chapter 4: critical infrastructure resiliency oag critical... · and trucking, farms, food...

55

What we found in our audit:

GAO

• EmergencyManagementOffice’slistofcriticalinfrastructurepartnersisincomplete

• TheProvincehasnotidentifieditscriticalinfrastructureandrelianceonothercriticalinfrastructureisnotknown

•ManydepartmentswerenotawareoftheNationalStrategyforCriticalInfrastructure

•DepartmentofHealth&Wellnesshasariskmanagementprocessforcriticalinfrastructureinthehealthsector

• TransportationsectorhasnotdoneriskassessmentsfortheCansoCausewayorsectionofhighwaynearAmherst

• Nodepartmentgivenresponsibilityforacriticalinfrastructureprogram.However,theEmergencyManagementOffice:• hadseniormanagementdirectiontoact,butnotgivenmandate

• agreedtotheNationalStrategyforCriticalInfrastructurein2009

• hassomecriticalinfrastructureresponsibilities

• Therehavebeencommunicationweaknesseswithgovernmentresponsestoevents:• 2015fueldisruption• 2014post-tropicalStormArthur

Overall conclusions:

• ExecutiveCouncilhasnotassignedresponsibilityforthecriticalinfrastructureprogram

• ProvincehasnotidentifiedalloperatorsofcriticalinfrastructurethatcouldimpacttheProvince

• Provincehasnotidentifiedcriticalinfrastructureitowns,exceptforthehealthsector

• ProvincehasnotdonewhatitsignedontodoundertheNationalStrategy

Why we did this audit:

• CriticalinfrastructureisrequiredforthehealthandsecurityofNovaScotians,includingtheeconomy

• Impactsoneverydaylife–drinkingwater,transportation,food,power,communications,andhealthcare

• Rateandseverityofnaturaldisastersisincreasing;asareintentionalthreats

• Provincemustensurecriticalinfrastructureisavailablewhenneededorthatoptionsarepresented

Chapter 4: Critical Infrastructure Resiliency

Report of the Auditor General • Municipal Affairs • November 2016

GAO

56

Critical Infrastructure Resiliency


Recommendations at a Glance Auditee Agreement and Page Reference

Recommendation 4.1Executive Council should clearly define if the Emergency Management Office is responsible for establishing a critical infrastructure program, and if not, assign responsibility to another department.

Agree

62

Recommendation 4.2The Emergency Management Office should develop and execute a strategy for implementing the National Strategy and Action Plan for Critical Infrastructure in the province.

Agree

63

Recommendation 4.3The Emergency Management Office should identify critical infrastructure owners and operators having an impact on the Province, ensuring all ten sectors are addressed.

Agree

66

Recommendation 4.4The Emergency Management Office should ensure all critical infrastructure owned by the Province is identified and have documented all-hazards risk assessments which consider interdependencies on other critical infrastructure and mitigation strategies.

Agree

69

Note: Recommendations 2 to 4 have been assigned to the Emergency Management Office because it took responsibility for the National Strategy for Critical Infrastructure when it was first released. If Executive Council assigns responsibility to another entity, these recommendations will need to transfer to that entity.

57

GAOBackground

4.1 PublicSafetyCanadanotes:

“critical infrastructure refers to processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government. Critical infrastructure can be stand-alone or interconnected and interdependent within and across provinces, territories and national borders. Disruptions of critical infrastructure could result in catastrophic loss of life, adverse economic effects, and significant harm to public confidence.”

4.2 With thegoalofbuildinga safer,moresecure,andmore resilientCanada,theNationalStrategyforCriticalInfrastructureandthesupportingActionPlan forCritical Infrastructurewere released in2010. EachprovinceandterritorycontributedtotheNationalStrategyandsignedonasparticipants.Together,theyestablishedacollaborativefederal,provincial,territorialandcriticalinfrastructuresectorapproachtostrengtheningcriticalinfrastructureresilience.

