Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. America’s First National Critical Infrastructure Exercise Mr. Mark Gembicki, National Managing Director Critical Infrastructure Resiliency Practice | Public Release

1 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. Background n To date, no exercise has been conducted by, or for, the Private Sector n Government exercises reflect the needs and requirements of the “government” n Organization plans, policies, and procedures are not adequately assessed or evaluated in current government exercises dealing with critical infrastructures

2 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. Objectives n Conduct a private sector exercise n Improve relationships among and between key stakeholders n Exercise threat scenarios against operational aspects of the electrical grid n Provide an infrastructure for organizations to self test and evaluate organizational plans, policies, and procedures n Capture performance data to evaluate Critical Infrastructure Resiliency metrics and models – U.S. comparison against other countries n Identify key successes and failures n Allow for a natural response to scenarios – inaction as well as action is evaluated n Consider both socio-economic and national security impact n Articulate benefits for preventative security

3 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. Overview n Funded by the private sector n All exercise data will be protected under multi-party non-disclosure agreements n Exercise will simulate and maintain perspective between parties n All information will be treated as sensitive but unclassified information n Participants will play at the location from which they would most likely respond to a cyber event n “Functional” exercise- simulating a real time emergency scenario using real people and equipment to test plans and procedures n Conducted with a comprehensive “hot wash” and after action analysis report available to all participants

4 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. General Framework of Scenario n Scenario and General Framework: NCIE will use a common series of scenario and varying perspectives for all players that would a) produce a response, and b) resemble possible attacks directed toward participants n The draft framework includes four stages: Stage 1: Situational Awareness - Background information on an emerging threat/vulnerability will be provided to assess organizational incident detection capabilities Stage 2: Crisis Identification - Increased activity will be presented in an escalating fashion Stage 3: Business Impact - Activity will cause a series of business impacts to trigger contingency plans Stage 4: Recovery - Activities should diminish and begin the recovery/restoration process to “normal” conditions

5 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. Participant Benefits n Participants are provided with a stable framework to exercise and self evaluate organizational capabilities to respond to security events n Improved understanding of social, economic, and national security impacts as well as a way to measure them against stakeholder equity and “Duty of Care” principles n Opportunity to provide recommendations to the Department of Homeland Securities, Science & Technology directorate for future R&D spending n Establish and/or improve relationships for future response situations n Ensure plans are accurate, up to date and understood n Test core emergency response personnel n Identify success/weakness in organizational policies with tangible improvements identified n Increased awareness of attacks and effects n Participation in follow-on exercises across remaining critical infrastructures

6 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. Critical Dates Completion of Final Exercise Plan: September 23, 2005 Concepts and Objectives Meeting Date:May 23, 2005 Initial Plan Completed:June 24, 2005 Initial Planning Conference:July 11, 2005 Mid-Planning Conference: August 30, 2005 Final Planning Conference: September 8, 2005 Exercise Execution Date: October 18-19, 2005 Interim Findings Report:November 7, 2005 After Action Reports:December 16, 2005

7 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved. NCIE Points of Contact Exercise Director Mr. Mark Gembicki Phone: Program Manager Mr. Joe Albaugh Phone: Exercise Advisor Mr. Amit Yoran Phone: Program Manager Ms. Jacklyn Blecker Phone:

8 Proprietary Information of BearingPoint Inc. | Copyright 2005 BearingPoint Inc. All rights reserved.