On Saturday, March 28, 2020, CISA updated its guidance regarding the essential critical infrastructure workforce and ensuring community and national resilience during the COVID-19 pandemic (March 28 Guidance). The new guidance contains an updated version of the Essential Critical Infrastructure Workforce list originally issued by CISA on March 19, 2020 (March 19 Guidance). The new version of the list expands both the number of sectors and the categories of essential workers within many sectors. These changes are significant because many states and local jurisdictions have issued shelter-in-place and stay at home orders designed to combat the spread of COVID-19 that have explicitly incorporated CISA's guidance in determining which businesses are exempt from discontinuing on-site operations.
CISA's list is intended to support state, local, territorial and tribal officials as they work to protect their communities while ensuring continuity of functions critical to daily life, public health and safety, and economic and national security. As CISA director Christopher C. Krebs emphasized in his accompanying cover memorandum, the list is advisory in nature and not a federal directive. Nor is it intended to be the exclusive list of essential sectors, workers and functions that should continue during the COVID-19 response across all jurisdictions. Individual jurisdictions are encouraged to use their own judgment and to add or subtract essential workforce categories based on their particular needs. In the wake of this updated guidance, we expect many states to update their existing orders and guidance.
I. CISA's Essential Critical Infrastructure Workforce List For COVID-19 Response
On March 19, 2020, CISA released an "initial" Essential Critical Infrastructure Workforce list to help guide state and local officials responding to COVID-19. Both Director Krebs' March 19 memorandum and the press release accompanying the March 19 Guidance quoted President Donald Trump as stating, "If you work in a critical infrastructure industry, as defined by the Department of Homeland Security, such as healthcare services and pharmaceutical and food supply, you have a special responsibility to maintain your normal work schedule."
The March 19 Guidance identified essential workers in 14 critical infrastructure sectors: (1) Chemical; (2) Communications and Information Technology; (3) Critical Manufacturing; (4) Public Works; (5) Defense Industrial Base; (6) Law Enforcement, Public Safety, First Responders; (7) Energy; (8) Financial Services; (9) Food and Agriculture; (10) Other Community-Based Government Operations and Essential Functions; (11) Healthcare/Public Health; (12) Hazardous Materials; (13) Transportation and Logistics; and (14) Water and Wastewater.1
As noted above, on March 28, 2020, CISA updated its guidance and the associated Essential Critical Infrastructure Workforce list. Mr. Krebs' updated memorandum did not contain the same presidential quote, and instead noted in bold print, as the March 19 Guidance did, that the list is "advisory in nature. It is not, nor should it be considered, a federal directive or standard." Relatedly, the guidance explains that the list is intended to be "overly inclusive reflecting the diversity of industries across the United States." The memorandum and guidance further note that CISA will continue to accept feedback and evolve the list in response to stakeholder feedback.
The March 28 Guidance added three critical sectors to the list contained in the March 19 Guidance: (1) Commercial Facilities, (2) Residential/Shelter Facilities, and (3) Hygiene Products and Services. It also broadened certain sectors. For example, the "Public Works" sector is now titled "Public Works and Infrastructure Support Services."
The Essential Critical Infrastructure Workforce list identifies categories of workers within each sector. Each of the lists has been expanded since the March 19 Guidance. For example, the Financial Services list now includes three additional categories of workers, including "[w]orkers who are needed to maintain orderly market operations to ensure the continuity of financial transactions and services." We have included, as an exhibit to this alert, a comparison showing changes made in the March 28 list from the list issued on March 19.
Importantly, CISA identifies a list of key principles that informed its list. These principles include, for example, that workers should be encouraged to work remotely when possible, in-person nonmandatory activities should be delayed until the resumption of normal operations, and, to the extent remote work is not possible, businesses should enlist strategies to reduce the likelihood of spreading the disease, such as offsetting shift hours and social distancing.
II. Looking Ahead
Since the March 19 Guidance was issued, a majority of states and many local jurisdictions have directed certain businesses to close on-site operations and/or to transition to teleworking arrangements. Many of these orders delineate essential and nonessential businesses and workers and recognize the need for essential businesses and workers to continue some on-site operations while still taking appropriate steps to protect public health and safety, such as employing social distancing protocols. In defining categories of essential businesses or workers, many states have explicitly incorporated the March 19 Guidance, directed that their orders should not be read to conflict with the March 19 Guidance, or appear to have used the March 19 Guidance or CISA-identified critical infrastructure sectors as a starting point for their own delineation of essential businesses and workers.
As noted above, both the March 19 Guidance and March 28 Guidance are merely advisory—neither is a federal directive. We expect state and local governments may update their stay-at-home and shelter-in-place orders and related guidance in the wake of the revised CISA guidance. Businesses with operations in jurisdictions with orders that reference the CISA guidance should closely review their current policies and procedures to gauge whether they remain in compliance with a given state's order, or whether the new March 28 Guidance may give them more flexibility to resume certain on-site operations.
Footnote
1 Federal law defines "critical infrastructure" broadly as "assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." 42 U.S.C. § 5195c(e). Prior to the COVID-19 pandemic and pursuant to Presidential Policy Directive 21 (Feb. 12, 2013), the Department of Homeland Security defined 16 critical infrastructure sectors. They include (1) Chemical Sector; (2) Commercial Facilities Sector; (3) Communications Sector; (4) Critical Manufacturing Sector; (5) Dams Sector; (6) Defense Industrial Base Sector; (7) Emergency Services Sector; (8) Energy Sector; (9) Financial Services Sector; (10) Food and Agriculture Sector; (11) Government Facilities Sector; (12) Healthcare and Public Health Sector; (13) Information Technology Sector; (14) Nuclear Reactors, Materials, and Waste Sector; (15) Transportation Systems Sector; and (16) Water and Wastewater Systems Sector. CISA's website provides brief descriptions of each sector as well as sector-specific plans, which further define the sectors and set forth risk management plans.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