4.3 Recentnaturaldisastersdemonstratetheimportanceofcriticalinfrastructureplanningandtheneedtoaddressinterdependenciesonotherinfrastructures.For example, in 2012 Hurricane Sandy caused severe power outages andhinderedoilandgastransportationwhichisessentialforemergencyresponsevehicles.Combinedrepairandrecoverycostswereestimatedat$78.8billionforthestatesofNewYorkandNewJersey(USDepartmentofCommerce–September2013).

4.4 The National Strategy “recognized that responsibilities for critical infrastructure in Canada are shared by federal, provincial and territorial governments, as well as local authorities, and private critical infrastructure owners and operators. It also recognized that critical infrastructure owners and operators have the expertise and information that governments need to develop comprehensive emergency management plans and, in turn, that governments have information on risks and threats relevant to owners and operators in carrying out their risk management activities.”Thesupportingfederal Action Plan for Critical Infrastructure is meant to “strengthen resilience in Canada by helping to prevent, mitigate, prepare for, respond to, and recover from disruptions of critical infrastructure.”

4 Critical Infrastructure Resiliency


GAO

58Report of the Auditor General • Municipal Affairs • November 2016


4.5 NovaScotiaclassifiesitscriticalinfrastructurewithinthesametensectorsasdefinedintheNationalStrategy.•Energyandutilities•Finance•Food• Transportation• Government

• Informationandcommunicationtechnology•Health•Water•Safety• Manufacturing

4.6 Someexamplesofcriticalinfrastructureandownershipareshownbelow.

• Federalgovernment:police(RCMP),military,bordercrossings,bloodsupply,drug labs,medicalemergencystockpiles,NationalAirportsSystem,ITsystems

• Provincial and territorial governments: police, emergency medicalcare,roadways,transportationequipment,ITsystems,watertreatmentfacilities,hospitals

• Municipal governments: police, fire, roadways, transportationequipment,waterandwastewatertreatmentfacilities

• Privatesector:financial institutions,powergeneratingfacilitiesandtransmission systems, transportation including rail, flight, shipping,andtrucking,farms,foodprocessingfacilities.

4.7 TheNovaScotiaMinisterresponsiblefortheEmergencyManagementOfficeaccepted theNationalStrategy forCritical Infrastructureonbehalf of theProvinceofNovaScotiain2009.

Audit Objectives and Scope

4.8 In summer 2016, we completed a performance audit that considered thestatusofNovaScotia’scriticalinfrastructure.Theauditwasconductedinaccordancewithsections18and21oftheAuditorGeneralActandauditingstandardsoftheCharteredProfessionalAccountantsofCanada.

4.9 ThepurposeoftheauditwastodeterminewhethertheProvinceofNovaScotiahaseffectivelyestablished thenecessarypartnershipsand implementedanall-hazardsriskmanagementapproachforcriticalinfrastructureinordertoprepareforandrespondtoeventsthatcouldnegativelyimpactthewell-beingandsafetyofNovaScotians.

4.10 TheobjectivesoftheauditweretodeterminewhethertheProvinceofNovaScotiais:

59

GAO



• workingtoensuretheresiliencyofcriticalinfrastructurerequiredforthesafetyandwell-beingofitsinhabitants;and

• fulfilling its commitment to the National Strategy for CriticalInfrastructureandthecorrespondingActionPlan.

4.11 Generally accepted criteria consistentwith the objectives of the audit didnotexist.AuditcriteriaweredevelopedspecificallyforthisengagementbyourOfficeusingtheCanadianNationalStrategyforCriticalInfrastructureand information collected during planning. Criteria were accepted asappropriatebyseniormanagementoftheEmergencyManagementOfficeattheDepartmentofMunicipalAffairs.SeniormanagementoftheDepartmentofHealthandWellnesswasalsoaskedtoreviewandacceptthecriteriaduetoitsinvolvementintheNationalStrategy.

4.12 Ourauditapproach included interviewswithmanagementandstaffof theEmergencyManagementOfficeattheDepartmentofMunicipalAffairs,andotherprovincialgovernmentdepartmentswithsubjectmatterexpertiseforcritical infrastructure sectors:Health andWellness; Justice; Environment;Agriculture; Fisheries and Aquaculture; Energy; Finance and TreasuryBoard; Transportation and Infrastructure Renewal; and Internal Services.Wealsoreviewedrelevantpolicies,guidelinesandprocessesandexaminedpositiondescriptions,minutes,reportsandotherdocumentation.

