Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.) - Phase II: Recommendations Report

Phase II: Recommendations Report

1.0, November 2013

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Authors

The Electronic Infrastructure Integrity Institute (EIII) of Plazion, Inc. has prepared this document for the European Network and Information Security Agency (ENISA). The authors of this document are:  Karl Frederick Rauscher  Stuart Goldman  Lionel Dupré, ENISA.

Contact

For contacting the authors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

Acknowledgements

ENISA thanks the following individuals for their contributions to this Report: - Richard E. Krock (Bell Labs, Alcatel-Lucent). - The organisers, hosts and expert participants of the ARECI Workshops: London (2007), Amsterdam (2008), Lisbon (2009); of note these include:  Valerie Andrianavaly, European Commission (Belgium)  Pedro Manuel de Barros, ANACOM (Portugal)  David Corrie, BT (U.K.)  José Fino Gomes, PT Comunicações (Portugal)  Thomas Kristmar, National IT and Telecom Agency (Denmark)  Pierre-Dominique Lansard, France Telecom (France)  Noel Lindford, BT (U.K.)  Simon van Merkom, Ministrie van Economische Zaken (The Netherlands)  Jonny Nilsson, PTS (Sweden)  Hakon Styri, Post-og teletilsynet (Norway)  John Vanleeuwen KPN (The Netherlands) - The emergency preparedness planners and crisis responders across Europe’s ICT industry. - The European Public-Private Partnership Task Force on Mutual Aid Strategies.

Legal notice

Copyright Notice

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

Executive Summary

The Mutual Aid for Resilient Infrastructure in Europe (MARIE) Issue 1 Report (2011) , which reflects the Phase 1 effort of this initiative, presented twelve Key Observations about Mutual Aid Assistance (MAA) which will be summarised later in this document. The objective of this initiative is to promote the resilience of European ICT infrastructures through the use of MAA strategies. To accomplish this, the value of mutual aid assistance will be described, insights into challenges in implementing MAAs will be captured and guidance will be articulated that will lead to greater utilisation of this advanced emergency preparedness measure. In presenting those Key Observations lays the foundation for actionable recommendations, which are included in this Report, and reflects work done during this initiative. This MARIE Issue 2 Report adds five actionable recommendations;

1. Member States Level the Road

2. A Mutual Aid Agreement Template

3. Critical Information Infrastructure Provider Due Diligence for Stakeholders

4. Scarce Resource Strategy

5. Local Communities Self-Reliance

The approach used by the MARIE Study and Report builds upon existing progress made. It extends this progress by conducting analyses of the current situation that would lend insights into how best to move forward, providing guidance to achieve further MAA deployments and creating an environment in Europe that will continue to sustain long term utilisation of mutual aid strategies that greatly enhance European critical Information infrastructures.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

1 Introduction

One of the most prominent obstacles to further utilisation of Mutual Aid Assistance (MAAs) is that organisations which embrace emergency preparedness responsibilities may not correctly take account of low probability and high impact events. Most of the observations presented here tightly couple with emergency preparedness motivation,with the primary concern leaning towards those types of large-scale incidents.

1.1 Goal

This report presents 5 main recommendations which will –if implemented- improve emergency preparedness for ICT Stakeholders. The results of the preliminary study performed in 2011 showed that the preparedness for Black Swan events (low probability / high impact) cannot be handled in isolation, and that one of the possible responses to this issue could be the use of Mutual Aid Agreements. The recommendations intend to provide a high level coverage to raise awareness and encourage their development.

