CHAPTER 2: DESCRIPTION OF SERVICE AND SERVICE LEVEL

‘Critical infrastructure is vitally important to all of us because it provides the necessities: water and food; the electricity and gas; the telecommunications and broadcasting services that keep us in touch and help us to conduct our business; the health services that keep us alive; the banking and finance system that keeps our economy running; and the transport system that gets us – and the goods we need – from A to B. ’⁵ – George Brandis

Preparing the list of critical infrastructure services described in the previous chapter is the first step. However, the list alone is not enough for planning the activities that follow. It is also important to describe the critical infrastructure services. How and on what basis can we say that a critical infrastructure service is functioning? How do we know what a specific critical service is and what characterises it? If we don’t know what a functioning service looks like, then it’s impossible for us to objectively assess whether or not it is functioning. Does a service function as needed?

Every critical service should be described. The description of a critical infrastructure service should allow the service provider, consumers and other stakeholders to understand what can and cannot be expected from the specific service. All critical infrastructure services can be characterised with different criteria and parameters. The requirements for and service level of a critical infrastructure service should also be determined. Power coming from the grid always has the same tension and frequency, and we’re used to this. It’s possible that these parameters have been determined in regulations. Power supply companies enter into contracts with their clients. These contracts or the general conditions of services may also contain other aspects that describe the service and service level. They might contain the number to call in the event of faults, determine how quickly the company has to react to faults, how quickly faults have to be eliminated, etc. Sometimes they state the length of a power cut from which the client is not charged for the service. In these cases, we can say that a service level has been determined between the service provider and the client. However, the service level of a critical infrastructure service should be determined from the viewpoint of the state.

It’s likely that there are many services that have not been adequately described and for which the necessary service level has not been determined. Or, if a service level has been determined, it was not done in consideration of the fact that the service is a critical infrastructure service and its consumers may have higher expectations regarding the continuous operation of the service.

These parameters should be determined for every critical infrastructure service:

• maximum tolerable downtime

• recovery time objective.

Maximum tolerable downtime is the downtime that an organisation, specific sector or country can tolerate. ‘Maximum tolerable’ can be defined at business, sector or country level and these could be different. A critical infrastructure service provider should follow the shortest defined downtime.

Recovery time objective is the defined time during which systems and services should be brought up and running.

Service-specific indicators that characterise the operating level of the service must be defined for the majority of services: a minimal quantity of calls in a mobile communications network, the quantity of banknotes withdrawn from an ATM in a certain unit of time, the guaranteed minimal water pressure at specific measurement points, the minimal number of passengers served by a harbour in a certain unit of time, etc.

The above is the so-called primary requirement in the process of building a critical infrastructure protection system. We should then think about the operational needs of critical services in the event of crises of different severity and define them if possible. What are the critical infrastructure services that should definitely work in the event of a crisis and at what level should they operate?

Lesson 2: Describe the critical infrastructure service and determine its service level.