4.13 Wedid not audit critical infrastructure owned by private entities inNovaScotia and cannot speak to its status. We looked atwhether governmentknowswhatNovaScotia’scriticalinfrastructureis,whoisresponsibleforit,andwhethergovernmenthasestablishedrelationshipswithprivateownersofcriticalinfrastructure.

4.14 OurauditperiodwasDecember2009toJuly2016,runningfromwhentheProvinceacceptedtheNationalStrategytothedatetheauditwassignificantlycompleted.

4.15 ThischapterhasarecommendationtoExecutiveCouncilthatitclarifywhoisresponsibleforestablishingacriticalinfrastructureprograminNovaScotia.The remaining recommendations have been assigned to the EmergencyManagementOfficebecauseittookresponsibilityfortheNationalStrategyforCriticalInfrastructurewhenitwasfirstreleased. IfExecutiveCouncilassignsresponsibilitytoanotherentity,theserecommendationswillneedtotransfertothatentity.

GAO



Significant Audit Observations

National Strategy for Critical Infrastructure

Conclusionsandsummaryofobservations

TheProvince does not have an implementation plan tomeet its commitment totheNationalStrategyforCriticalInfrastructure.Thereareelementsofaprograminplacetohelpensuretheresiliencyofthecriticalinfrastructurerequiredforthesafetyandwell-beingofNovaScotians,butnotacompleteprogramengagingallsectors.In2009,theMinisterresponsiblefortheEmergencyManagementOfficeagreedonbehalfoftheProvincetoimplementtheNationalStrategyandActionPlanforCriticalInfrastructure. EmergencyManagementtookresponsibilitybuttherewasno formalmandate for thisprogramandover time, ithasnot takenaleadershiproleinimplementingaprogramtomeettheobjectivesoftheNationalStrategy.Withtheexceptionofthehealthsector,criticalinfrastructureownedbygovernmenthasnotbeenidentified,theEmergencyManagementOfficedoesnothaveacompletelistofprivatesectorcriticalinfrastructureowners,andworkinggroupsfortheremainingninesectorshavenotbeenestablished.

4.16 Background–TheNationalStrategyforCriticalInfrastructureincludestencriticalinfrastructuresectors,mostofwhichlinktoprovincialgovernmentdepartmentsoragencieshavingsubjectmatterexpertiseofthesector. Forexample,thehealthsectoralignswiththeDepartmentofHealthandWellness;theenergysectoralignswiththeDepartmentofEnergy.

4.17 Acriticalinfrastructureoversightfunctionwithintheprovincialgovernmentshould ensure departments and agencies with expertise are assigned toappropriatesectorsandaremadeawareofprovincialresponsibilitiesincludedintheNationalStrategyandActionPlanforCriticalInfrastructure.

4.18 AprovincialprogramwouldidentifyrelevantownersandoperatorsofcriticalinfrastructurehavinganimpactontheProvinceofNovaScotia, includingprivatesectorpartners.Tosucceed,theprogramwoulddeveloppartnershipswith identified parties and use a framework to share information before,during,andaftereventsimpactingcriticalinfrastructure.

Emergency Management Office committed to implement National Strategy but has no plan

4.19 The Emergency Management Office was involved in discussions andprovidingfeedbackalongwiththefederalgovernmentandotherprovincesandterritorieswhentheNationalStrategyforCriticalInfrastructurewasdrafted.Inlate2009,theMinisterresponsiblefortheEmergencyManagementOfficeacceptedtheNationalStrategyandActionPlanforCriticalInfrastructureonbehalfoftheProvince.

61

GAO



4.20 Senior management responsible for the Emergency Management Officeassigned responsibility for implementing a critical infrastructure programinNovaScotiatothatoffice.TheEmergencyManagementOfficeincludedperformance measures related to a critical infrastructure program in itsaccountabilityreportin2010-11.However,thesemeasureswerenottrackedorreportedagainst.Subsequentaccountabilityreportsdidnotincludetheseperformancemeasures.

