DHS National Risk Register

DHS National Risk Register
Name	DHS National Risk Register
Formed	2003
Jurisdiction	United States
Headquarters	Washington, D.C.
Parent agency	United States Department of Homeland Security

DHS National Risk Register The DHS National Risk Register is an official analytical product published by the United States Department of Homeland Security to catalog and assess threats and hazards affecting United States critical infrastructure and populations. It synthesizes inputs from federal entities such as the Federal Emergency Management Agency, Office of the Director of National Intelligence, and Department of Defense components, while aligning with statutory authorities like the Homeland Security Act of 2002 and directives from the White House. The Register informs planning by agencies including the Federal Communications Commission, Environmental Protection Agency, and Department of Transportation.

Overview

The Register identifies hazard types, likelihood estimations, and consequence metrics to support resilience across sectors overseen by the Cybersecurity and Infrastructure Security Agency, National Protection and Programs Directorate, and sector-specific agencies like the Department of Energy and Department of Health and Human Services. It integrates intelligence assessments from the Central Intelligence Agency, National Counterterrorism Center, and National Geospatial-Intelligence Agency with empirical data from the United States Geological Survey, Centers for Disease Control and Prevention, and National Oceanic and Atmospheric Administration. Policy frameworks such as the National Response Framework and the Presidential Policy Directive 8 shape its analytic scope.

History and development

The Register emerged in the aftermath of the September 11 attacks and institutional reforms that created the United States Department of Homeland Security. Early iterations drew on legacy capabilities from the Federal Emergency Management Agency and the Information Analysis and Infrastructure Protection Directorate. Influential events informing its evolution include the Hurricane Katrina response, the Northeast blackout of 2003, and cyber incidents like the Sony Pictures hack and attacks attributed to state actors such as Russian Federation-linked actors. Legislative milestones, including amendments to the Homeland Security Act of 2002 and appropriations oversight by the United States Congress, affected scope and funding.

Structure and methodology

Analysts use multi-criteria risk assessment models that adapt techniques from National Institute of Standards and Technology frameworks, probabilistic modeling used by the Defense Advanced Research Projects Agency, and scenario planning akin to exercises conducted by the RAND Corporation and Center for Strategic and International Studies. The Register applies consequence categories familiar to operators at the Federal Aviation Administration, United States Postal Service, and United States Coast Guard, and cross-validates threat vectors with intelligence from the National Security Agency and law enforcement inputs from the Federal Bureau of Investigation. Methodological components include hazard identification, vulnerability analysis, impact quantification, and mitigation prioritization, linked to standards from the International Organization for Standardization where applicable.

Risk categories and content

Content spans natural hazards like earthquakes documented by the United States Geological Survey and pandemics studied by the World Health Organization and Centers for Disease Control and Prevention; technological failures exemplified by incidents involving the Bureau of Land Management or failures in North American Electric Reliability Corporation-regulated grids; and human-caused threats such as terrorism typified by plots disrupted by the Joint Terrorism Task Force, transnational criminal activity involving the Drug Enforcement Administration, and cyber operations traced to groups associated with the People's Republic of China or Islamic State of Iraq and the Levant. It addresses infrastructure sectors overseen by entities like the Department of Transportation, Department of Commerce, and Department of Energy.

Implementation and use

Federal, state, local, tribal, and territorial stakeholders—including offices similar to those in New York City, Los Angeles, and Puerto Rico—use the Register to prioritize grants administered by the Federal Emergency Management Agency and to inform continuity plans aligned with the Continuity of Operations Plan construct. Private sector partners such as utility operators under the North American Electric Reliability Corporation and telecommunications firms regulated by the Federal Communications Commission reference the Register to guide investments and exercises with organizations like the Energy Sector Control Systems Working Group and standards bodies including the National Fire Protection Association.

Criticisms and controversies

Critiques have come from think tanks such as the Heritage Foundation and Brookings Institution as well as investigative reporting in outlets covering oversight by the Government Accountability Office and hearings before congressional committees including the House Homeland Security Committee and Senate Homeland Security and Governmental Affairs Committee. Concerns include perceived politicization, transparency limitations compared to documents like the Freedom of Information Act disclosures, methodological opacity similar to debates around National Intelligence Estimates, and resource allocation questions echoed in reports by the Congressional Budget Office. Civil liberties organizations such as the American Civil Liberties Union have raised issues when risk assessments intersect with surveillance policies.

Related programs and agencies

The Register interlinks with programs including the National Incident Management System, Integrated Public Alert and Warning System, and initiatives led by the Cybersecurity and Infrastructure Security Agency. It complements assessments performed by the Homeland Security Advisory Council, National Infrastructure Advisory Council, and academic centers such as those at Johns Hopkins University, Massachusetts Institute of Technology, and Stanford University. International counterparts include frameworks from the European Union and partnerships with agencies like the United Kingdom's National Cyber Security Centre and multilateral bodies such as the United Nations Office for Disaster Risk Reduction.

Category:United States Department of Homeland Security