1.2 Target audience

The 2007 ARECI Report called on the private sector across Europe to take the initiative to establish formal Mutual Aid Assistance in order to enhance existing resilience capabilities. As a result, some notable progress has been made, however there are many more opportunities for Mutual Aid Assistance to be implemented. The European private sector could champion the available opportunities: the difference between getting, and not getting this done, can mean the continued operation, or failure, of critical information infrastructure in the times when it is most needed by society. The first phase of this initiative has presented twelve Key Observations that concisely capture the most important aspects of the current landscape in Europe regarding the state of MAAs. These observations are foundational for these recommendations.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

2 Scope

Mutual Aid Assistance is an arrangement entered into by two or more parties that make provision for lending assistance across normal boundaries during an emergency situation. The types of mutual aid with the scope of this study include:

Sector orientation Formality •ad hoc (informal) Types of assistance Network and Technology Geographical range

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

2.1 Ingredients

Ingredients are usual “components” which space in a contribute to the overall Resilience of a given Environ- strategically ment located data Critical Inforamtion Infrastructure. A set of 2 centre suggested ingredients were initially devised in a Bell-Labs publications for the enhancement of Networks Reliability and Security. diesel generator Power The diagram below shows these 8 ingredients, and provides one example for each.

2.2 Key Observations Hardware

Karl F. Rauscher, Richard E. Krock, and James P. Runyon, 2006, Eight Ingredients of Communications Infrastructure: A Systematic and Comprehensive Framework for Enhancing Network Reliability and Security, Bell Labs Technical Journal, (c) Lucent Technologies Inc.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

Maximum Opportunity for Mutual Aid Assistance Tail Event Syndrome Planning Economic Considerations Best Effort Acceptance Ingredient Transfer Potential Transfer of Responsibility Mutual Aid Is Good Policy Resource Sharing Constraints Unsung Mutual Aid Successes Full Spectrum Emergency Preparedness Smart Planning

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3 Recommendations

This section presents 5 actionable recommendations that, if implemented, will greatly enhance the resilience of European critical information infrastructure in the midst of a crisis. The recommendations are presented to Member States and the Private sector. Each recommendation is presented with supporting material, such as the Key Observations of the previous section, required commitments, benefits of implementation, alternatives and their consequences, next steps and measures of success. With the underpinning of the Key Observations generated from the MARIE Phase I effort, a solid foundation was laid for this Phase 2 work, which focused on developing guidance that can effectively establish a trajectory for on-going, sustained mutual aid agreements.

Recommendation Private Member Sector States

1. Member States Level the Road X

2. A Mutual Aid Agreement Template X 3. Critical information infrastructure Provider Due Diligence for X Stakeholders 4. Scarce Resource Strategy X X

5. Local Communities Self-Reliance X X

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.1 Member States Level the Road

3.1.1 Background

Regulations and Fragmentation may have imposed hurdles along the path to private sector mutual aid agreements. These hurdles may be generic legacy wording that may be silent on emergency situational exemptions. An excess of regulation may discourage companies from pursing mutual aid agreements. This report presents an opportunity for new awareness of the benefits of mutual aid as an option for resilience of critical information infrastructure. Member States can “shine a spotlight” on good corporate emergency preparedness by applauding examples that should serve as role models. When elevating the level of visibility of mutual agreements, Member States should include options that are both cross-industry and cross-border. Thus, mutual aid agreement discussions should identify areas where the Member States – at the local, national and international levels - need to address and resolve impediments to industry collaboration for the purpose of critical information infrastructure resilience. In addition to removing obstacles to collaboration, Member States can also move to strengthen mutual aid agreement potentials by providing a way to address specific issues such as temporary Recommendation No. 1 waivers of certain rules in a crisis. There are other rules for commerce that need to be identified and Governments should be responsive in addressed so that a rule does not block the rapid creating an environment that supports flow of aid. private sector initiatives that seek to establish Mutual Aid Assistance by reducing Because Member States have unique roles in regulatory obstacles and by raising protecting economic stability, national security awareness about agreements that clearly and public safety, they should be most conscious provide added safety and security to the of the very real possibility of rare but devastating public. events that could impair critical information infrastructure functionality.

3.1.2 Required Commitments

Private industry needs to produce an outline of the most effective mutual aid models and then identify Laws and Regulation changes that will be necessary for implementation. Member States at all levels (local, national, and international) need to be responsive to the identified modifications requested and balanced by good governance to avoid abuse, while providing the flexibility needed during times of crisis. Private industry then needs to draft and execute the agreements.

3.1.3 Benefits

The ‘levelling of the field’ to reduce hurdles to collaboration for mutual aid will enable many more Mutual Aid Assistance agreements to be established and thus greatly improve resilience. The

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

resolution of regulatory impediments prior to a crisis will allow the mutual aid to flow immediately during a crisis.