4.21 Inearly2011, theEmergencyManagementOfficeheldameetingwith theEmergencyPlanningOfficersofprovincialdepartments.Thepurposeofthemeetingwastoexplaintheprogramanddeterminehowtoidentifycriticalinfrastructure owners within sectors. Details included on the meetingagenda demonstrate the EmergencyManagementOffice’s commitment totheNationalStrategy,aswellasitsintenttoleadtheprograminNovaScotia.However,thiswastheonlymeetingfacilitatedregardingtheimplementationof a critical infrastructure program across government. There have beenmanydepartmentrestructuringsandstaffchangessincethattimeandmostofthecurrentEmergencyPlanningOfficersthroughoutgovernmentwerenotawareoftherequirementsoftheprogramwhenweinterviewedthem.

4.22 The Emergency Management Office does not have a legislated mandatefromExecutiveCouncil to implement a critical infrastructure program inNovaScotia. However, its staff have job descriptionswhich assign themresponsibilitiesrelatedtocriticalinfrastructure.Theseinclude:

• “ensuring responsibility for public safety and the protection of infrastructure in the Province of Nova Scotia;

• providing government with a professional, effective, efficient, and coordinated preparation for, response to, and recovery from an emergency; and

• developing and implementing policy related to a critical infrastructure program in the province.”

4.23 Despite this, there has been little action in recent years and there are nopoliciesrelatedtocriticalinfrastructure.

4.24 The Department of Justice also has a unit within the Public Safety andSecurity Division – Security Intelligence Management Services – withcritical infrastructure responsibilities. This unit is to assess threats tocritical infrastructure and distribute information to those responsible fortheinfrastructure.Althoughsomeoftheunit’sworkmayidentifysecuritythreats, theProvincedoesnot identifycritical infrastructureanddoesnothavealistofprovincially-ownedinfrastructuretoconductthreatassessmentson.Wealsonotedtheunitissupposedtohavefivemembersbutonlytwopositionsarefilled.

GAO



4.25 TheGovernment ofNovaScotia needs to assign responsibility to developand implement a critical infrastructure program and ensure participationfromappropriatedepartmentsandagencies.Aprogramwhichwillrequirecollaboration among Government departments and private sector entitiesrequires leadership to achieve buy-in and build trust. Additionally, theprovincialentityresponsiblefortheprogramneedstheauthoritytorequireprovincialgovernmentdepartmentstocomply.

Recommendation 4.1 ExecutiveCouncilshouldclearlydefineif theEmergencyManagementOfficeisresponsible for establishing a critical infrastructure program, and if not, assignresponsibilitytoanotherdepartment.

Executive Council Response: Agree. Executive Council Office will review and determine the appropriate responsibility for critical infrastructure.

4.26 Despite committing to theNationalStrategy, theEmergencyManagementOfficedidnothaveanactionplantoimplementtheStrategyintheProvinceandtheprovincialprogramdidnotmoveforwardafteraninitialmeetingwithdepartmentrepresentatives.TherequirementsoftheNationalStrategyandActionPlanhavenotbeencommunicatedtoGovernmentdepartments.Asaresult,staffandmanagementindepartmentswithsubjectmatterexpertiseforcriticalinfrastructuresectorsarenotawarethattheirdepartmentfallsinoneofthesectors.

4.27 TheNationalStrategy intended that government departmentswith subjectmatter expertise would establish partnerships with relevant private sectorownersandoperators.Forexample,withinthewatersector,representativesfrom the Department of Environment would be expected to developpartnerships with water and wastewater treatment facilities to promotecriticalinfrastructureplanningandinformationsharing.However,provincialrepresentativesweinterviewedfeltprivatesectorownershadresponsibilitytoprotecttheirowninfrastructureandexpectedthatresponsestoincidentswouldbecoordinatedwith theEmergencyManagementOffice. Althoughdepartmental representatives may communicate regularly with criticalinfrastructureownersandoperatorswithintheirsector,theyarenotengagingthese owners and operators for purposes specific to critical infrastructureresiliencyplanning.

