SED Convenings Survey – Nuclear

OMB CONTROL NUMBER: 1670-XXXX

OMB EXPIRATION DATE: 00/00/20XX

SED Convenings Survey – Nuclear

Thank you for participating in this important survey.

The Cybersecurity and Infrastructure Security Agency (CISA) has partnered with Team Guidehouse to conduct an evaluation to learn more about stakeholder engagements and satisfaction with CISA’s convening activities, products and services. Convening activities refer to guidance and expertise, as well as councils, working groups, roundtables, and other types of collaborative activities. Products and services refer to things like publications, emails, and webinars. Answers to questions may reflect your organization’s experiences with CISA, as well as your personal perspective as a member of that organization.  

 

The survey takes approximately 10 minutes to complete. Your participation is voluntary but important. You can skip any questions you do not want to answer, and you can decide not to participate at any time without consequence. The purpose of the survey is to learn your thoughts on CISA’s convening activities, and whether they help improve risk reduction in your organization. 

 

Your answers are confidential. Your name or your organization’s name will not be identified in our reports. Findings will be presented in aggregate form to CISA. All data from the survey will be destroyed after the report is complete. This survey is intended to help inform and improve CISA’s products and services. We will follow all CISA policies on handling data, and only a small number of members of our team will see the individual responses. 

 

CISA identified you as a key stakeholder, but if you do not believe you are the appropriate person from your organization to complete this survey, please email betsy.flores@associates.cisa.dhs.gov. Please o not forward this email.  

 

If you have any questions about the survey or your participation, feel free to contact Betsy Flores at 609-750-2018 or betsy.flores@associates.cisa.dhs.gov.  

By pressing “next” you are consenting to participate in the survey.

 

SED Convenings Evaluation Privacy Act Statement:

Pursuant to 5 U.S.C. § 552a(e)(3), this Privacy Act Statement serves to inform you of the following concerning the collection of the information on this form.

Authority: Collection of the information solicited on this form is authorized by Homeland Security Act § 871 (6 U.S.C. § 451), 71 FR 14930 (Mar. 24, 2006), and Executive Order 12862 “Setting Customer Service Standards” 58 FR 48255 (Sept. 11, 1993) authorize the collection of this information.

Purpose: The purpose of this survey is to assess the extent to which CISA’s convening activities, products, and services 1) provide timely, accurate, and useful information about security and risk resilience, including opportunities for meaningful information exchange between CISA and sector stakeholders; and 2) are accessed and used by stakeholders to enhance their abilities to respond to critical threats and improve strategic decision-making and risk reduction. This survey also aims to increase understanding of the best practices for getting stakeholders engaged and building trusted relationships. This survey is intended to help inform and improve CISA’s activities, products, and services.

Routine Uses: The information solicited on this form may be disclosed as generally permitted under 5 U.S.C. §552a(b) of the Privacy Act of 1974, as amended. This includes using the information, as necessary and authorized by the routine uses published in DHS/ALL-002 - Department of Homeland Security (DHS) Mailing and Other Lists System of Records (November 25, 2008, 73 FR 71659).

Consequences of Failure to Provide Information: Providing this information is voluntary.; however, failure to provide any of the information requested may prevent CISA from obtaining the information needed to evaluate the effectiveness of CISA’s convening activities with Stakeholder engagements.

Paperwork Reduction Act

The public reporting burden to complete this information collection is estimated at 10 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and the completing and reviewing the collected information.  The collection of information is voluntary. An agency may not conduct or sponsor, and a person is not required to respond to a collection of information unless it displays a currently valid OMB control number and expiration date.  Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to DHS’s Office of the Chief Procurement Officer, Office of Acquisition Policy and Legislation, 7^th and D Street, Washington, D.C. ATTN: PRA [OMB Control No. 1601-XXXX].

Section A. Organization Characteristics

S1. This survey will be for individuals who are the representatives for their organization as well as those who are the representatives for an association.

Please indicate whether you are from an organization (a company with employees) or from association (an organization or association with member organizations).

• organization

• association

The first questions are about you and your [organization/association].

A1. Approximately, how many employees does your [organization/association] have?

• 1- 100

• 101 – 999

• 1000 or more

A2. What classification best describes your [organization/association]?

• Public Sector – GO TO A2a

• Private Sector - GO TO A2b

• Non-Governmental Organization – GO TO A3a

• Other (please specify) _____________________________ - GO TO A3a

A2a. IF PUBLIC SECTOR - Which of the following best describes your public sector [organization/association]? Select all that apply.

 Federal

 State

 Local

 Tribal

 Territorial

A2b. IF PRIVATE SECTOR - Which of the following best describes your private sector [organization/association]? Select all that apply.

 Medical

 Industrial

 Academic

 Nuclear reactors, materials, and waste

 Transportation

 Power

• Non-Governmental Organization

• Other (please specify) _____________________________

A3a. Is your [organization/association] currently a member of the Nuclear Sector or Government Coordinating Council (SCC or GCC)?