3.1.4 Alternatives and their Consequences

The sole alternative consists actually in leaving the current situation to continue, and slow down the development of Mutual Aid Assistance in Europe. Consequences of mutual aid can restrict and/or delay the resolve of a crisis because of regulatory barriers.

3.1.5 Next Steps

Member States should initiate reviews to determine what, if any, policies or regulations pose impediments to private sector progress in developing mutual aid agreements.

3.1.6 Measures of Success

The ultimate goal is for Member States here to make way for the development of more mutual aid agreements. However, specific improvements in the regulatory landscape are tangible, midway, measures of success. Also, having the aid agreements in place and documented before a crisis occurs is another important measure of midway progress. The final measure of success occurs after the agreements are invoked during a crisis.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.2 A Mutual Aid Agreement Template

3.2.1 Background

Fortunately, there are existing models of Mutual Aid Assistance that have proven effective. This recommendation is aimed at capturing a framework for proven elements of Mutual Aid Assistance for critical information infrastructures. The template should be flexible and should include the widest possible set of combinations, e.g., intra-sector and inter-sector, within private sector and with public sector, national and international. Once created, the template should be maintained and should be enhanced with new learning from experiences. The mutual aid agreement will include the terms and conditions that are explicitly spelled out and agreed to before a crisis occurs. This is imperative so that aid not be delayed while seeking internal approvals from someone in the lending entity beyond the initial agreement. Little benefit comes from last minute negotiations or clarifications. The plan must be complete enough to simply be invoked. Thus, the mutual aid template should strive to be as complete as possible to anticipate the parameters and details that will be most effective when the Mutual Aid Assistance that are derived 6 7 from it become operational. This recommendation is about optimum preparation

Recommendation No. 2

that is still cost effective. This is in stark contrast to The private sector should develop and an ad hoc “best effort” approach to mutual aid, if maintain a standard mutual aid any effort at all, that surprisingly dominates many 8 agreement template for reference that critical information infrastructure cultures. outlines the essential elements of a comprehensive mutual aid agreement.

3.2.2 Required Commitments

The private sector, as the owner of most of Europe’s critical information infrastructure, must take the initiative for generating the first mutual aid template, making sure to include all critical template elements. The private sector should work with the various industries to extend the template to be inclusive of cross-industry and cross-border opportunities and must collaborate to develop an acceptable template, i.e. one with broad appeal. The template must be stored and maintained as the process matures.

3.2.3 Benefits

Having a reference template will expedite the development of Mutual Aid Assistance between the parties by providing a standardised framework. A readily available template will lower the barrier to entry for organisation seeking to improve their resilience posture.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.2.4 Alternatives and their Consequences

If this recommendation is not implemented, fewer Mutual Aid Assistance agreements will be developed. Those that are developed without such template will take longer to create and will likely be less complete, not having the benefit of a previous editions. Also the agreements will be less uniform, leading to concerns of unfairness and confusion as to the terms when many entities are involved. The end result will be less resilience and delayed restoration of critical functions during a crisis.

3.2.5 Next Steps

The next steps begin with the private sector gathering existing templates and then beginning to develop a common template derived from the best elements of those aggregated. This template development exercise is extended to explicitly address intra-industry, inter-industry and crossborder aspects.

3.2.6 Measures of Success

The first key measures of success is the development of a mutual aid template with broad appeal. A second key measure of success is a long term sustainable process to manage enhancements. This is best performed by the private sector because of the private sector ownership reality and therefore private sector cultural orientation. The third key measure of success is the realisation of complete Mutual Aid Assistance documented and executed between partners prior to a crisis occurring.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.3 Critical Information Infrastructure Provider Due-Diligence for Stakeholders