4.28 One of the National Strategy’s primary objectives was to engage inpartnerships and promote information sharing. There are no criticalinfrastructure working groups, outside of health, tasked with developingsectorriskprofilesandmitigationplansforcriticalinfrastructure.Therearecommittees andworkinggroups, established forotherpurposes in criticalinfrastructure sectors,whichhavenotbeenused topromoteplanningand

63

GAO



collaboration between partners. Government could use these groups todevelop and expand partnerships with critical infrastructure owners andoperators.

4.29 There are other mechanisms available to identify national and regionalthreatsandriskshavinganimpactoncriticalinfrastructureinNovaScotia.However,notallof theseresourcesarefullyutilized. Oneexample is theCanadianCritical InfrastructureGateway, anonline site hostedbyPublicSafetyCanada for thecritical infrastructurecommunity. It aims toallowinformation sharing among partners. During our audit, we reviewed thecontentofthissite.Wefounditprovidesplanningguidesandriskidentificationaidsthatcouldbeusefultoolsforrepresentativesnotexperiencedwithcriticalinfrastructureprotection.TheEmergencyManagementOfficeisnotactivelyusingorpromotingthissitetocriticalinfrastructurerepresentativeswithingovernmentortheprivatesector.

Recommendation 4.2 The EmergencyManagement Office should develop and execute a strategy forimplementingtheNationalStrategyandActionPlanforCriticalInfrastructureintheprovince.

Emergency Management Office Response: Agree. The Emergency Management Office is currently undertaking a review of its Critical Infrastructure Resiliency Framework. The scope of the work will include an update to reflect alignment with the National Strategy and Action Plan for Critical Infrastructure.

Identification of Critical Infrastructure Owners and Operators in Nova Scotia


Governmenthasnotidentifiedallcriticalinfrastructureownersandoperatorsintheprovince.Communicationsfromgovernmenttotheprivatesectorwereproblematicduringtworecenteventsimpactingcriticalinfrastructure.OnlytheDepartmentofHealthandWellnesshasidentifiedandmaintainsalistofcriticalinfrastructureinitssector.Somedepartmentshavelistsavailableforotherpurposeswhichwouldaidinidentifyingcriticalinfrastructureownersintheirsector,butthishasnotbeendone.

4.30 Background – Themajority of critical infrastructure is owned outside ofgovernment,makingpartnershipsbetweenalllevelsofgovernmentandtheprivatesectoressentialtohelpensuretheresiliencyofcriticalinfrastructure.Partnershipsallowfor timely sharingof information,which in turn,helpslead to coordinated responses by partners to events impacting critical

GAO



infrastructure. Critical infrastructure and its owner or operator must beidentifiedbeforepartnershipscanbeestablished.

4.31 Criticalinfrastructuresystemsareinterdependent;onesystemmaybeneededtohelprecoveranother.Forexample,cleartransportationroutesareneededtorestorepower.Thiscreatesthepotentialforcascadingeffectsintheeventofasignificantfailure.

Government does not have a complete list of critical infrastructure owners and operators to partner with

4.32 Withtheexceptionofthehealthsector,theEmergencyManagementOfficehasnotidentifiedallcriticalinfrastructureownersandoperatorswithinthetensectorsanddoesnotknowifstepshavebeentakentoensureresiliencyof their critical infrastructure. Examples include risk assessments andcontingencyplans.Criticalinfrastructureownedbytheprivatesectormaybeadaptiveandresilient,butgovernmentdoesnotknowitsstatusoritsowner.

4.33 TheEmergencyManagementOfficeconsidersitselftherelationshipbuilderwith critical infrastructure owners and operators and has a contact list ofpartners,includinggovernmentandprivatesectorrepresentatives.Wefoundthislistisnotcompleteandtheprocesstokeepitcurrentisnotadequate.Wenotedthefollowingdeficiencies:

• provincial government contacts were inaccurate for half of thedepartmentsweinterviewed;

• the provincial government contacts we interviewed were oftenunawareofcriticalinfrastructureresponsibilities;and

• privatesectorcontactsarenotincludedforthefinancesectorandothersectorsdonotcoverallcontactswewouldexpect.

4.34 Communicatingwith partners in a timely fashion during a time of crisiswouldbemoredifficultwithoutacompleteandcurrentcontactlist.

