(IT)/Cyber Sector As required by Presidential Policy Directive 21 (PPD-21), the current version of the National Infrastructure Protection Plan (NIPP 2013—also referred to as the National Plan) provides a unifying structure to define a single program for integrating critical infrastructure and key resources (CI/KR) protection. PPD-21 also assigned a federal agency as the lead Sector-Specific Agency (SAA) for each of the 16 critical infrastructures identified in PPD-21. Each SSA is responsible for developing and implementing an updated Sector-Specific Plan (SSP) for its sector. The original SSPs were published in 2010 based on a Letter of Agreement in the 2009 version of the NIPP, but were updated in 2015. The SSPs detail the application of the NIPP concepts to the unique characteristics and conditions of each sector. A growing number of hacking incidents or cyber attacks in recent years has raised concerns about the adequacy of the SSP to address major threats or hazards in our IT sector and cyber space. This includes major hacking into credit card records or other IT/data systems at Lockheed Martin (a major defense contractor), RSA the security division of a major data storage company for financial institutions), SONY, major banking institutions, Target Stores, and the even the U.S. State Department. In fact, in 2010 alone, the U.S. government was subject to over 300,000 cyber attacks on its infrastructure. There were also suspicions that hacking into Google e-mail (gmail) accounts for high-ranking U.S. officials could be traced to China, and the CIA Web site was hacked. Many other incidents have occurred since then. There are also ongoing investigations about Russian hacking into the 2016 Presidential election process. The IT sector is inextricably linked with the Communications sector, and interdependencies exist with all other CI/KR sectors. Technological advances and rapid development or modernization of a wide variety of systems and processes that depend on a secure IT system, including the Internet and the “cloud,” ensure that IT/cyber security will demand increasing attention in the future. Ensuring IT and cybersecurity is incredibly complex and challenging due to technological complexities and our global interconnectedness, which make it very difficult to detect, deter, trace, defend against, prosecute or counter cyber attacks and hacking. You and the members of your team should assume the role of senior government officials representing DHS and other federal agencies and entities with responsibilities for ensuring the security of the U.S. IT sector and cyber space. Threats and hazards in this vital CI/KR sector carry potentially enormous consequences to our national economy, to national security and defense, to privacy, and to confidence in our government. President Trump has asked about the security of our IT sector and cyber space and protection from intentional terrorist or espionage attacks, criminal or malicious hackers ...

1. (IT)/Cyber Sector
As required by Presidential Policy Directive 21 (PPD-21), the
current version of the National Infrastructure Protection Plan
(NIPP 2013—also referred to as the National Plan) provides a
unifying structure to define a single program for integrating
critical infrastructure and key resources (CI/KR) protection.
PPD-21 also assigned a federal agency as the lead Sector-
Specific Agency (SAA) for each of the 16 critical
infrastructures identified in PPD-21. Each SSA is responsible
for developing and implementing an updated Sector-Specific
Plan (SSP) for its sector. The original SSPs were published in
2010 based on a Letter of Agreement in the 2009 version of the
NIPP, but were updated in 2015. The SSPs detail the application
of the NIPP concepts to the unique characteristics and
conditions of each sector.
A growing number of hacking incidents or cyber attacks in
recent years has raised concerns about the adequacy of the SSP
to address major threats or hazards in our IT sector and cyber
space. This includes major hacking into credit card records or
other IT/data systems at Lockheed Martin (a major defense
contractor), RSA the security division of a major data storage
company for financial institutions), SONY, major banking
institutions, Target Stores, and the even the U.S. State
Department. In fact, in 2010 alone, the U.S. government was
subject to over 300,000 cyber attacks on its infrastructure.
There were also suspicions that hacking into Google e-mail
(gmail) accounts for high-ranking U.S. officials could be traced
to China, and the CIA Web site was hacked. Many other
incidents have occurred since then. There are also ongoing
investigations about Russian hacking into the 2016 Presidential
election process.

