FRANKLIN COUNTY EXECUTIVE COMMITTEE MEETING Franklin County Emergency Management and Homeland Security 21 MARCH 2012BRIEF TO EXCOMM1

Agency Update Grants Update Integrating Risk Management into the Homeland Security Enterprise Cyber Security 21 MARCH 2012BRIEF TO EXCOMM2

FY2011 Grant 21 MARCH 2012BRIEF TO EXCOMM3

FY2011 SHSP FEMA Priorities Whole Community; Advancing “Whole Community” Security and Emergency Management. Building Prevention and Protection Capabilities. Maturation and Enhancement of State and Major Urban Area Fusion Centers. 21 MARCH 2012BRIEF TO EXCOMM4

FY2011 SHSP Ohio Priorities Expand Interoperable Communications Throughout Ohio. Conduct Multi-Agency Local, Regional and State-wide Exercises. Implement Preparedness Training Initiatives. Strengthen CBRNE Prevention, Protection, Detection and Response. Enhance Intelligence Fusion and Information Sharing Capabilities (LE-SHSP Funds). Implement the National Infrastructure Protection Program. Grant program applications must align with one or more of the above funding priorities to be eligible for funding. 21 MARCH 2012BRIEF TO EXCOMM5

Program Specific Overviews and Priorities - SHSP Activities implemented under SHSP must support terrorism preparedness by building or enhancing capabilities that relate to the prevention of, protection from, response to and recovery from terrorism in order to be considered eligible. 21 MARCH 2012BRIEF TO EXCOMM6

Changes to Local Guidance for FY2011 Food costs with the exception of per diem and for full-scale exercises have been eliminated. Per recent FEMA guidance, the maintenance and sustainment costs have been expanded to include equipment purchased with non-federal sources. In accordance with the requirements of 44 CFR, sub-grantees seeking to make a purchase or other procurement exceeding $100,000 must pre-coordinate the procurement with Ohio EMA. Environmental and Historical Preservation (EHP) Review forms have been updated and must be completed and submitted with projects. (An EHP must be conducted for even the smallest items, such as hanging a whiteboard on a wall) Quarterly reporting by OEMA will be conducted for all FY2011 sub-grants. So it will be imperative that all sub-grantees submit your quarterly reports in a timely manner to FCEM&HS. 21 MARCH 2012BRIEF TO EXCOMM7

Changes to Local Guidance for FY2011 LE SHSP Specific FY2011 LE SHSP grant funds may not be used to support fusion center-related initiatives unless the fusion center is able to certify that privacy and civil rights/civil liberties protections are in place that are determined to be at least as comprehensive as the ISE Privacy Guidelines by the ISE Privacy Guidelines Committee within 6 months of the award date on the FY2011 award. A fifth statewide priority for CBRNE Detection was added to the LE SHSP as in the FY2010 Program and continues as an allowable priority in FY2011. No more than 30% of the total regional award (excluding National Border Initiative (NBI) funds) may be used toward the CBRNE detection priority. 21 MARCH 2012BRIEF TO EXCOMM8

FY2011 Franklin County SHSP Allocation $469, Performance Period of September 1, 2011 – April 30, 2014 Waiting on Award 21 MARCH 2012BRIEF TO EXCOMM9

FY12 Transition to FY13 National Preparedness Grant Program Preparedness Grant Programs for FY2012: – SHSP (Competitive and Guidelines TBD) – UASI (Cleveland & Cincinnati) – Operation Stonegarden Eliminated Programs: – Metropolitan Medical Response System (MMRS) – Citizen Corps Program (CCP) Eligible costs under these two programs are now allowed under SHSP and UASI. 21 MARCH 2012BRIEF TO EXCOMM10

FY12 Transition The FY2012 Homeland Security Grants are focused on mitigating and responding to the evolving threats while beginning to transition to the new vision set forth in the President’s FY2013 Budget focused on building and sustaining the core capabilities outlined in the National Preparedness Goal. FY2012 Grants guidance will begin to prepare grantees for the transition to the new grants vision in FY2013 by consolidating multiple, separate preparedness grant programs into a more streamlined model. FY2012 is a transition year. 21 MARCH 2012BRIEF TO EXCOMM11

