Yes

  No

  N/A

• Describe

• Are employees trained on trained on appropriate security practices?

  Yes

  No

  N/A

• How often are Administrators trained on appropriate security practices?

  6 months

  Annually

  Less frequently than annually

  Not trained

• How often are general employees trained on appropriate security practices?

  6 months

  Annually

  Less frequently than annually

  Not trained

• Are security scans performed?

  Yes

  No

  N/A

• How often are security scans performed?

  Yes

  No

  N/A

• Is encryption used to transmit data?

  Yes

  No

  N/A

• Are standard configurations in place to harden Operating Systems?

  Yes

  No

  N/A

• If yes, select all that apply

  Select Disable unneeded services/ports Apply patches Corporate policy to enforce best practices

  • Disable unneeded services/ports
  • Apply patches
  • Corporate policy to enforce best practices

• Are isolated test beds used for configuration changes (e.g., isolated system to test new equipment and software)?

  Yes

  No

  N/A

Impact of Loss of Primary Internal IT System

• If primary mode of primary internal IT system is lost completely (and no back-up is employed), within what time period would the facility be degraded?

  Less than 1 hr

  1 - 4 hrs

  4 - 8 hrs

  Greater than 8 hours

• If IT systems are lost, what would be used for back-up?

  Alternate Back-up Site

  Back-up data storage (eg. would need to be loaded and accessed from another system)

  No Back-up (eg. manual)

• Describe

• Once the facility is on back-up IT mode, what percentage of normal functions are lost or degraded?

  None

  1 - 33%

  34 - 66%

  67 - 100%

Internal IT System Briefing Notes

• Notes

Overall Internal IT Systems Comments

• Comments

Information Technology Commendables

• IT Commendable

• Add an additional IT Commendable

IT Commendable

• IT Commendable

Water Dependency

• Asset Name/Critical Node name

• Is water required for the facility for core operations (produce key services, goods)?

  Yes

  No

  N/A

General Water Detail

• What is the purpose(s) of water usage?

  Domestic (eg. potable)

  Core Operations (eg. rinse waters, process water, fire protection for special areas)

  Cooling (eg. cooling towers, HVAC)

  Other

• Describe why it's critical to facility operations

• What primary water sources apply?

  Internal

  External

Internal Water Sources

• What type of internal water sources apply?

  On-site wells

  Surface water

• Describe

• Do on-site sources produce enough water to handle full facility load?

  Yes

  No

  N/A

• Percent of Demand

External Water Sources

• Water Provider

• How many water service connections are there for the facility?

  One

  More than one

• Can each service connection handle entire facility load?

  Yes

  No

  N/A

• If there are multiple service lines, where do they enter the facility?

  Same Location

  Different Geographic Location

• Describe

• Are the main service lines collocated with other utilities (e.g., utility corridors with electric, Communications, fiber, etc.)?

  Yes

  No

  N/A

• Are components of the water service located inside of the building (but still within control of facility) protected from vandalism or accidental damage?

  Yes

  No

  N/A

• Describe

• Are components of the water supply located outside of the building (but still within control of facility) are protected from vandalism or accidental damage?

  Yes

  No

  N/A

• Describe

Loss of Water Service

• Has the facility experienced water service outages within the last 5 years?

  Yes

  No

  N/A

• Is there a Contingency/Business Continuity Plan with provider for restoration?

  Yes

  No

  N/A

• Explain

• Does the facility participate in provider priority plan for restoration?

  Yes

  No

  N/A

• Explain

• Is there on-site water storage?

  Yes

  No

  N/A

• Quantity

• Quantity type

  Gallons

  Acres-Feet

• Can on-site storage support full core operations?

  Yes

  No

  N/A

• Duration

• Duration Type

  Hours

  Days

• If all water service is lost (without considering any back-up or alternative mode), how soon would the facility be severely impacted?

  Less than 1 hr

  1 - 4 hrs

  4 - 8 hrs

  Greater than 8 hours

• If water service is lost (and any backup is implemented) what percentage of normal business functions are lost or degraded?

  None

  1 - 33%

  34 - 66%

  67 - 100%

Water Briefing Notes

• Notes

Overall Water Comments

• Comments

Water Commendables

• Commendable

• Add an additional Commendable

Commendable

• Commendable