• Yes – GO TO A3b

• No – GO TO A4c

• Don’t know – GO TO A4a

A3b. IF YES - How long has your [organization/association] been a member of the Nuclear

Sector or Government Coordinating Council? Your best guess is fine.

| | | YEARS

| | | MONTHS

A4a. Are you a representative to CISA for your [organization/association]?

• Yes – GO TO A4b

• No – GO TO A5

A4b. IF YES - How long have you been a representative to CISA for your

[organization/association]?

| | | YEARS

| | | MONTHS

GO TO A5

IF A3a = NO

A4c. Why is your organization no longer a member of the Nuclear SCC or GCC?

____________________________________________________________

____________________________________________________________

____________________________________________________________

A5. Please indicate other sectors for which your [organization/association] is a member.

Select all that apply

 Chemical

 Commercial Facilities

 Communications

 Critical Manufacturing

 Dams

 Defense Industrial Base

 Emergency Services

 Energy

 Financial Services

 Food and Agriculture

 Government Facilities

 Healthcare and Public Health

 Information Technology

 Transportation Systems

 Water and Wastewater Systems

 Not a member of any other sector

Section B. Satisfaction with CISA’s Convening Activities, Products, and Services

B1. The next questions are about the convening activities, products, and services of CISA and how useful they are to your [organization/association].

How often does your [organization/association] participate in sector-specific Council meetings?

 Monthly

 Quarterly

 Bi-Annually

 Annually

 Other timeframe (please specify):_________________________________________

 My [organization/association] has not participated in Council meetings

B1a. IF HAS NOT PARTICIPATED: Why has your [organization/association] not participated in sector-specific Council meetings?

_________________________________________________________

_________________________________________________________ – SKIP TO B2

B1b. Do you think that the frequency of sector-specific Council meetings is too frequent, too seldom, or about right?

• Too frequent

• Too seldom

• The right amount of time

B2. How often does your [organization/association] participate in sector-specific working groups?

 Monthly

 Quarterly

 Bi-Annually

 Annually

 Other timeframe (please specify):_________________________________________

 My organization has not participated in working groups

B2a. IF HAS NOT PARTICIPATED: Why has your [organization/association] not participated in sector-specific working groups?

_________________________________________________________

_________________________________________________________ – SKIP TO B3

B2b. Do you think that the frequency of sector-specific working groups is too frequent, too seldom, or about right?

• Too frequent

• Too seldom

• The right amount of time

B3. How often does your [organization/association] participate in threat briefings?

 Monthly

 Quarterly

 Bi-Annually

 Annually

 Other timeframe (please specify):_________________________________________

 N/A My organization has not participated in any threat briefings – SKIP TO B4

B3a. Do you think that frequency of threat briefings is too frequent, too seldom or about right?

 Too frequent

 Too seldom

 The right amount of time

B4. How often do you receive emails from CISA Nuclear Sector?

Daily

Weekly

Bi-Weekly

 Monthly

Other timeframe (please specify):_________________________________________

N/A – I do not receive any emails – SKIP TO B5

B4a. Do you think that the frequency of these emails is too frequent, too seldom, or about right?

Too frequent

 Too seldom

 The right amount of time

B5. Thinking about the various methods of collaboration with CISA as well as the products and services

they provide, please indicate how helpful you found each of the following to improve strategic decision-making and risk reduction:

	Not at all helpful	A little helpful	Somewhat helpful	Very Helpful	Extremely Helpful	Don’t know or N/A
Sector-specific Council Meetings						
GCC/SCC Working Groups						
Digital Communications (such as emails)						
Threat Briefings						
Quarterly Joint GCC/SCC Meeting						
Critical Infrastructure Threat Information Sharing Framework						
Nuclear Sector Cybersecurity Framework Implementation Guidance						
The DHS Hometown Security Initiative						
Critical Infrastructure Training (such as web-based security awareness training, workplace security, active shooter preparedness, insider threat)						
Counter-Improvised Explosive Device (IED) Training & Awareness						
National Cyber Awareness System						
Homeland Security Information Network (HSIN)						

B6. Have you used other products or services provided by CISA, or attended other meetings with them that has not yet been mentioned?

 Yes

 No – SKIP TO B7

B6a. IF YES: What are those products, services, or meetings?

__________________________________________________________________________

__________________________________________________________________________

B6b. How helpful have those been?

__________________________________________________________________________

__________________________________________________________________________

B7_1. IF ASSOCIATION: The next questions are about actions that member organizations have taken to improve risk reduction as a result of CISA’s convening activities*.

*By convening activities, we mean CISA’s guidance and expertise, as well as councils, working groups, roundtables, and other types of collaborative activities.

Recognizing that you may not be directly involved in these changes but based on what you know, please indicate how many organizations have taken the following actions to improve risk reduction as a result of CISA’s convening activities.

Action	No member orgs	Some member orgs	Most member orgs	All member orgs	Don’t know/Can’t say
Updated policies or plans					
Created or updated an emergency action plan					
Created new positions or functions within the organization					
Introduced new security measures/processes					
Implemented new training courses or programs					
Made some other change (please specify:)___________________					

B7_2. IF ORGANIZATION: What action(s) has your organization taken to improve risk reduction as a result of CISA’s convening activities?

