Business Continuity of Critical Infrastructures for Safety and Security Incidents

Introduction

Critical infrastructures (CIs) are components of wide networks of technical infrastructures which support the daily activities of every nation and provide vital products and services. These services include distribution of natural gas, electricity, fuels, transportation services, water distribution and others.

CIs can be subjected to damage caused by natural hazards or man-made threats which can be amplified due to the networks that have been created between them and might result into disastrous cascading effects. Such incidents can potentially render entire cities unable to provide vital services and functions, while also threating the societal security and safety. Natural disasters such as the tsunami and earthquake which triggered the nuclear disaster in Fukushima Daiichi, the more recent wildfires in Greece 2018 and the Typhoon Jebi which hit Japan in 2018 were events of very high magnitude. Scientific research has also stressed the importance of the effects of natural hazards due to climate change with potentially devastating effects for the European CIs especially in sectors such as energy, transportation, water management (EU-CIRCLE, 2016). At the same time, the high value of CIs can attract man-made threats such as terrorism, aimed towards attracting the media, causing mass casualties and spreading fear, or antisocial behavior meant to apply political pressure.

Unfortunately, such events are difficult to predict and pinpoint and there is no solution which would create an absolute defense system against such hazards. As such, it is necessary for CI operators to establish and effective Business Continuity Plan (BCP) which will focus not on the absolute protection of an infrastructure, but on the timely response to adverse incidents or emergencies, in order to safeguard the infrastructure’s vital operations and assets from future disruptive events.

This chapter will discuss further the significance of the protection European CIs, the possible threats that they can be exposed to, and present an elaborate framework towards Business Continuity Planning based on literature, research and best practices for general application, independently of the infrastructures’ field of operations or the nature of hazards.

The objectives of this chapter are:

• 1.

  To increase the understanding of risk management concepts around the safety and security of Critical infrastructures.

• 2.

  To provide a comprehensive, elaborate and practical guide for Business Continuity Planning which will contribute to an effective emergency response

• 3.

  To raise the awareness of Critical Infrastructure stakeholders in regard to natural and man-made risks to which the European Critical Infrastructures may be exposed.

Background

The modern approach towards the protection of critical infrastructure against disasters (natural or man-made), is focused on a proactive strategic planning of an infrastructure in order to build resilience against hazards which may occur. Resilience enables an infrastructure (or organization) to respond to disruptions through its ability to absorb damage and adapt to adverse incidents, ensuring the continuation of its critical activities and the safety of its stakeholders. Resilience can be built through an elaborate Business Continuity Management approach (British Standards Institution [BSI], 2018b).

Business continuity (BC) refers to the ability of an organization to deliver goods and services at acceptable predefined levels after a disruptive incident (BSI, 2018b, p. 41). In general, disruptive threats against technical infrastructures, may include natural hazards, man-made disasters, terrorism, IT/IS incidents, disruption to supply chain, disruption to internal support services and others (Smith, 2012). Considering the above categories, a disruptive incident could be a fire outbreak which can cause physical damage to an infrastructure and threaten the safety of the personnel also affecting infrastructure’s supply chain, or it could involve a cyberattack targeting the IT systems of an organization which will cripple its operations and prevent delivery of services.