4.35 TheEmergencyManagementOfficeusesaninformationdistributionsystemsimilartoanemailsystemtosendinformationsuchasweatheralertstocriticalinfrastructurepartnerswhohaveprovidedacontactperson.Thenotificationsystemcansendemails,textmessages,andvoicemailstorecipientstoensuretheyarereachedandtheinformationincludescontactinformationallowingrecipientstofollowupasnecessary.

4.36 Although the Emergency Management Office has a system in place tocommunicatewithcriticalinfrastructurepartners,availabilityofusefulandtimely informationhas beennoted as a significant issuewith its responseduringtworecenteventsimpactingcriticalinfrastructure:post-tropicalstorm

65

GAO



Arthurandthe2015fueldisruption.Anindependentreviewpanelprepareda report on theNovaScotia fuel shortage andmade21 recommendations,6ofwhicharespecific tocommunications. Thereportnotedbreakdownsin communication between government and key service providers anddistributionof inaccurate information. Themajority of recommendationswereaddressedtotheEmergencyManagementOfficeandcanbeappliedtoallcriticalinfrastructuresectors.Additionally,aninternallyprepared“lessonslearned”documentontheresponsetopost-tropicalstormArthuridentifiedareas of improvement for communications with critical infrastructurepartners.

Health and Wellness has identified critical infrastructure in the health sector; other departments have partial lists

4.37 Through the Health Services Emergency Management division, theDepartmentofHealthandWellnessmaintainsalistofcriticalinfrastructurein the health sector to adequately prepare for emergencies and ensure aconsistent,coordinatedresponseintheeventanemergencyoccurs.Oftheten departments at which we interviewed staff and management, HealthandWellnesswastheonlydepartmentfamiliarwiththerequirementsoftheNational Strategy andAction Plan forCritical Infrastructure and activelyplanningwithinitssector.

4.38 Somedepartments, forpurposesnotrelatedtocritical infrastructure,haveinformation available which would help identify private sector criticalinfrastructure owners and government-owned critical infrastructure. Weidentifiedthefollowing:

Critical Infrastructure Sector Applicable Department/Entity What information government has:

Water Department of Environment Water treatment facilities in the province

Food Department of Agriculture and Department of Fisheries and Aquaculture

Partial list of farm infrastructure and seafood processing facilities in the province. Details include monetary impact

Transportation, Food Department of Agriculture 82 provincially-managed dykes currently being prioritized in anticipation of climate change impacts

Government Department of Transportation and Infrastructure Renewal

Government-owned buildings with monetary replacement values, but no assessment of whether they are critical

Transportation Department of Transportation and Infrastructure Renewal

Government-owned bridges with a condition rating of each bridge, but no assessment of whether they are critical

GAO



Critical Infrastructure Sector Applicable Department/Entity What information government has::

Energy Nova Scotia Utility and Review Board

Energy providers and fuel distributers for regulatory compliance purposes. Details not shared with the Emergency Management Office

Recommendation 4.3 TheEmergencyManagementOfficeshouldidentifycriticalinfrastructureownersand operators having an impact on the Province, ensuring all ten sectors areaddressed.

Emergency Management Office Response: Agree. The Emergency Management Office has an established Network of critical infrastructure partners internal and external to government. Utilizing the ten section of critical infrastructure, EMO will undertake a mapping initiative to identify contacts in all ten sectors.

Provincially-owned Critical Infrastructure


TheProvincehasnotidentifiedcriticalinfrastructureitowns.Documentationofriskassessmentsforprovincially-ownedcriticalinfrastructureisinconsistent.AttheDepartmentofTransportationandInfrastructureRenewal,therewasminimaldocumentationofrisksfortwocriticalsectionsofhighway;theDepartmenthadadequateriskassessmentsforawatertreatmentfacility.HealthandWellnesshasariskassessmentandmonitoringprocessforthehealthsector,includingidentifyinginterdependencieswithothercriticalinfrastructuresectors.InternalServiceshasathreat-riskanalysisunderwayforanewTrunkMobileRadioSystem.

