Banking and Finance Sector-Specific Plan - U.S. Department of ...

• In 2003, BITS and SIA drafted Considerations for the Financial Services Industry: Actions Relevant to the Homeland Security Advisory
System on behalf of the FSSCC;
• In July 2004 when a credible threat was discovered which targeted financial services firms, the Treasury Department and the
sector followed information-sharing and notification protocols. Furthermore, other firms in the vicinity of these targeted
institutions employed internal protocols to increase protective measures in response to the heightened threat level;
• During 2004, the FSSCC produced suggested practices for sector members to use in protective programs, including pandemic
planning;
• In 2004, the FBIIC and the FSSCC conducted its first phase of outreach meetings in 29 cities. At the end of the second phase
in 2007, the outreach meetings will have reached 37 cities;
• In the first quarter of 2005, the Treasury Department, BITS, and ChicagoFIRST published a handbook on how to create
regional organizations similar to ChicagoFIRST;
• In 2005 during Hurricane Katrina, the FS-ISAC provided reporting of the storm’s predicted path well in advance of the hurricane
hitting landfall. These reports included information on the potential impacts to transportation, telecommunications,
water, health care, and financial services closings, as well as assistance strategies;
• In 2006, the FSSCC developed a Disaster Response Protocol for sharing information between the public and private sectors
and rapid dissemination of information between organizations within the financial services sector;
• In 2006, the FS-ISAC developed and implemented threat advisory levels for both physical and cyber attacks to provide sectorspecific
threat warning to member institutions;
• During 2006, the Treasury Department and members of the FBIIC completed an updated vulnerability assessment of the sector;
• In November 2006, the Multi-State ISAC reported evidence of a brute-force cyber attack originating from Chinese IP source
addresses. In response, the FS-ISAC shared member submissions with DHS and other ISACs, providing additional details and
recommendations. As a result, the two IP source addresses were identified quickly and blocked;
• Throughout 2006, the FBIIC and the Treasury Department conducted two separate protective-response planning exercises
with two different systemically critical members of the sector;
• The Treasury Department sponsored and participated in regional preparedness exercises with ChicagoFIRST members and
Federal, State, and local law enforcement and first responders in July 2004, June 2005, and December 2006; and
• The Treasury Department leads quarterly testing of the emergency communications system of the FBIIC.
Develop and Implement Protective Programs