Chemical Sector-Specific Agency Incident Management And .
Chemical Sector-Specific AgencyIncident Management andCoordination PlaybookAUGUST 2019U.S. Department of Homeland SecurityCybersecurity and Infrastructure Security AgencyChemical Sector-Specific Agency Incident Management and Coordination Playbook
Chemical Sector-Specific Agency Incident Management and Coordination Playbooki
Chemical Sector-Specific Agency Incident Management and Coordination Playbookii
Sector-Specific Incident Management Activation,Communication, and EngagementIncident Management Roles The Cybersecurity and Infrastructure Security Agency (CISA) receives information about an actual oremerging incident that could affect one of the critical infrastructure sectors for which CISA serves asthe sector-specific agency (SSA). CISA aggregates incident information and engages with the appropriate sector partners to validatepreliminary assumptions and initial assessments. CISA determines the potential level of impacts based on the Incident Severity Schema for physical andcyber incidents (see below). CISA determines the appropriate sector-related actions and level of effort: Maintain situational awareness and coordinate with sector partners through the establishedcollaboration structures Share information with sector stakeholders according to established protocols andinformation-sharing mechanisms Conduct stakeholder engagements Manage requests for information to and from sector stakeholders Manage requests for assistance from sector stakeholders Support U.S. Department of Homeland Security (DHS) and interagency reporting requirementsIncident Severity SchemaPhysical or Cyber IncidentSeverityIncident Severity Schema DescriptionLevel 5 – Emergency(Black)Poses an imminent threat to the provision of wide-scale critical infrastructureservices, national government stability, or the lives of U.S. personsLevel 4 – Severe(Red)Likely to result in a significant impact to critical infrastructure across multiplesectors/regions for a sustained periodLevel 3 – High(Orange)May have an impact on critical infrastructure function/operability across sectors/regions for a sustained periodLevel 2 – Medium(Yellow)May have an impact on critical infrastructure function/operability across sectors/regions for a sustained periodLevel 2 – Medium(Green)Unlikely to have an impact on critical infrastructure function/operability for asustained periodLevel 0 – Baseline(White)Unsubstantiated or inconsequential event involving infrastructure assetsChemical Sector-Specific Agency Incident Management and Coordination Playbookiii
ContentsIntroduction . 1Incident Management Activation . 5Inform . 5Validate . 5Activate . 6Incident Management and Coordination Practices. 9Preparedness . 9Response . 10Recovery . 14Appendix A. Incident Management Phases and Incident Severity Schema .16Appendix B. SSA Coordination Across CISA Elements. 18Appendix C. Homeland Security Information Network – Critical Infrastructure .21Appendix D. Information Security . 22Appendix E. Chemical Sector Partnership Council Member Organizations.23Appendix F. Incident Teleconferences. 24Appendix G. Requests for Information and Requests for Assistance .26Appendix H. Regulatory Waivers . 27Appendix I. National-Level Reporting . 30Appendix J. Authorities . 32Chemical Sector-Specific Agency Incident Management and Coordination Playbookiv
IntroductionAs the sector-specific agency (SSA) for the Chemical Sector,the Cybersecurity and Infrastructure Security Agency (CISA) isresponsible for coordinating incident notification and sharinginformation among federal departments and agencies; state,local, tribal and territorial (SLTT) entities; and private-sectorpartners. CISA uses established systems and communicationmechanisms to ensure the right information is available todecision-makers at the right time—before, during, and afterincidents affecting the critical infrastructure sectors.This document provides administrativeand operational practices, easy-toaccess tools and resources, and athand references to assist CISA—as theSSA for this critical infrastructuresector—in preparing for, responding to,and recovering from an all-hazardsincident or event affecting the sector.Chemical Sector-specific incident management and coordination activities may involve the directparticipation of multiple elements across CISA, depending on the type of incident, its severity, and theneed for a coordinated federal response. These elements typically include: SSA Leadership: CISA principal with the authority to direct resources in support of the SSAfunction. SSA Management Team: Organizational element within CISA that supports sector-specificstrategic planning and coordination activities, manages national-level sector partnershipstructures and collaboration mechanisms, and provides the staffing function at theheadquarters level in steady state as well as during incidents. Regional Offices: Operational elements of CISA at the regional level that provide targetedprograms and services to owners and operators and coordinate regional information sharing. CISA Integrated Operations Coordination Center (CIOCC): Organization within CISA that servesas the primary information-sharing hub for incidents affecting critical