FY12 Transition Grantees will be encouraged to utilize grant funding to maintain and sustain current capabilities through investments in training and exercises, updates to current planning and procedures, and lifecycle replacement of equipment. Any new capabilities (TBD by State) wanting to be built must be deployable if needed to support regional and national efforts. All capabilities being built or sustained must have a clear linkage to the core capabilities (not TCLs) in the National Preparedness Goal. Per recent FEMA guidance, the maintenance and sustainment costs have been expanded to include equipment purchased with non-federal sources. 21 MARCH 2012BRIEF TO EXCOMM12

Grant Framework Team – FY12 Since grants will now be a competitive environment, OEMA has convened a Grant Framework Committee to review the grant guidance. Committee is made up of representation from the bulk of the stakeholders: – OEMA – 2 large EMA counties – 2 medium EMA counties – 2 small EMA counties – UASI Cities – MMRS – Ohio Homeland Security Four Committee meetings have already been held. 21 MARCH 2012BRIEF TO EXCOMM13

Grant Framework Committee Purpose Install a framework that better utilizes the reduced funding anticipated. Determine the criteria and ranking system for the awarding of grants. Build up core high ranking capabilities that can be deployed regionally and nationally. Risk (THIRA) – Capabilities – Gap Analysis. 21 MARCH 2012BRIEF TO EXCOMM14

Grant Framework Team The State’s FY2012 application must be submitted before May 4, % of the funds must be passed through to local jurisdictions. 25% of the funds must be dedicated to Law Enforcement activities for terrorism prevention, detection, response and recovery. Ohio’s FY2012 estimated amount to be awarded to counties is $3.3 Million. Not all 88 counties will receive funding. Applications may be submitted on a regional basis. 21 MARCH 2012BRIEF TO EXCOMM15

FY13 National Preparedness Grant Program Vision Consolidation of Grants – All 16 grant programs will be rolled into one competitive National Preparedness Grant Program. This will enable grantees to develop and sustain core capabilities outlined in the National Preparedness Goal and support the recommendations of the Redundancy Elimination and Enhanced Performance for Preparedness Grants Act. Will prioritize nationally deployable NIMS-typed capabilities that can be utilized anywhere in the nation upon request. 21 MARCH 2012BRIEF TO EXCOMM16

FY13 National Preparedness Grant Program Vision Funding will be competitive and based on prioritized core capabilities as well as comprehensive threat/risk assessments and gap analyses. All grant funded projects will be validated via peer review to ensure that projects support the development and sustainment of regional and national core capabilities. Peer review will assist in targeting funds for regionally critical projects and will reduce the redundancy of like assets throughout the Region. Grant awards will have a two-year performance period with very limited extensions. 21 MARCH 2012BRIEF TO EXCOMM17

Integrating Risk Management into the Homeland Security Enterprise Background Franklin County Emergency Management & Homeland Security (FCEM&HS) takes a risk-based approach to our business model. Intent is to more effectively engage elected officials and decision makers in EMHS policy making. Problems to address: – Same response for every hazard but terrorism. – Risks assessed but not incorporated into training, exercise, funding. – Efforts duplicated due to partners working in silos. 21 MARCH 2012BRIEF TO EXCOMM18

Integrated Risk Management Very complex system; coordinated by FCEM&HS to help ensure decision makers are educated about risks that impact Franklin County and fully integrated into the strategic planning process for managing those risks. FCEM&HS is building an IRM process to support the Homeland Security Enterprise. Participation by Decision Makers in the Homeland Security Enterprise (jurisdiction CEOs) is key to fully realizing integrated risk management. This is a cultural and paradigm shift in Homeland Security thinking. 21 MARCH 2012BRIEF TO EXCOMM19

21 MARCH 2012BRIEF TO EXCOMM20 “Silo-ed” Approach Fire EMA LE Private Sector CEOs Private Sector CEOs Citizens Health Decision Makers Decision Makers State Federal NGOs Non- Profits Non- Profits

21 MARCH 2012BRIEF TO EXCOMM21 Fire EMA LE Private Sector CEOs Private Sector CEOs Citizens Health Decision Makers Decision Makers State Federal Integrated Approach Local Jurisdictions Local Jurisdictions State and Federal Partners State and Federal Partners NGOs Non- Profits Non- Profits Emergency Partners Emergency Partners

Homeland Security Enterprise Homeland Security Enterprise (HSE) is a “whole community” approach. Utilizes partnerships among emergency management, law enforcement, public health, local/state/federal government, private sector, nongovernmental organizations, faith-based & community-based organizations, and the public. Based on emphasis on all-hazards preparedness at federal level, local HSE partners must share info regardless of threat, whether tornadoes or terrorism. HSE is the FOUNDATION of Integrated Risk Management. Local Emergency Partners Jurisdictional CEO’s State and Federal Partners FCEM&HS Communication & Coordination 21 MARCH 2012BRIEF TO EXCOMM22