3.3.1 Background

The owners and operators of critical functions play a vital role in society, with dependencies on them for national security, economic stability and public safety. As such, there are high expectations on these critical information infrastructure owners and operators to keep critical functions running – especially during times of crises. However, all systems have limitations and the cost for providing functions in crises, when stress is above normal, can often be above the cost of what the market will bear, particularly in a competitive free market environment. Fortunately, MAAs offer a way of providing greatly increased resilience at very little additional cost. In fact, it is rare that such ROIs are possible to achieve. Both direct customers, as well as other stakeholders, will benefit from the added robustness provided from MAAs. In order to achieve its potential for resilience with existing cost structures, the private sector can implement many more Mutual Aid Assistance agreements than has been done in the past. In pursuing this goal, options should not be restricted to those within a given industry, but rather also between industries since much of the equipment is common. MAAs can be created between different industries to take advantage of diversity, that when one industry is Recommendation No. 3 stressed, a dissimilar industry may have The private sector entities with critical less pressure on its resources (e.g., water infrastructure functions should establish formal and power industries have common Mutual Aid Assistance with industry peers, crossresources such as trucks, backhoes fuel, sector entities and governments, as appropriate, in some craft). order to ensure appropriate levels of resilience of their operations. Plans that do not explicitly address all of the potential resources are simply incomplete and may be regretted during a major crisis. This recommendation is about companies that provide critical information infrastructure functions to society taking new steps to ensure their due diligence in planning for worst case (i.e. “rainy day”) scenarios.

3.3.2 Required Commitments

Individual private sector companies should implement MAAs with peers, cross sector entities. The role of Member States is to eliminate obstacles to private sector creation of MAAs.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.3.3 Benefits

The implementation of this recommendation will enhance business continuity of the participating organisations, avoid costly alternatives with unattractive ROIs, make unnecessary additional government oversight and regulation and improve the resilience of the organisations, sectors and nation-states.

3.3.4 Alternatives and their Consequences

Without formal MAAs, aid can be restricted and or delayed during a crisis by unresolved concerns, jeopardising public safety, economic stability or even national security.

3.3.5 Next Steps

Private sector companies should identify potential partners for mutual beneficial arrangements. Like other private sector agreements, these arrangements may be a private matter. Thus it is not necessary for Member States to be aware of them, though critical information infrastructure operators may choose to advise key stakeholders.

3.3.6 Measures of Success

The direct measure of success is having an industry with abundant MAAs in place and documented before a crisis occurs.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.4 Scarce Resource Strategy

3.4.1 Background

Some rare crises will place such severe stress on specific resources that competition for them may prevent their utilisation. Resources that are susceptible to this problem include fuel, generators, vehicles and anything else that can be essential for the operation of multiple critical information infrastructures. Thus, in considering possible crisis scenarios, Mutual Aid Assistance agreements need to explicitly address the rare cases where multiple parties are in need of the same scarce resource. Allocation schemes are needed to define frameworks for working through conflicts of interests. The method in which they are invoked is also important. Member States should be involved to ensure that the framework being used will provide the most relief for the affected public. Therefore, there is a need for the identification of both potential critical resources and general policies for handling those scenarios that may be otherwise unanticipated. Both issues need to be communicated with, and agreed with, the appropriate Member States. Because critical information infrastructure operation is typically not the primary function of the government entities being engaged, Member States should not be expected to immediately understand the implications of a scarce resource on critical information infrastructure operations Recommendation No. 4 The private sector, in consultation with Potentially, this will prove to be a difficult government, should develop strategies to recommendation to achieve, but its value can be manage the scarcest resources in order to inestimable during massive crises. Mutual Aid provide opportunities for their use in a Assistance can break down when both parties way that will provide the most relief for have urgent need for the same resources at the the affected public(s). same time, which can be the situation during a large crisis. In a massive crisis at the level where Member States may need to step in and declare Emergency law, having such an agreement may provide for the common good of the citizen without the otherwise interminable delay while Member State officials try to determine resource allocations without the aid of such prior agreements.

3.4.2 Required Commitments

The private sector must consider the most severe crises that can occur and be willing to commit their resources for the public good even to the detriment of a particular sector. The role of the Member States will be decisive in prioritising the general public’s interests.