infrastructure. National Risk Management Center (NRMC): Organization within CISA that serves as the lead forplanning, analysis, and collaboration activities related to the most significant risks affectingcritical infrastructure and critical functions.Figure 1 depicts the coordination pathways between these elements. CISA leadership—as part of theSSA leadership role—oversees all incident management activities and may direct execution of sectorspecific incident management and coordination activities by the CIOCC, regional offices, or SSAmanagement team. The CIOCC combines communications, cyber, and physical infrastructure protectionand resilience expertise, synchronized under aCISAsingle operating concept. The CIOCCcoordinates asset response during significantSSAincidents and is the focal point for sharingLeadershipinformation among federal and non-federalentities.NRMCCIOCCThe NRMC identifies the infrastructure in theaffected area that, if disrupted, could lead tonational-level consequences. The NRMC alsoprovides analytic products on direct incidentimpacts and cascading impacts, as well astailored analysis requested by CISA leadershipand other incident responders. For additionalSSAManagementTeamRegionalOfficesFigure 1. Internal Coordination Mechanismsfor Sector-Specific Incident ManagementChemical Sector-Specific Agency Incident Management and Coordination Playbook1
information on determining the need for a coordinated federal response and coordination across CISAelements, see Appendices A and B.For all-hazards incidents, CISA—as the SSA for this critical infrastructure sector—is responsible formaintaining situational awareness, assessing and analyzing critical infrastructure data related to thesector, collaborating and coordinating with sector partners, sharing pertinent information with sectorstakeholders, and responding to requests for information (RFIs) and requests for assistance (RFAs), asappropriate. The SSA roles and responsibilities executed by CISA during an incident (as depicted inFigure 2) include: Information Sharing: Collecting, synthesizing, prioritizing, and disseminating event-relatedinformation at the national, regional, and local levels; facilitating access to federally producedpre- and post-event impact analyses and modeling products; and managing and sharinginformation on the Homeland Security Information Network – Critical Infrastructure (HSIN-CI).For information on HSIN-CI and the use of information designations, see Appendices C and D. Partnership Coordination and Collaboration: Coordinating incident situational awarenessbetween CISA and the organizations that comprise the corresponding partnership councils: theGovernment Coordinating Council (GCC) and Sector Coordinating Council (SCC). For a list ofpartnership council member organizations, see Appendix E. Stakeholder Engagement: Conducting outreach engagements with sector stakeholders at thenational, regional, and local levels to collect or provide incident information and responseoptions for consideration. Outreach engagements may be conducted under a variety of formats,including email, teleconference, video teleconference, or in-person meetings. For additionalinformation on the use of calls and briefings, see Appendix F. Requests for Information/Assistance: Supporting and facilitating the submittal, processing, andtracking of RFIs and RFAs from sector stakeholders (at the national, regional, and local levels) tothe CIOCC. For additional information on processing requests, including those related toregulatory waivers, see Appendices G and H. Internal Reporting and Interagency Coordination: Reporting incident status, criticalinfrastructure impacts, response activities, and federal resource commitments to the DHS, aswell as coordinating with other federal partners as required. For additional information onnational-level reporting, see Appendix tional, Regional,and Local Levels)PartnershipCollaboration &CoordinationInternalReportingDHS Leadership& ComponentsCISAInformation SharingStakeholder EngagementRequests for InformationRequests for nPartnersFigure 2. SSA Roles and Responsibilities for Sector-Specific Incident Management and CoordinationChemical Sector-Specific Agency Incident Management and Coordination Playbook2
About the Incident Management and Coordination PlaybookThe Chemical Sector-Specific Agency Incident Management and Coordination Playbook (playbook)provides administrative and operational practices, easy-to-access tools and resources, and at-handreferences to assist CISA—as the SSA for this critical infrastructure sector—in preparing for, respondingto, and recovering from an all-hazards incident or event affecting the sector. These practices, resources,and references are based on current DHS policy and guidance.The playbook applies to both advance-notice and no-notice physical or cyber events that trigger acoordinated response between the Federal Government and its sector partners. The intended audiencefor the playbook includes those organizations within CISA with roles and responsibilities in support ofthe SSA function. Though these organizations may be assigned other incident response duties as CISAelements, the playbook pertains only to the roles and responsibilities in support of the SSA