Overview

What

This guide seeks to:

• Set out practical approaches that can be used to identify significant Local Infrastructure

Who

This guide is aimed at:

• Government – CI Resilience Policy leads in Scottish Government
• Critical Infrastructure (CI) Operators – Strategic Management, Resilience and Business Continuity Management (BCM) leads
• Responder Communities – Regional Resilience Partnerships (RRPs), Local Resilience Partnerships (LRPs), Government department policy leads
• Industry Groups

Why

The benefits of identifying significant local infrastructure include:

• Achieving long term resilience of significant infrastructure
• Ensuring understanding of Physical, Logical and People assets at a local level
• Prioritisation of investment for asset protection
• Providing context for the Resilience Preparedness Assessment process

How

• Compile a list of local infrastructure
• Identify what is significant
• Share with resilience partners through the RP CI groups
• Map significant local infrastructure to assist in the identification of dependencies and interdependencies

Case Study

Significant Local Infrastructure Pilot Project

The North of Scotland Regional Resilience Partnership Critical Infrastructure Group carried out a pilot piece of work to identify significant local infrastructure in three Local Authority areas in the North capturing a variety of geographic types. These were:

• Angus Council – rural
• Aberdeen City Council – urban
• Orkney Islands Council – island

The aim was to establish a simple process for developing a database of Significant Local Infrastructure with relevant supporting data. This data included site addresses of sites, names of owners, GIS location data and 24/7 contact numbers.

Significant Local Infrastructure is defined as infrastructure which is regarded as important in a local geographic area and supports the delivery of essential services at a local level.

Each of the three pilot areas were approached via their Council emergency planning leads to provide a list of infrastructure sites. One to one discussions were held with each lead and a template provided to give some guidance as to the sectors to be considered. These were;

• Energy – including electricity, gas and fuel
• Civil Nuclear
• Communications - including telecoms, internet, broadcasting and postal services
• Transport - including aviation, ports and ferries, rail and roads and bridges
• Finance
• Government – including SG, local government, others
• Emergency Services – including Police, Fire, Ambulance and Coastguard
• Food
• Water
• Health
• Chemicals
• Defence
• Space

This required some consultation with other relevant areas within Council’s including planning and roads etc. This initial piece of work captured not only significant local infrastructure but also some national and critical national infrastructure (CNI).

The methodology is described further in the following sections.

Background

This Guide has been developed to support infrastructure owners and operators, emergency responders, industry groups and government departments to work together to improve the resilience and security of critical infrastructure and essential services in Scotland.

This is best achieved through a Team Scotland approach that seeks to Keep Scotland Running and Keep Scotland Informed before, during and after infrastructure related emergencies.

Each of Scotland’s three Resilience Partnerships have established Critical Infrastructure sub groups to support their understanding of infrastructure in their area and deliver an agreed work plan. These groups also provide context for their Risk Preparedness Assessments¹⁷ and ultimately supports the production of Community Risk Registers.

All of this work forms part of Scotland’s Strategic Framework, for dealing with Critical Infrastructure in Scotland. The other parts being delivered by:

• Scottish Governments Resilient Essential Services Team and their engagement with Infrastructure Sector Resilience Groups and individual infrastructure owners and operators.
• Police Scotland’s Protect Profile work which identifies a broad range of infrastructure assets in each of their territorial Divisions.

This tripartite approach collates a rich picture of infrastructure and supports further work to identify dependencies and interdependencies (see Guide 3 for further information) through a GIS mapping product maintained by Police Scotland.

A key part of this work will be collated by the 3 Resilience Partnerships CI groups to identify Significant Local Infrastructure. The term Significant Local Infrastructure refers to local sites known by responders and deemed to have local importance in the delivery of essential services. These include, bridges, tunnels, hospitals, police stations, fire stations, prisons, electricity sub stations etc. (see Annex B for more examples). It is used in this context to reduce sensitivities attached to the term critical. Significant Local Infrastructure work will provide a much more comprehensive list of infrastructure (a rich picture), some of which may be regarded as critical.

The identification of Critical National Infrastructure is well established and clearly described in the 2016 CPNI Guidance.¹⁸

¹⁷ See Preparing Scotland Guidance

¹⁸ CPNI – CNI Protection in the UK – the role and functions of CPNI – September 2016

Methodology

This section describes the process used in the pilot to identify Significant Local Infrastructure. It is simplistic to encourage understanding and engagement with the process but nevertheless provides useful information in support of the overall strategy.

