Presidential Policy Directive 21

Presidential Policy Directive 21
Name	Presidential Policy Directive 21
Date	May 2013
Issued by	Barack Obama
Purpose	Critical infrastructure security and resilience
Related legislation	Homeland Security Act of 2002, Presidential Policy Directive 8, National Infrastructure Protection Plan

Presidential Policy Directive 21 is a 2013 executive directive issued by Barack Obama addressing critical infrastructure security and resilience for the United States. It articulates roles for federal departments and agencies in protecting critical infrastructure sectors and emphasizes partnerships with non-federal owners and operators. The directive situates infrastructure protection within broader national preparedness efforts alongside directives such as Presidential Policy Directive 8 and programs tied to the Department of Homeland Security and Department of Defense.

Background and Purpose

The directive arose amid concerns following incidents like the 2013 Target data breach, debates over risk to sectors exemplified by attacks on SANs and outages affecting Northeast blackout of 2003, and strategic reviews conducted under Barack Obama administration security advisors. It builds on statutory frameworks including the Homeland Security Act of 2002 and policy documents such as the National Infrastructure Protection Plan, aligning federal action with private-sector stewardship prominent in sectors such as Energy Policy Act of 2005-impacted utilities, Federal Aviation Administration-regulated aviation, and Health Insurance Portability and Accountability Act-relevant health systems. The directive's purpose links to national strategies advanced during the administrations of George W. Bush and Bill Clinton that emphasized interagency coordination and public–private collaboration.

Scope and Key Provisions

The directive identifies responsibilities for over a dozen critical infrastructure sectors, including those named in sector-specific plans like Electricity Subsector Coordinating Council and the Chemical Facility Anti-Terrorism Standards-related chemical sector. It establishes sector-specific agency lead roles by referencing federal departments such as Department of Homeland Security, Department of Energy, Department of Health and Human Services, Department of Transportation, and Department of Commerce. Key provisions mandate risk assessments drawing on frameworks like the NIST Cybersecurity Framework and require continuity planning similar to measures in the Presidential Decision Directive 63 era. The policy also addresses information sharing mechanisms reminiscent of collaborations like InfraGard and training and exercise expectations comparable to programs run by the Federal Emergency Management Agency and National Guard Bureau.

Implementation and Federal Agencies

Implementation tasks were assigned to federal entities including Department of Homeland Security, Department of Defense, Department of Energy, Department of Health and Human Services, Environmental Protection Agency, Department of Transportation, and Department of Commerce. The directive designates roles consistent with prior sector partnership models involving Sector Risk Management Agencies and sector coordinating councils. Operationalization relied on federal capacities from organizations such as the Cybersecurity and Infrastructure Security Agency (later established) and legacy centers like the National Protection and Programs Directorate. Interagency mechanisms echoed committees and councils such as the National Security Council and the Office of Management and Budget for budgeting and oversight.

Coordination with State, Local, Tribal, and Private Partners

The directive emphasizes coordination with non-federal stakeholders, promoting engagement models used by entities like National Governors Association, United States Conference of Mayors, National Association of Counties, and tribal organizations similar to those represented in Institute for Tribal Government dialogues. It calls for information sharing between federal entities and private operators including utilities, transportation firms, and healthcare systems—paralleling collaborations with groups such as American Hospital Association, North American Electric Reliability Corporation, American Petroleum Institute, and Aviation Sector Coordinating Council. Exercises and preparedness activities referenced practices from joint efforts involving Federal Emergency Management Agency, National Guard Bureau, and corporate partners that had precedent in exercises like Operation Atlantic Resolve-style coordination and regional resilience initiatives.

Impact and Criticisms

The directive influenced sector planning, leading to updated risk assessments and revised public–private engagement, and set the stage for subsequent organizational changes such as the creation of dedicated cybersecurity entities. Critics argued the directive preserved voluntary cooperation models favoring private owners and operators similar to critiques of the National Infrastructure Protection Plan and raised concerns about transparency, civil liberties, and statutory authority that echoed debates seen with Patriot Act-era surveillance and with legislation like the Cybersecurity Information Sharing Act of 2015. Some stakeholders in state and local jurisdictions sought clearer funding commitments akin to debates over Stafford Act disaster assistance, while privacy advocates compared information-sharing provisions to controversies involving Edward Snowden disclosures.

Subsequent Developments and Related Policy

Following the directive, administrations and Congress advanced related measures including organizational reforms that led to the establishment of the Cybersecurity and Infrastructure Security Agency within the Department of Homeland Security and legislative actions exemplified by the Cybersecurity Information Sharing Act of 2015. Later executive actions and strategies under presidents such as Donald Trump and Joe Biden referenced infrastructure resilience, cyber defense, and supply-chain security in policies like national cyber strategies and executive orders addressing critical sectors. Internationally, dialogues with partners such as NATO, European Union, and bilateral engagements with Canada and Mexico reflected evolving norms for protecting cross-border infrastructure and supply networks.

Category:United States national security policy