This presentation was made by Charles Baubion, OECD, at the 4th OECD Forum on Governance of Infrastructure, held in Paris on 17 April 2019

1. OECD Policy Toolkit on
Governance of Critical Infrastructure
Resilience
Charles Baubion, OECD High Level Risk Forum
OECD 4th Infrastructure Forum
Paris, 17th April 2019

2. Critical infrastructure: backbone of
the functioning of our societies
85% of OECD countries have a national critical infrastructure strategy
or programme but sectors and definitions differ across countries
Essential for the day-to-day functioning of our societies and economies
Disruptions affect socio-economic well-being, public safety, national security
0 5 10 15 20 25
Space sector
Defence industry
Critical manufacturing
Dams & flood defence
Nuclear
Law enforcement
Public Safety
Chemical industry
Food supply
Government
Finance
Water
Health
Transportation
ICT
Energy
Nb of countries

3. Critical infrastructure policies are
confronted to a dynamic risk landscape
Multiple hazards and threats Interconnectedness and interdependencies
Digitalisation and hyper-connectivity Ageing infrastructure
 Shifting from asset protection to system resilience

4. Building CI resilience in practice
Resilience built on a set of measures combining:
• System robustness, redundancies  design / construction
• Back-up capacities, rapid recovery  operation /maintenance
• Adaptability to changing conditions  retrofit / renewal
 Comprehensive policy across infrastructure life cycle

5. • Mix of public & private responsibilities
• Data & information sharing
• Trust, competition & free-riding
• Prioritising resilience measures
• Who pays for resilience & who benefits ?
• Voluntary vs. regulatory frameworks
• Cross-border cooperation
Governance challenges to enhance
critical infrastructure resilience
 Importance of partnerships between
governments and infrastructure operators

6. Trust &
Information-
sharing
Multi-sector
Governance
Inter-
dependencies
mapping
Transboundary
cooperation
Accountability
& compliance
Policy tools
Vision &
resilience
objectives
OECD Policy Toolkit on Governance of Critical
Infrastructure Resilience

7. Next steps forward
1. OECD Report on Good Governance for Critical
Infrastructure resilience with a stock-taking survey
2. Country case-studies on critical infrastructure resilience
policies
 Pilot case study on Finland electricity T&D
OECDanalysisonthegovernanceofcritical
infrastructureresilience
3. Benchmark indicators on governance of critical
infrastructure resilience
OECD expert workshop in September 2019

8. ANNEXES

9. Assessing criticality, interdependencies and
vulnerabilities for a risk-based approach
1. Mapping interdependencies to
estimate the full impact of service
losses
2. Conducting a criticality assessment
based on impact criteria
3. Resilience analysis and stress tests
to identify weak points
Only 36% of OECD countries conduct interdependency analysis
UK Data and Analytics Facility for National Infrastructure
More work is needed
Respondents express interest in this, but :
• Not equipped with mapping capabilities yet
• Currently working on an interdependencies mapping tool

10. Engaging CI operators in policy design to foster engagement
and build trust
• Sharing information on risks and vulnerabilities
– between government and operators
– between operators
• Building trust
– secured networks and platforms
– joint exercices and emergency plans
 Developing a common vision towards CI resilience with
shared objectives
Creating partnerships and
information-sharing mechanisms
 Australia’s Trusted Information Sharing Network (TISN)
Finland National Emergency Supply Organisation (NESO)
Canada Critical Infrastructure Gateway

11. What policy tools can governments use?
Finding the right combination
To increase efforts in critical infrastructure protection, plans and
investments in resilience, governments can rely upon:
• Voluntary approach
• Regulation
• Incentives
• Public financing
• Peer-pressure
Decision-making criteria:
- Stakeholder’s engagement
- Cost-benefit analysis
- Repercussions on costs of services
- Enforcement / compliance

12. 0 5 10 15 20 25
Mandatory insurance for critical infrastructure
Ranking based on inspection / performance results
Incentive mechanisms for investing in resilience
Peer-reviews, monitoring and evaluation
Other types of penalties for non-compliance
Sectoral mutual aid agreements
Reporting on operators resilience
Public investments in infrastructure resilience
Fines for non-compliance with resilience requirements
Performance-based regulations on business continuity
Incentive mechanism to assess risks and vulnerabilities
Fostering the development/use of professional standards
Mandatory information-sharing mechanisms or platforms
Mandatory business continuity plans
Sectoral prescriptive regulations dedicated to CIP
Guidance for sub-national levels of government
Inspections and performance assessments
Sharing best practices
Awareness raising activities and trainings
Voluntary information-sharing mechanisms or platforms
Provision of hazards and threats information
Resilience guidelines for critical infrastructure operators
Nb of countries
Policy tools and mechanisms for increasing the
resilience of critical infrastructure
22 policy tools and mechanisms : voluntary versus mandatory frameworks
Voluntary mechanisms
Mandatory mechanisms

13. Cross-border and international
cooperation
70% respondents have engaged in cross-border cooperation with
their international counterparts
0 5 10 15
Common criteria for risk assessment
Joint cross-border strategies or plans
Cross-border emergency response plans
Exchange, visits and peer reviews
Information exchange mechanisms and early warnings
Nb of Countries

14. 1. Setting up a multi-sector governance structure for critical
infrastructure resilience
2. Understanding complex interdependencies and vulnerabilities
across infrastructure systems to prioritise resilience efforts
3. Establishing trust between government and operators by securing
risk-related information-sharing
4. Building partnerships to agree on a common vision and achievable
resilience objectives
5. Defining the policy mix to prioritise cost-effective resilience
measures across the life-cycle
6. Ensuring accountability and monitoring implementation of critical
infrastructure resilience policies
7. Addressing the transboundary dimension of infrastructure systems
OECD Policy Toolkit on Critical Infrastructure
Resilience: 7 Governance challenges