• Compile a list of local Infrastructure considered significant in each Local Authority area. Completion of the template at Annex A will assist to limit the scope of what is considered to be significant
• Identification of what is significant within the LA area will require local knowledge and expertise of various areas of the LA’s key departments including planning, roads, business continuity and emergency planning
• Completing the list will in some cases include sites which may have a national criticality classification however this will be confirmed at a later stage in the process and should not prevent them being included at this point
• This list will be shared with the relevant Sector Resilience Groups within the Critical Infrastructure Resilience Partnerships governance structures for comparison and feedback

Ultimately this list will be combined with Police Scotland Protect Profiles and Scottish Government Critical Infrastructure lists to create the rich picture of sites across Scotland.

Future Work

Once significant local infrastructure is identified the Resilience Partnerships’ Critical

Infrastructure groups will support further work assessing

• Criticality
• Vulnerabilities
• Mitigation
• Identifying gaps in capability

This work is already underway in respect to Telecoms Outages, Black Start planning and Fuel Disruption. The following bullets describe further work which will be required:

• Based on current Resilience Partnership knowledge and expertise, assess and complete the risk assessments associated with the loss of essential services and consider vulnerabilities and impact of the loss on the Resilience Partnership area
• Consider the Contingency Plans that are in place to mitigate the risks associated with the loss of essential services
• Include national plans, sector specific plans (e.g. COMAH, REPPIR), organisational plans and local plans and arrangements to mitigate the risk
• Assess the capability and capacity of the Resilience Partnership to respond to the worst case scenario caused by the loss of essential services
• Identify gaps in preparedness and response arrangements
• Gaps identified in relation to individual Operator and Sector responsibility, can be highlighted through the Critical Infrastructure Resilience Partnership arrangements or direct with the policy areas
• This assessment will feed directly into the Resilience Partnerships Measuring Preparedness Statements

Summary

As has been highlighted, this element of the Strategic Framework was designed to be simple and not require specialist knowledge or skills other than knowledge and appreciation of the significant infrastructure sites in individual Local Authority areas. It is envisaged that each Local Authority area should be able to collate the information required following one meeting of key personnel followed up by collation of the information required for each site as per the template in Annex A. The Resilience Partnership Critical Infrastructure groups will determine the pace at which the data is gathered but it has been proposed that small numbers of Local Authorities in each of the Resilience Partnership areas will work on collating their lists between meetings of the RP CI groups.

Police Scotland have a GIS secure mapping project underway which will be used to map the lists of infrastructure. Ultimately these lists will assist in further work to identify dependencies and interdependencies and in due course will support the identification of weaknesses and vulnerabilities in our portfolio of infrastructure.

Delivery

• CPNI – CNI Protection in the UK – the role and functions of CPNI
• CPNI – CNI Protection in the UK - Annexes
• RPA Process

Significant Local Infrastructure Template

Local Authority Area –

Please complete the attached template with as much detail as required. If you have any questions, please contact the Resilient Essential Services Team ciru@gov.scot

Please add as many new lines under each sector as you need. You will have some sectors with no assets.

Examples of Generic Critical Local Infrastructure List

Energy

• Hydro Generating Stations - Electricity
• Significant Power Stations - Electricity
• Gas Compression/Pumping Stations - National Grid Gas
• Significant Gas Distribution assets - Scotland Gas Networks (SGN)
• Oil Pumping Stations/Refinery/Distribution Centres - Oil/Fuel
• Significant Pipelines - Oil/Gas
• Nuclear Power Stations/assets - Nuclear
• Utilities Control Centres

Transport

• Significant road bridges/tunnels
• Arterial road routes/nodes
• Significant rail bridges/tunnels
• Hub railway stations
• Major bus stations
• Main/significant harbours/sea ports
• Airports
• Air Traffic Control Centres

Finance

• Significant Financial Institutions
• Significant cash handling areas

Communications

• BT Exchanges [particularly those supplying CNI sites]
• BT/Cable and Wireless – 999 Call Handling Centres
• Radio/Television Transmitters/masts
• Significant postal collection/distribution centre

Water

• Significant Reservoirs/dams
• Water treatment works
• Waste treatment/pumping sites

Food

• Significant Food Production assets
• Significant Food Processing assets
• Significant Food Distribution assets
• Significant Food Retail assets

Health

• Main Hospitals
• Specialist Health resources
• Other significant Health responsibilities

Emergency Services

• Police [e.g. HQ, Control Rooms, Major Incident Operations Centres, SCC]
• Fire [as above]
• Ambulance [as above]
• Maritime Coastguard [as above]

Government

• UK Government assets
• Scottish Government assets
• Local Government assets [e.g. Council Headquarters, Emergency Centre]
• Prisons

Crowded Places

• Main Shopping Centres
• Significant Football Grounds/Stadia
• Major events/festivals

Military

• Significant Military Bases
• MACR sites

Other

• COMAH Sites
• Universities - particularly those with CBR assets
• Significant visitor attractions [e.g. significant hotels, golf courses, sporting attractions, Concert venues]
• Major Sector IT Data Centres