3.4.3 Benefits

The benefits from implementing this recommendation are that the MAAs developed will be even more valuable as they will now be prepared for two of the most common obstacles to effective mutual aid: i) limited resources and ii) indecision in the midst of a crisis response that prevents much needed resources from being utilised. This approach allows the industries to use their vast

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

experience to create a mutually beneficial plan for the public good well in advance of the time when decisions are needed.

3.4.4 Alternatives and their Consequences

The absence of such a plan may result in the declaration of martial law and attempts to create a plan from scratch by officials lacking the intimate knowledge necessary to properly deploy limited resources.

3.4.5 Next Steps

Each industry should identify and then rank the resources that could be under heavy pressure during a crisis. Additional steps include engaging other industries and Member States to agree on both frameworks for decision making and specific policies for specific resources. Each crisis should be a trigger for a revision of the framework’s flexibility and actual usability, and the update may also be planned on a regular basis as a complement.

3.4.6 Measures of Success

The key measure of success here is to the most critical resources identified and a framework established and agreed to with key industries and the appropriate Member States.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.5 Self-Reliance of Local Communities

3.5.1 Background

It is important for the general public to be reminded from time to time of their dependence on critical information infrastructure functions and the possibility of their temporary unavailability. Because losing such critical support only occurs rarely, such reminders and self-reliance education are needed from those who understand the real possibility and consequences on public safety. Experience has taught us that the first 72 hours after an event are often the most difficult hours for the public. The types of local communities that can be engaged include schools, shopping malls, business areas, housing complex communities and others. The types of critical services include water, food, medical care, power, police, transportation, and communication. Without communities that are well informed and that can withstand outages for a limited time, restoration resources would be redirected away from fixing the problems and would be too focused on providing temporary help to the public. For example, if the general public is encouraged to have plans that include a 72-hour supply of potable water per household, then resources can be devoted to fixing a pipe break rather than passing out bottled water to the public, and thereby delaying the repair.

Recommendation No. 5

3.5.2 Required Commitments

The public and private sectors should European institutions, Member States and cooperate with local organisations to Industries are all key in taking the initiative to raise the awareness of the need for identify the important messages to be given to specific plans for the temporary local communities. The identification and unavailability of critical infrastructure engagement of local communities is also a key functions. component of this recommendation. The private sector’s contribution will be to provide professional knowledge and required skills to ensure the plans are comprehensive and viable.

3.5.3 Benefits

Having disaster plans in each community will reduce the adverse impacts on the public during a temporary absence of the normal support services. This reduction will facilitate the critical information infrastructure operators to invoke their recovery plans (including the specific recommendations in this report) with a better balance of optimising the permanent restoration of services rather than redirection of limited resources to first provide emergency services to the public at the expense of further delaying normal restoration.

3.5.4 Alternatives and their Consequences

Without communities that are well informed and that can withstand outages for a limited time, restoration resources would be redirected away from fixing the most important problems.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

3.5.5 Next Steps

European institutions, Member States and industries should work together to identify the few key messages to send to local groups. The same would identify potential recipients of such guidance and education. Templates are developed that include flexible components for customisation of communication based on group type or other pertinent factors. Local community groups develop plans sites. The template is stored and maintained by an appropriate entity as the process matures. Select community leaders are encouraged to subscribe to priority communications schemes if available.

3.5.6 Measures of Success

The key measure of success is individuals and local community groups that are prepared for short term crises.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

4 Conclusion

The recognised main issue of Mutual Aid in Europe lays in the fact that working agreements are not well publicised. To date, there has been no platform that has enabled the creation of the necessary bonds between key players of Crisis Management at Pan-European level. An initial attempt to bring this topic to discussion was made in an EP3R (European Public-Private Partnership) Task Force, which has concluded based on the early recommendations of this research. Still, the road ahead for sound European implementation of such mechanism is still to be crossed, and should not be overlooked at the profit of more trendy topics: such a voluntary approach where Member States would be seen as facilitators and coordinators is not an immense obstacle, and yet could allow a much faster recovery of large-scale incidents (cross border or not), and therefore the saving of a significant amount of money.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

References Related ENISA publications

Mutual Aid For Resilient Infrastructure In Europe (MARIE) - Key Observations Report – Available online at: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-andservices/mutual-aid-assistance