Select all that apply.

□ Updated policies or plans

□ Created or updated an emergency action plan

□ Created new positions or functions within the organization

□ Introduced new security measures or processes

□ Implemented new training courses or programs

□ Other (Please specify) _____________________________

B7a. IF B7_1a = Some, Most, or All OR IF B7_2 = Updated policies or plans: What kind of existing policies or plans [has your organization/have member organizations] updated?

Select all that apply.

□     Cyber security/safety

□     Physical security/safety (including security screening)

□     Insider threat (physical or cyber)

□     Active assailant (including active shooter)

□     Bag search

□     Business and supply chain continuity

□     Information sharing/communications

□     Natural and man-made hazards and emergencies

□     Other (please specify): _____________________________

B7b. IF B7_1d = Some, Most, or All OR IF B7_2 = Introduced new security measures or processes: What kind of new security measures or processes [has your organization/have member organizations] introduced?

Select all that apply.

□     Worker onboarding/offboarding

□    Annual employee cyber and physical security training

□    Employee/visitor identification usage and program (e.g., badges, PIV cards, etc.)

□    Employee equipment inventory

□     Visitor check-in/check-out/escort

□     Vendor/client clearance

□     Multifactor authentication usage

□     Cyber hygiene enhancements

□     Other (please specify): _____________________________

B8. Since becoming a Nuclear Sector member, how much would you say CISA’s convening activities, products, and services have added value to your [organization’s/member organizations’] cyber security? Would you say….

 Not at all

 Slightly

 Moderately

 Significantly

 Not sure/Can’t say

B8a. IF B8=MODERATELY OR SIGNIFICANTLY: How has CISA’s convening activities, products, and services added value to [your organization’s/ member organizations’] cyber security?

Select all that apply.

□    Increased knowledge, understanding, and awareness about cyber security and impacts

□    Timely and useful guidance and information about best practices

□    Identification of gaps and need for additional information

□    Awareness of useful support, tools, and resources (e.g., SRMA team, CSA presence, vulnerability assessments) that are available at no cost

□    Take-up/utilization of useful support, tools, and resources that are available at no cost

□    Networking opportunities/useful contacts

□    Information exchange/sharing

□    Other (please specify): _____________________________

B9. Since becoming a Nuclear Sector member, how much would you say CISA’s convening activities, products, and services have added value to your [organization’s/member organizations’] physical security? Would you say….

Not at all

Slightly

Moderately

 Significantly

 Not sure/Can’t say

B9a. IF B9=MODERATELY OR SIGNIFICANTLY: How has CISA’s convening activities, products, and services added value to [your organization’s/ member organizations’] physical security?

Select all that apply.

□   Increased knowledge, understanding, and awareness about physical security and impacts

□   Timely and useful guidance and information about best practices

□   Identification of gaps and need for additional information

□   Awareness of useful support, tools, and resources (e.g., SRMA team, PSA presence, physical assessments) that are available at no cost

□   Take-up/utilization of useful support, tools, and resources that are available at no cost

□   Networking opportunities/useful contacts

□   Information exchange/sharing

□   Other (please specify): _____________________________

B10. How much has being a member of the Nuclear Sector added a reputational value to your [organization/member organizations] that positively impacts your relationships with your clients?

Not at all

Slightly

Moderately

 Significantly

Section C. Stakeholder Relationship

The next questions are about the relationship between your [association/organization] and CISA. We know

there may be others at your [organization/association] who are engaged with CISA, but we would like to

know your perspective.

C1. How much do you agree with the following statements relating to your personal engagement with CISA in general…

Statement	Strongly disagree	Disagree	Neither agree nor disagree	Agree	Strongly agree
CISA openly shares all information, motives, and choices in straightforward and plain language					
CISA creates quality products, services, and/or experiences.					
CISA consistently delivers on promises and experiences.					
I am kept informed about issues that are important to my [organization/association].					

C2. When responding to the next questions, please focus on your relationship with your contacts from the Nuclear Sector only, rather than from CISA generally.

Thinking about the following key attributes of engagement, how much do you agree or disagree with the following statements…

Statement	Strongly disagree	Disagree	Neither agree nor disagree	Agree	Strongly agree
My CISA Nuclear Sector contacts follow through (do what they say they will do).					
My opinion is valued and listened to.					
We work together to address and solve problems and issues.					
The Nuclear Sector team is easy to engage with.					
Our relationship is based on clear objectives.					
The Nuclear Sector team engages proactively with me.					
The Nuclear Sector team is consistent in its messages and behaviors					

C3. Is there anything else you want to share about your relationship with CISA staff from the Nuclear Sector, or about their convening activities and/or products and services?

____________________________________________________________________________________

____________________________________________________________________________________

___________________________________________________________________________________

Thank you for your participation! We may be contacting you for an in-depth interview about your experience as a member of the Nuclear Sector. As with this survey, responses to the in-depth interview will be confidential. We appreciate your continued partnership in defending against today’s threats and collaboration to build more secure and resilient infrastructure for the future.

DRAFT