Banking and Finance Sector-Specific Plan - U.S. Department of ...

4. Prioritize Infrastructure
In the wake of the attacks of September 11, 2001, the Treasury, in conjunction with the members of the FBIIC and the private
sector, undertook a renewed effort to identify and prioritize the key infrastructures. This effort is part of the overall risk assessment
and management process taking place in the public and private sectors on an ongoing basis. The risk assessment methodology
discussed in section 3 is part of the sector’s overall risk management approach, which includes prioritization efforts. The
prioritization within this approach assists the sector in determining the focus for protective programs.
In the private sector, this effort is an internal process to analyze and prioritize the processes and networks that the individual
institutions need to meet their business continuity management and planning efforts.
In the public sector, the Treasury Department, through outreach to the members of the FBIIC, conducts an annual risk assessment
review of the sector. This effort provides a sector-wide prioritization focused on business continuity and resilience for
essential processes in the Banking and Finance Sector. The prioritization is informed by the extensive knowledge of the members
of the FBIIC and, where appropriate, in consultation with certain private sector owners and operators. As the sector is
changing constantly, so, too, are the Treasury and the FBIIC’s processes for identifying and prioritizing the systemically important
assets, processes, and networks. The Treasury Department and the FBIIC continually meet with financial institutions and
regulators to determine any new assets that are critical to the operations of the sector. Results from these consultations are used
to update the annual prioritization where appropriate.
The Treasury Department uses the prioritization to inform sector participants where appropriate and to facilitate discussions,
if necessary, to employ protective measures with the owners and operators. In specific instances, the Treasury Department
reaches out to these members of the sector to encourage participation in business continuity exercises and programs. From a
sector-wide perspective, these prioritization efforts inform the FBIIC’s perspective on overall sector risk and, in turn, influence
the Treasury Department’s ongoing development of new outreach programs.
Furthermore the Treasury Department works with its security partners, including DHS, to collaborate on threat analysis and
information dissemination in accordance with this prioritization in the Banking and Finance Sector. This process enables the
coordination necessary to conform with the NIPP baseline criteria and helps to facilitate DHS’s efforts to assess national comparable
risk.
The basis for prioritization of critical infrastructure within the Banking and Finance Sector stems from the degree of sector
reliance on the identified assets, processes, and networks. Analysis for this prioritization relies upon the potential impact to the
sector’s continued efficient and orderly operation, should the infrastructure experience significant interruption or loss. Essential
to this prioritization process is the importance of these infrastructures and the overall financial services system to maintaining
the public’s confidence in our national economic system and political institutions. The effort uses a variety of factors, including:
Prioritize Infrastructure