function.The playbook is organized into five major sections, described below. It may be read in its entirety, orsections of the playbook can be removed for use for a specific incident, relating to the responsibilitiesassigned to specific elements within CISA: Incident Management Activation and Communication: Highlights the major steps of activationfor an incident or event. This section includes established criteria for decision-making aboutresponses to an incident, contact information necessary to support the incident, and a sectorsnapshot. Introduction: Highlights the overarching responsibilities of the SSA for all-hazards incidentmanagement and coordination. Activation: Describes the process by which the SSA activates its incident management andcoordination protocols. Incident Management and Coordination Practices: Lists the administrative and operationalpractices of the SSA to support three stages of incident management: preparedness, response,and recovery. Appendices: Provide readily accessible reference material to carry out incident managementand coordination practices, including incident severity determination, coordination across DHScomponents, incident teleconferences, HSIN-CI, RFIs and RFAs, information security, nationallevel reporting, regulatory relief, and statutory authorities.The practices described in the playbook utilize the unified risk-based approach and partnership modelframework for steady-state protection detailed in the National Infrastructure Protection Plan 2013:Partnering for Critical Infrastructure Security and Resilience (NIPP 2013). The contents of the playbookreflect lessons learned gathered over years of experience with joint exercise activities and real-worldemergencies that required a coordinated public–private sector response. Although it is designed toprovide as much specific guidance as possible, this playbook is also intended to be dynamic, flexible,and tailored in its application to accommodate the unique aspects of an event scenario. The playbook isalso designed to adhere to the unique authorities, capabilities, and decision-making processes of thevarious partner organizations that must work together to effect a well-coordinated response.Terms and DefinitionsFor purposes of the playbook, an incident or event is an occurrence—natural or man-made—that:Chemical Sector-Specific Agency Incident Management and Coordination Playbook3
Represents a significant change from normal, steady-state conditions of a critical infrastructurefacility or system, or May require a response to protect life or property and minimize potential adverseconsequences, or May require protective measures to mitigatevulnerabilities to the critical infrastructurefacility or system that may be threatened bythe incident.All-hazards incidents may be natural or man-made,can be localized or widespread, may affect physical orcyber infrastructure, and have a variety of primary andsecondary consequences. All-hazards incidents can becharacterized as either advance-notice or no-notice. Ano-notice incident occurs unexpectedly or with minimalwarning. Some examples of no-notice incidentsinclude earthquakes, tsunamis, blackouts, andterrorist attacks. It is also possible that incidents withtypically predictable patterns can become no-noticeincidents when their behavior differs from what isexpected. The specific nature of the event willdetermine the appropriate course of action taken byeither the SSA, as outlined in this playbook, or otherresponsible parties. A list of events is included inTable 1.Acknowledgements, Distribution, andMaintenanceTable 1. Sample Event Types andPotential ScenariosSlow-Onset Events Climatological Events (extreme temperatures,drought, wildfires) Hydrological Events (floods) Meteorological Events (tropical cyclones,severe winter storms) Pandemics (global disease outbreaks) Space Weather Events (geomagnetic storms) Scheduled Disruptions (shutdowns formaintenance, upgrade, or rehabilitation)No-Notice Events Criminal Incidents and Terrorist Attacks(vandalism, theft, property damage, activeshooter incidents, kinetic attacks) Cyber Incidents (denial-of-service attacks, zeroday exploits, malware, phishing) Geophysical Events (earthquakes, tsunamis,volcanic eruptions) Hydrological Events (flash floods)The development of the Chemical Sector-Specific Technological and Industrial AccidentsAgency Incident Management and Coordination(structural failures, industrial fires, hazardousPlaybook was led by the SSA management team, insubstance releases, chemical spills)consultation with the GCC and SCC. The playbook was Meteorological Events (severe convectivedeveloped pursuant to the sector partnershipstorms)framework described in the NIPP 2013 and is Unscheduled Disruptions (equipmentdesigned to implement the concept of operationsmalfunction, long-term power outages)described in the Critical Infrastructure and KeyResources Support Annex to the National Response Framework (NRF) and the National Cyber IncidentResponse Plan (NCIRP).Sector partners and related personnel should use appropriate measures to ensure the proper use andmaintenance of this information. The playbook will be reviewed at least every other year and tested asappropriate (e.g., at a national-level exercise or other large-scale exercise) to remain current andcompliant with policy and general practice changes. The SSA management team will review anyproposed changes or revisions to the playbook and approve or reject them. Extensive revisions to theNational Planning Frameworks, the NIPP 2013, the NCIRP, the National Incident Management System(NIMS), Federal Interagency Operational Plans, or other national-level guidance on cyber and physicalincident management—as well as significant revisions to CISA’s organizational or operational structure—may require changes to key elements of the playbook.Chemical Sector-Specific Agency Incident Management and Coordination Playbook4