References Cited

Achievements and Next Steps: Towards Global Cyber-Security, European Commission Communication on Critical Information Infrastructure Protection, Brussels, March 2011. Andrianavaly, Valerie, Security & Resilience in Information Society, Proceedings from ARECI Mutual Aid and Emergency Preparedness Workshops, London, December 2007. Fallout Protection: What To Know And Do About Nuclear Attack, United States Department of Defense and The Office of Civil Defense: December 1961. Gomes, Jose Fino, Emergency Preparedness and Network Infrastructures, Proceedings from ARECI Workshop on Resilience of Electronic Communications Infrastructures, Lisbon, Portugal, May 2009. Krock, Richard E., Lack of Emergency Recovery Planning Is a Disaster Waiting to Happen, IEEE Communications Magazine, Volume: 49 Issue: 1, ISSN: 0163-6804, January 2011, pages 48-51. Krock, Richard E., Recent Disasters and Lessons Learned, Proceedings from ARECI Workshop on Resilience of Electronic Communications Infrastructures, Lisbon, Portugal, May 2009. Lindford, Noel, A BCM Network Proposal, Proceedings from ARECI Mutual Aid, Information Sharing, and Emergency Preparedness Workshops, Lisbon, Amsterdam, April 2008. Nillson, Jonny, Preparing for Incidents in Sweden, Proceedings from ARECI Workshop on Resilience of Electronic Communications Infrastructures, Lisbon, Portugal, May 2009. NRSC Pandemic Planning Checklist, Version 1, ATIS, August 2009. Rauscher, Karl F., Availability and Robustness of Electronic Communications Infrastructures (ARECI) Report, European Commission-sponsored Bell Labs Study, March, 2007. ec.europa.eu/information_society/policy/nis/strategy/activities/ciip/areci_study/index_en.htm Rauscher, Karl Frederick, The Reliability of Global Undersea Communications Cable Infrastructure (ROGUCCI), The Report, IEEE: 2010. www.ieee-rogucci.org Rauscher, Karl Frederick and Goldman, Stuart, Priority International Communications (PIC) – Staying Connected in Times of Crisis, EastWest Institute, 2012. www.ewi.info/pic . Verwaayen, Ben, Remarks at the EU Ministerial Conference on Critical Information Infrastructure Protection (via video recording), Tallinn, April, 2009.

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

Annex A: Acronyms

3G Third Generation Wireless 4G Fourth Generation Wireless 8i Eight Ingredient (Framework for ICT Infrastructure) ARECI Availability and Robustness of Electronic Communications Infrastructure (Report) ATM Asynchronous Transfer Mode ASPR Agreements, Standards, Policy and Regulation BWA Broadband Wireless Access C7 Signalling System 7 CDMA Code Division Multiple Access COW Cell on Wheels CIIP Critical Information Infrastructure Protection DOCSIS Data Over Cable Service Interface Specification EC European Commission EIII Electronic Infrastructure Integrity Institute ENISA European Network and Information Security Agency EU European Union GSM Global System for Mobile GUCCI Global Undersea Communications Cable Infrastructure ICT Information and Communications Technology IEEE Institute of Electrical and Electronics Engineers IMS IP Multimedia Subsystem IN Intelligent Network IP Internet Protocol MAA Mutual Aid Agreement MPLS Multiprotocol Label Switching NATO North Atlantic Treaty Organisation NGN Next Generation Networks NRSC Network Reliability Steering Committee

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

PIC Priority International Communications ROI Return on Investment SDH Synchronized Digital Hierarchy SIP Session Initiation Protocol SONET Synchronised Optical Networking SS7 Signalling System 7 TDM Time-Division Multiplexing WIFI Wireless Fidelity IEEE 802.11 WIMAX Worldwide Interoperability for Microwave Access WLAN Wireless Local Area

European Union Agency for Network and Information Security www.enisa.europa.eu

Mutual Aid for Resilient Infrastructure in Europe (M.A.R.I.E.)

ENISA

European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

Athens Office

1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu

European Union Agency for Network and Information Security www.enisa.europa.eu

www.enisa.europa.eu