4.39 Background–Themajorityofcriticalinfrastructureintheprovinceisownedandoperatedbyprivateindustry,whiletheremainderisdividedamongthethree levels of government. Examples of critical infrastructure ownedbytheprovincialgovernmentinclude:hospitals,roadways,informationsystems,water treatment facilities, dykes, and dams. The entities responsible foroperating critical infrastructure owned by the provincial governmentshould have documented risk assessments and protection plans. A goodunderstandingoftheriskstoNovaScotia’scriticalinfrastructuremeanstheProvincecanbetterprepareitselftorespondtoeventsimpactingitscriticalinfrastructure.

4.40 The provincial government does not have a complete list of its criticalinfrastructure. Through interviews with government staff, we identifiedprovincially-ownedinfrastructureitemswhich,ifcompromised,wouldhave

67

GAO



significantnegative impactson thehealthandsafetyofNovaScotians,aswell as economic impacts. We selected critical infrastructure from foursectors:health, transportation,water, and informationandcommunicationtechnologytodetermineiftheProvincehadadequatedocumentationofriskassessmentsandprotectionplansforitscriticalinfrastructure.Theresultsaredetailedbelow.

Completed risk assessments of provincial health systems and a provincially-owned water treatment facility; critical communications system in process

4.41 Health-care system–Themajorityofthehealthcriticalinfrastructuresectorisownedby,oristheresponsibilityof,theProvince.Thisincludes:

• hospitals,clinics,andpharmaciesoperatedbytheNovaScotiaHealthAuthorityandtheIWKHealthCentre;

• EmergencyHealthServices;

• HealthLink811;

• publichealthservices;and

• health-careproviders.

4.42 TheDepartmentofHealthandWellnesshasaprocesstoassessandmonitorrisksimpactingcriticalinfrastructureinthehealthsectorusinganall-hazards,riskmanagement approach. TheDepartment has comprehensive plans toensureresiliencyofthehealthsystemincaseofadisruptionandregularlyconductstrainingexerciseswhichsimulateemergencysituationsinordertoprepare adequate responses. Lessons learned from trainingexercises andsignificanteventsimpactingthehealthsystemaretrackedtoensurerisksandresponsesareupdatedovertime.

4.43 Hayden Lake water treatment facility–Wetestedoneoftwowatertreatmentfacilities owned by the Department of Transportation and InfrastructureRenewal. This facility providesdrinkingwater to a varietyof customersin Lockeport, including residential, health-care facilities, schools, andbusinesses.Aprolongeddisruptiontothewatersupplycouldrequireacarefacilityorschooltotransferresidentstoanotherlocationorpayforbottledwatertobebroughtin.

4.44 Inordertoensuresafedrinkingwateracrosstheprovince,theDepartmentof Environment has testing and reporting requirements that must befollowedbyallwatertreatmentfacilities.Inaddition,theDepartmenthasdocumentationrequirements that facilitiesmustsubmit inorder to receiveoperatingapprovals.

GAO



4.45 We found Hayden Lake’s protection and contingency plans includecomprehensivedocumentationofriskstothelakeandtreatmentfacility.Theplansalsoincluderecoveryproceduresforarangeofdisruptions.However,theriskassessmentsdonotaddressthefacility’sdependencyonothercriticalinfrastructure being available during a disruption. For example, if powerortransportationisnotavailabletothefacilityduringasignificantweatherevent,thatcouldhinderitsabilitytoprovidedrinkingwater.Managementtold us they believe these risks are largely mitigated by a backup waterreservoirthatholdsoverfourdaysofwatersupplyinreserve.

4.46 Trunk Mobile Radio 2.0 System – In Nova Scotia, virtually all frontlineemergencyserviceprovidersutilizetheTrunkMobileRadio2.0Systemforradiocommunications.Severalfederalandmunicipalpartnersalsousethesystemorareimplementingitintheiroperations.TheTrunkMobileRadioSystemnetworkiscomprisedof89communicationstowersites,ofwhichtheProvinceownsten.Itisusedbyemergencyresponderssuchaspolice,firedepartments,andparamedicstocommunicateandiscriticalforpublicsafetyduringbothwidespreademergencysituationsandnonemergencysituations.