Incident Management ActivationBefore, during, and after an incident, the need for assistance or information can originate from manydifferent entities from the local level to the federal level. The incident information may follow a numberof paths through the distributed network of stakeholders and interagency partners before reachingCISA. CISA must then validate that information, potentially combining it with other sources for furtheranalysis. The origin and the evaluation of incident information may differ slightly for physical versuscyber incidents. For either type of incident, CISA leadership will direct the appropriate level of effort tosupport the sector directly or through the coordinated federal response. Figure 3 below summarizesthese steps, from discovering a threat or incident to activating a sector-specific response.InformReceive informationabout an actual orpotential incidentValidateIntegrate andvalidate incidentinformation fromvarious sourcesActivateDetermine incidentphase and activateSSA protocolsFigure 3. Process of activation in all-hazards responseInformCritical infrastructure sectors generally comprise a broad range of entities that take advantage ofmultiple communication channels that facilitate information sharing when an actual
Chemical Sector-specific incident management and coordination activities may involve the direct participation of multiple elements across CISA, depending on the type of incident, its severity, and the need for a coordinated federal response. These elements typically include:
Incident Management Process Map 1. Incident Management Process Map 1. Incident Management Description and Goals 9. Incident Management Description and Goals 9. Description 9. Description 9. Goals 9. Goals 9. Incident Management RACI Information 10. Incident Management RACI Information 10. Incident Management Associated Artifacts Information 24
Chemical Formulas and Equations continued How Are Chemical Formulas Used to Write Chemical Equations? Scientists use chemical equations to describe reac-tions. A chemical equation uses chemical symbols and formulas as a short way to show what happens in a chemical reaction. A chemical equation shows that atoms are only rearranged in a chemical .
Levenspiel (2004, p. iii) has given a concise and apt description of chemical reaction engineering (CRE): Chemical reaction engineering is that engineering activity concerned with the ex-ploitation of chemical reactions on a commercial scale. Its goal is the successful design and operation of chemical reactors, and probably more than any other ac-File Size: 344KBPage Count: 56Explore further(PDF) Chemical Reaction Engineering, 3rd Edition by Octave .www.academia.edu(PDF) Elements of Chemical Reaction Engineering Fifth .www.academia.eduIntroduction to Chemical Engineering: Chemical Reaction .ethz.chFundamentals of Chemical Reactor Theory1www.seas.ucla.eduRecommended to you b
TIBRS Incident Report ORI # Incident # CAD # Incident Date Incident Time Incident Date is: Address # Street Name Apt./Suite # City State Zip Code Zone Latitude Longitude Arrival Date Arrival Time Officer Cleared by: Exceptional Clearance Ex. Clearance Date Offense # 1 T.C.A. Offense TIBRS Offens
Key terms in incident reporting in NHSN Required Incidents reporting . Coming Up Next Optional Incident reporting Incident case studies . 20 . So far, the key terms in incident reporting and required Incidents reporting have been covered. Next, optional Incidents repor\൴ing as well as incident case studies will be discussed.
Incident Commander (IC), Incident Commander in Unified Command (UC) or Deputy Incident Commander (DIC) within the National Incident Management System (NIMS) Incident Command System (ICS). Personnel assigned to this position should be qualified as an IC. Throughout the rest of this Job Aid, the generic term "Command" may
in a critical incident. Some of these are presented in Critical and Traumatic Incident. (2) There are various possible responses to a critical incident. These are presented in Critical Incident Information. (3) There are many things that police agencies can do to minimize the possible undesirable effects of a critical incident.
Animal Food Nutrition Science Public Health Sports & Exercise Healthcare Medical 2.3 Separate, speciality specific listings providing examples of the detailed areas of knowledge and application for each of the five new core competencies required by Registered Nutritionist within these specialist areas have been created and are listed later in this document under the relevant headings. 2.4 All .