2. The IT sector is inextricably linked with the Communications
sector, and interdependencies exist with all other CI/KR sectors.
Technological advances and rapid development or
modernization of a wide variety of systems and processes that
depend on a secure IT system, including the Internet and the
“cloud,” ensure that IT/cyber security will demand increasing
attention in the future. Ensuring IT and cybersecurity is
incredibly complex and challenging due to technological
complexities and our global interconnectedness, which make it
very difficult to detect, deter, trace, defend against, prosecute
or counter cyber attacks and hacking.
You and the members of your team should assume the role of
senior government officials representing DHS and other federal
agencies and entities with responsibilities for ensuring the
security of the U.S. IT sector and cyber space. Threats and
hazards in this vital CI/KR sector carry potentially enormous
consequences to our national economy, to national security and
defense, to privacy, and to confidence in our government.
President Trump has asked about the security of our IT sector
and cyber space and protection from intentional terrorist or
espionage attacks, criminal or malicious hackers, or from
disruptions due to technological failures or natural disasters.
Our modern industrial society and economy have become
absolutely dependent information technology, the Internet and
cyber space. It is therefore imperative that our IT sector be
protected.
Could terrorists, foreign governments or criminal hackers
exploit vulnerabilities in our IT system, the Internet or cyber
space to steal vital government or corporate records, sensitive
defense or security information, or other data that could disrupt
our society, economy and national defense? Could they
introduce “worms,” computer viruses or other spyware or
malware that could lead to devastating IT system failures and
compromise national security? Are there effective risk

3. assessment, risk management or mitigation measures that can
reduce the threat or the consequences of hacking and cyber
attacks? This crisis situation illustrates how our critical
infrastructures are interrelated and interdependent.
President Obama issued a Presidential Policy Directive #21 for
Critical Infrastructure Security and Resilience, and an
Executive Order for improving Critical Infrastructure
Cybersecurity in 2013, and President Trump issued an
Executive Order in 2017 on Strengthening the Cybersecurity of
Federal Networks and Critical Infrastructure. However, to
follow up and promote faster progress in this area of concern,
he has requested a study of the Federal government's role to
ensure IT security and cybersecurity. Senior DHS and national
security officials are concerned that terrorists will escalate
efforts to attack us through this sector. Your team has been
invited to participate on the Presidential Action Team, which
has an opportunity to help shape the President's agenda to
further improve the protection of this particular CI/KR sector.
Your presentation should address the roles, responsibilities,
capabilities and challenges or limitations of the Federal
government in ensuring a secure IT system and cyber space. Is
the SSP an adequate guide to prevent future major incidents,
either from natural/accidental causes or from terrorist activity?
Does the SSP need changes to account for lessons learned from
recent hacking or cyber attack incidents? Are linkages needed
between the IT SSP and the others to address the cybersecurity
issue? How does the IT SSP relate to the Executive Orders and
PPD-21? If actions are necessary beyond those in the SSP,
provide specific recommendations with supporting evidence or
logical argument for the President. Is the government organized
effectively to address the threats, risks and vulnerabilities in
this sector?
The actual output of the Project is a PowerPoint presentation for
the President.

4. GUIDELINES
CONTENT
Your presentation might address the following for the U.S.
Information Technology (IT) sector and cyber space:
· What is included in the U.S. IT System?
· Does the SSP limit its actions to specific or narrowly focused
elements or aspects of the IT system, such as the Internet?
· Does the SSP address potential impacts on other critical
infrastructures?
· Analysis of the IT system and cyber space using the SSP
template for protecting the critical infrastructure:
· Define the IT sector and cyber space vulnerabilities.
· Specify protective measures to address these threats.
· Discuss risk management considerations (threats vs.
vulnerabilities).
· Identify dependencies with other agencies, departments, and
other organizations.
· Identify shortfalls in the current system.
· Are there lessons to be learned from any major hacking or
cyber attack incidents that could drive changes to the SSP?
· Does the SSP need better linkages to the other SSPs?

5. · How does the IT SSP relate to President Obama’s Executive
Order and PPD-21 of 2013, or President Trump’s Executive
Order of 2017?
· Provide specific recommendations to the President for actions
to improve the security posture of the U.S. in the context of this
sector.
· Recommend any changes or elements that should be included
in the updated version of the SSP for the IT sector.
Bottom line: This is your opportunity in about 20
slides/viewgraphs to inform the President on how to improve
the security and protection of the U.S. IT sector and cyber
space. The successful project will advise the President on how
to improve the IT/cyber security using the SSP as a framework
for defining the solutions.
FORMAT
Each team will prepare a short PowerPoint (or Prezi or Google
Docs) presentation (approximately 20 slides) along with any
relevant notes – either as notes on the slides or as a separate
Word document.
DELIVERY
Each team should designate a leader/coordinator who will
assume responsibility for posting the presentation. I’ll give
further details as the due date gets closer.
Your completed Group Project is due (posted as an attachment
in the Group Project public discussion forum) March 20, the
beginning of Week 9.
GRADING
Following are the holistic grading rubrics with criteria for each

