On March 28, 2020, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) issued an updated version of its “Essential Critical Infrastructure Workforce” guidelines, intended to help state, tribal, and other local officials decide what workers may need to continue to operate as usual when COVID-related “lockdown” or “stay at home” orders are in place.
The guidance, originally issued March 19, 2020, identifies functions that may be critical to public health and safety, as well as economic and national security, in 16 essential sectors:
Healthcare/public health,
Law enforcement, public safety, and other first responders,
Food and agriculture,
Energy,
Water and wastewater,
Transportation and logistics,
Public works and infrastructure support services,
Communications and information technology,
Other community- or government-based operations and essential functions,
Hazardous materials,
Financial services,
Chemical,
Defense industrial base,
Commercial facilities,
Residential/shelter facilities and services, and
Hygiene products and services.
For critical manufacturing sectors, the new guidance clarifies that suppliers, supply chains, and their workers are also deemed essential. In particular, the guidance covers workers necessary for manufacturing, and “workers needed to maintain the continuity of these manufacturing functions and associated supply chains.”
CISA issued the original guidance after President Trump issued guidelines on March 16, 2020, stating that those who work in a critical infrastructure industry have a special responsibility to maintain their normal work schedule. While the CISA list is detailed and contains many functions within each sector that may be critical, the agency recognizes that it is overly inclusive and emphasizes that it is intended to be advisory. Importantly, many state “lockdown” and “shutdown” orders rely on the CISA guidelines to help define essential industries and workers.
The CISA 2.0 guidance is based on nine key principles, the first of which is that response to the COVID-19 pandemic is “locally executed, state managed, and federally supported.” Government officials must use their own judgment when issuing directives in their communities, and critical infrastructure owners and operators are expected to do the same when they make decisions about whether and how to allocate workforce onsite and which processes to prioritize.
As expected, the new guidance states that any functions that can be carried out remotely should be done so. In-person work should focus on core business activities, and businesses should employ strategies such as designing shifts to separate essential critical infrastructure staff. When making decisions about which workers need to be onsite, business leads may find it helpful to consult the nine key principles that precede the list.