February 14, 2013, 12:40 PM — President Barack Obama's cybersecurity executive order, signed on Tuesday, could significantly expand the list of companies categorized as part of U.S. critical infrastructure sector, security experts said Wednesday.
The executive order requires federal agencies and critical infrastructure owners and operators to work cooperatively to minimize cyber risks and strengthen resilience to attacks. It also calls for the creation of new consensus security standards and best practices that critical infrastructure companies will be urged, but not mandated, to follow.
The order stems from what the White House has long said is the need for immediate action to protect critical assets against cyber threats.
Administration officials contended that the order was necessary because Congress has so far failed to adequately update cybersecurity legislation.
A key piece of the executive order is requires federal agencies overseeing critical infrastructure areas to identify organizations "where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security."
Such entities will then be designated as part of the U.S. critical infrastructure.
The order gives the Department of Homeland Security (DHS) and sector-specific federal agencies 150 days to use a risk-based assessment approach to identify such organizations. Owners and operators of those businesses will then be notified by the DHS.
The order allows businesses to challenge a classification and ask to for reconsideration.
A separate Presidential Policy Directive (PPD-21) released on Tuesday scraps the previous national policy for federal agencies and departments to identify and prioritize critical infrastructure. That policy had been established under Homeland Security Presidential Directive-7 (HSPD-7) of 2003.
"This PPD updates our policy from a primary focus on protecting critical infrastructure against terrorism to protecting, securing, and making the nation's critical infrastructure more resilient to all hazards - including natural disasters, manmade threats, pandemics, and cyber attacks," a spokeswoman from the White House's National Security Council told Computerworld via email Wednesday.