21 MARCH 2012BRIEF TO EXCOMM23 Integrated Risk Management Strategy Decision Maker Education and Engagement Homeland Security Enterprise Planning Training Exercises Funding Priorities Franklin County Threat Hazard Identification & Risk Assessment (THIRA) Franklin County Core Capability Assessment Franklin County Gap Analysis GapsCapabilitiesRisk Decision Maker Review & Updates Planning Training Exercises Funding Priorities GapsCapabilitiesRisk

Comparison: IRM & National Preparedness System NPS ComponentsFCEM&HS IRM Process Identifying and Assessing RiskEnhancing risk assessment Estimating Capability Requirements (Cap Assess) Assessing capabilities Building and Sustaining Capabilities (Gap Analysis) Gap Analysis Planning to Deliver CapabilitiesStrategic Planning Validating CapabilitiesDecision-Maker Education & Engagement Reviewing and UpdatingAnnual Review & Update 21 MARCH 2012BRIEF TO EXCOMM24

Franklin County Regional Training and Exercise Strategy In 2011, FCEM&HS completed a Regional Strategy to 1) help coordinate county training and exercises, 2) expand regional collaboration, and 3) more efficiently use Federal, State and local funding and resources to enhance regional preparedness. FCEM&HS initiated a Regional Training and Exercise Committee for the Columbus Metropolitan Statistical Area (MSA); includes Delaware, Fairfield, Franklin, Licking, Madison, Morrow, Pickaway, and Union counties. In 2012, FCEM&HS started the Franklin County Training & Exercise Committee with representation from multiple disciplines throughout the county. 21 MARCH 2012BRIEF TO EXCOMM25

In Review We are all part of the Homeland Security Enterprise. Risks  Capabilities  Gaps  HSE Decision Making = IRM. Successful implementation of both IRM and NPS in Franklin County rests on participation of Franklin County decision makers. End-state: an informed body of leaders in Franklin County who understand our risks, capabilities and gaps and use that knowledge as part of the HSE to shape policy and funding. Franklin County will also produce a Guide that can be disseminated by OEMA and FEMA to help local governments implement Integrated Risk Management at the local level. 21 MARCH 2012BRIEF TO EXCOMM26

Cyber Security ‘60 Minutes’: The Stuxnet Worm The Stuxnet worm showed, for the first time, that a cyber attack could cause significant physical damage to a facility. Does this mean that future malware, modeled on Stuxnet, could target other critical infrastructure — such as nuclear power plants or water systems? Google the story with search terms “60 Minutes Stuxnet.” 21 MARCH 2012BRIEF TO EXCOMM27

Cyber Security New York Times: ‘Soul of the New Hackitvist’ A new age of online hacking has begun, and it targets governments, government agencies and any other cause that “hacktivists” want. This type of hacking is organized and involves multiple hackers. “At a time when life, commerce and statecraft have gone digital, hacktivists can threaten governments, or they can just as easily dump innocent people’s credit card numbers on the Internet for more common criminals to steal.” Google Search terms: “soul of the new hacktivist nyt” 21 MARCH 2012BRIEF TO EXCOMM28

Cyber Security ‘Anonymous’ Threat Professes anti-authoritarian views; ‘hacktivists.’ Uses Internet, , computers as weapons to steal private data and disrupt systems. Targets include law enforcement, homeland security community, power companies, political parties, businesses, critics. Targets are in U.S., U.K., Australia, other nations worldwide. Allegiances to ‘Occupy,’ Wikileaks, and numerous white supremacy groups. 21 MARCH 2012BRIEF TO EXCOMM29

Cyber Security U.S. Cyber Consequences Unit Cyber Security Check List (2007) Comprehensive survey of steps that corporations & organizations should take to reduce vulnerability to cyber- attacks. Viewing Cyber Security as ‘risk triangle’ of threats, consequences and vulnerabilities – checklist addresses vulnerabilities. Vulnerabilities & counter-measures sorted into 6 broad categories: 1) Hardware, 2) Software, 3) Networks, 4) Automation, 5) Humans, 6) Suppliers. 21 MARCH 2012BRIEF TO EXCOMM30

QUESTIONS / DISCUSSION Franklin County Emergency Management and Homeland Security 21 MARCH 2012BRIEF TO EXCOMM31