6. scoring level: Score Rubrics and Ratings 90- 100% Excellent.
Exceeds expectations in terms of quality of analysis and critical
thinking, with conclusions, recommendations or assertions
strongly supported by sound evidence and logical argument.
Succinctly synthesizes and applies key concepts and
demonstrates mastery of the issues from multiple perspectives.
Clearly and comprehensively addresses all the main points and
sub-questions in each overall question. Thoroughly responds to
one question from each module. Demonstrates substantive
research and sound organization of the material. Superbly
written, clear, coherent, and concise, with impeccable grammar,
spelling, punctuation and sentence structure. Response
demonstrates a high proportion of original work with limited
reliance on direct quotes and paraphrasing. All acronyms,
abbreviations or technical terms are clearly defined. Substantive
in terms of length and content. Formatting and style comply
with guidelines and instructions. Source citations consistently
use proper APA style. Submitted early, or by the due date, or by
the date indicated for an approved extension. 80-89% Good.
Generally meets expectations in terms of quality of analysis and
critical thinking, with conclusions, recommendations or
assertions generally supported by evidence and logical
argument. Synthesizes and applies key concepts and
demonstrates grasp of the issues from a balanced perspective.
Addresses most main points and sub-questions in each overall
question. Satisfactorily responds to one question from each
module. Demonstrates competent research and organization of
material. Generally clear, coherent, and concise, with a few
minor errors in grammar, spelling, punctuation or sentence
structure. Response demonstrates a reasonable proportion of
original work with some use of direct quotes or paraphrasing.
Most acronyms, abbreviations or technical terms are defined.
Sufficient in terms of length and substance. Formatting and
style generally follow course guidelines, expectations and
requirements. Source citations generally follow proper APA
style, with few minor technical errors or inconsistencies.

7. Submitted by the due date, or by the date indicated for an
approved extension. 5 70-79% Satisfactory. Meets some, but not
all, expectations in terms of quality of analysis and critical
thinking, with conclusions, recommendations or assertions
sometimes supported by evidence and logical argument.
Generally synthesizes and applies key concepts and
demonstrates some grasp of the issues. Addresses some, but not
all, main points and sub-questions in each overall question.
Responds to one question from each module Demonstrates
satisfactory research and organization of material. Generally
clear, coherent, and concise, but requires further editing to
correct minor errors in grammar, spelling, punctuation or
sentence structure. Response demonstrates some original work,
but with heavy reliance on direct quotes or paraphrasing. Some,
but not all, acronyms, abbreviations or technical terms are
defined. Response meets only minimum expectations in terms of
length and substance. Formatting and style comply with some,
but not all, guidelines or instructions. Source citations do not
consistently follow proper APA style. Responds to the required
number of questions. Submitted by the due date, or by the date
indicated for an approved extension. 60-69% Needs
Improvement. Meets some, but not all, minimum expectations.
Demonstrates limited analysis and critical thinking, but missing
some elements, key points, or supporting evidence. Synthesis
and application of key concepts is weak or inconsistent.
Demonstrates superficial or minimal research, or incoherent
organization of material. Not responsive to the main points and
sub-questions in each overall question. Does not respond to one
question from each module. Requires substantial editing to
correct numerous errors in grammar, word choice, sentence
structure, spelling or punctuation. Response demonstrates
overreliance on direct quotes or paraphrasing in proportion to
original work. Acronyms, abbreviations and technical terms are
misused or not defined. Overly brief or incomplete, and only
meets some of the minimum guidelines, expectations and
instructions in terms of formatting and style. Missing some

8. source citations, or the citations are not consistent with APA
guidelines. Submitted late without an approved extension. 0-
59% Unsatisfactory (Failure). Failed to respond to the question,
or failed to meet expectations at a minimally acceptable level
according to guidelines, instructions and requirements for this
assignment. Excessive reliance on direct quotes or paraphrasing,
with little evidence of original work. Little or no evidence of
analysis, critical thinking, synthesis or grasp of issues. Poor
written communications skills. Failed to follow instructions in
terms of formatting, style, or source attribution. Response is
very brief or demonstrates no evidence of research in
appropriate sources to support assertions and conclusions.
Evidence of plagiarism.
PAGE
2