4.47 In the last two years, the Department of Internal Services and a privatepartnerhavemigrated toanewerversionof trunkmobile radio. A threat-riskassessmentforthenewsystemisunderwayinpartnershipwithoneoftheprimaryusers.

4.48 In the meantime, Internal Services has considered some of the risks forthetenprovincialtrunkmobileradiosites. Managementprovideduswithdescriptions of protective measures for the sites owned by the Province.While this isnota formalassessmentof the risks facingeachsite, itdoesprovideevidencethatmanagementhasinformallyassessedrisksimpactingthesitestomakedecisionsregardingprotectivemeasuresandredundanciestoincludeateachlocation.

Transportation and Infrastructure Renewal does not have risk assessments for critical sections of highway

4.49 Canso Transportation Link –TheCansoCauseway,swingbridge,andCansoCanaltogetherformtheCansoTransportationLink.Itwasopenedin1955.TheLinkprovidesforvehicleandrailtrafficbetweenmainlandNovaScotiaandCapeBretonIsland,whilealsoallowingforvesselmovementsthroughtheCansoCanal.AlltrucktrafficinandoutofCapeBretonandthroughtotheislandofNewfoundlandpassesovertheCansoCauseway.Weweretoldthatthiscriticaltransportationlinksupportsthefollowingmovements:

• Vehicles–8,300perday,ofwhich20%aretrucks

• Rail–twofreighttrainsperday

• MarineShipping–2,050passagesperyearthroughthecanal

69

GAO



4.50 The Canso Transportation Link is critical to both Cape Breton andNewfoundland and Labrador. Alternative transportation methods wouldneed to be identified if the Causeway was unavailable. A prolongeddisruptionwouldimpactdistributionnetworksrelyingontransportationovertheCauseway,suchasfoodandmedicine.

4.51 Transportation and Infrastructure Renewal has not completed riskassessments or protection plans for the Canso Transportation Link. ThefederalgovernmentisintheprocessoftransferringownershipoftheCansoCausewayandswingbridgetotheProvince.Thedocumentationrelatedtothetransferanda$10.5millionrepairprojectcontainsinformationneededto prepare risk assessments and protection plans including: identificationof stakeholders, developing a communications plan, conducting impactanalyses, assessing physical condition, and prioritizing repairs. However,thisinformationhasnotbeenusedtohelpassessrisks.

4.52 Amherst Highway 104 border to New Brunswick–TheChignectoIsthmusisthesolelandbridgejoiningmainlandNovaScotiawithNewBrunswick;it is one ofCanada’smost significant transportation corridors. We foundTransportationandInfrastructureRenewalhasnotpreparedriskassessmentsorprotectionplansforthissectionofhighway.TheDepartmentofAgriculturehascompletedastudytoinvestigatethemostseriousriskfacingthehighway:risksoffloodingoftheChignectoIsthmus.

4.53 AreportwasreleasedinDecember2012aspartofajointprogramamongthefourAtlanticprovinces,withthegoalofhelpingAtlanticCanadiansbetterpreparefor,andadaptto,climatechange.ItconcludedthatthetransportationcorridorthatcrossestheChignectoIsthmusisvulnerabletocoastalfloodingfromstormsurgesaswellaslong-term,sea-levelrise.Astormsurgeoftwometreswouldcauseextensiveflooding,possiblelossoflife,atemporaryhaltinvehicleandrailtraffic,andseveredamagetoawidevarietyofpublicandprivateassetsintheAmherst(NovaScotia)andSackville(NewBrunswick)areas. This demonstrates the need for a risk assessment and protectionstrategyforthehighway.

Recommendation 4.4 TheEmergencyManagementOfficeshouldensureallcriticalinfrastructureownedby theProvince is identified andhavedocumented all-hazards risk assessmentswhich consider interdependenciesonother critical infrastructure andmitigationstrategies.

Emergency Management Office Response: Agree subject to recommendation 4.1. The department(s) assigned responsibility for critical infrastructure will coordinate with all government departments to ensure risks and interdependencies are identified and mitigation strategies are in place.

chapter 4: critical infrastructure resiliency oag critical... · and trucking, farms, food...

Documents