prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: The Federal Reserve's (the Fed's) responsibilities as the nation's central bank fall into four main categories: monetary policy, provision of emergency liquidity through the lender of last resort function, supervision of certain types of banks and other financial firms for safety and soundness, and provision of payment system services to financial firms and the government  Congress has delegated responsibility for monetary policy to the Fed, but retains oversight responsibilities to ensure that the Fed is adhering to its statutory mandate of "maximum employment, stable prices, and moderate long-term interest rates " The Fed has defined stable prices as a longer-run goal of 2% inflation—the change in overall prices, as measured by the Personal Consumption Expenditures (PCE) price index  By contrast, the Fed states that "it would not be appropriate to specify a fixed goal for employment; rather, the Committee's policy decisions must be informed by assessments of the maximum level of employment, recognizing that such assessments are necessarily uncertain and subject to revision " Monetary policy can be used to stabilize business cycle fluctuations (alternating periods of economic expansions and recessions) in the short run, while it mainly affects inflation in the long run  The Fed's conventional tool for monetary policy is to target the federal funds rate —the overnight, interbank lending rate  This report provides an overview of how monetary policy works and recent developments, a summary of the Fed's actions following the financial crisis, and ends with a brief overview of the Fed's regulatory responsibilities  In December 2008, in the midst of the financial crisis and the "Great Recession," the Fed lowered the federal funds rate to a range of 0% to 0 25%  This was the first time rates were ever lowered to what is referred to as the zero lower bound   The recession ended in 2009, but as the economic recovery consistently proved weaker than expected in the years that followed, the Fed repeatedly pushed back its time frame for raising interest rates  As a result, the economic expansion was in its seventh year and the unemployment rate was already near the Fed's estimate of full employment when it began raising rates on December 16, 2015  This was a departure from past practice—in the previous two economic expansions, the Fed began raising rates within three years of the preceding recession ending  Since then, the Fed has continued to raise rates in a series of steps to incrementally tighten monetary policy  The Fed raised rates once in 2016, three times in 2017, and four times in 2018, by 0 25 percentage points each time  The Fed has stated that "some further gradual increases in     the federal funds rate" are necessary to fulfill its mandate  The Fed describes its plans as "data dependent," meaning they would be altered if actual employment or inflation deviate from its forecast  Although monetary policy is now less stimulative than it had been at the zero lower bound, the Fed is still adding stimulus to the economy as long as the federal funds rate is below what economists call the "neutral rate" (or the long-run equilibrium rate)  To illustrate, the federal funds rate is currently similar to the inflation rate, meaning that the real (i e , inflation-adjusted) federal funds rate is around zero  However, there is uncertainty as to what constitutes a neutral rate today  By historical standards, a zero real interest rate would be well below the neutral rate, but the neutral rate appears to have fallen following the financial crisis, so that current rates may be close to the neutral rate today  Typically, the Fed keeps interest rates below the neutral rate when the economy is operating below full employment, at neutral levels when the economy is near full employment, and above the neutral rate when the economy is at risk of overheating  Indeed, the Fed identifies this as one of its "three key principles of good monetary policy " Because of lags between changes in interest rates and their economic effects, in the past, the Fed has often preemptively changed its monetary policy stance before the economy reaches the state that the Fed is anticipating  In this business cycle, the Fed has maintained a (progressively less) stimulative monetary policy throughout the expansion, boosting economic activity  In one sense, this policy could be viewed as having successfully delivered on the Fed's mandated goals of full employment and stable prices  The unemployment rate has been below 5% since 2015 and is now lower than the rate believed to be consistent with full employment  Other labor market measures are also consistent with full employment, with the possible exception of the still-low labor force participation rate  Economic theory posits that lower unemployment will lead to higher inflation in the short run, but inflation has not proven responsive to lower unemployment in recent years  After remaining persistently below the Fed's 2% target from mid-2012 to early 2018 as measured by core PCE, inflation has remained around 2% in 2018 as measured by headline or core PCE  Economic growth has also picked up beginning in the second quarter of 2017, after being persistently low by historical standards throughout the expansion  Contributing to the 2018 growth acceleration, a more expansionary fiscal policy (larger structural budget deficit) added more stimulus to the economy in the short run  Two notable policy changes contributing to fiscal stimulus in 2018 were the 2017 tax cuts ( P L  115-97 ) and the boost to discretionary spending in FY2018 and FY2019 agreed to in P L  115-123   The Fed did little to offset this fiscal stimulus, as the pace of monetary tightening in 2018 was only slightly faster than in 2017  Despite strong economic data (which is only available with a lag), the Fed announced in January 2019 that it would be "patient" before raising rates again in light of increased economic uncertainty and financial volatility  The Fed's intended policy path poses risks  If the Fed waits too long to raise rates again, the economy could overheat, resulting in high inflation and posing risk to financial stability  As an example of how overly stimulative monetary policy can lead to the latter, critics contend that the Fed contributed to the precrisis housing bubble by keeping interest rates too low for too long during the economic recovery starting in 2001  Critics see these risks as outweighing any marginal benefit associated with monetary stimulus when the economy is already so close to full employment  Raising rates more quickly would also provide more "headroom" for the Fed to lower rates more aggressively during the next economic downturn  The potential percentage point reduction in rates before hitting the zero bound is currently smaller than the rate cuts that the Fed has undertaken in past recessions  Alternatively, there is uncertainty about whether strong growth, low unemployment, inflation around 2%, and the generally benign economic environment will continue  Economic expansions do not "die of old age"; nevertheless, the current expansion is already the second longest on record and cannot last forever  The flattening of the yield curve (i e , long-term Treasury yields are similar to short-term Treasury yields) is seen by some as a warning signal that rates are too high  Although there is a risk of stimulative monetary policy causing the economy to overheat, there is also a risk that tightening too quickly could be harmful if the economy slows  Some critics would prefer clear evidence that inflation is above the Fed's target or financial conditions are unstable before the Fed raises rates again  Monetary policy refers to the actions the Fed undertakes to influence the availability and cost of money and credit to promote the goals mandated by Congress, a stable price level and maximum sustainable employment  Because the expectations of households as consumers and businesses as purchasers of capital goods exert an important influence on the major portion of spending in the United States, and because these expectations are influenced in important ways by the Fed's actions, a broader definition of monetary policy would include the directives, policies, statements, economic forecasts, and other Fed actions, especially those made by or associated with the chairman of its Board of Governors, who is the nation's central banker  The Fed's Federal Open Market Committee (FOMC) meets every six weeks to choose a federal funds target and sometimes meets on an ad hoc basis if it wants to change the target between regularly scheduled meetings  The FOMC is composed of the 7 Fed governors, the President of the Federal Reserve Bank of New York, and 4 of the other 11 regional Federal Reserve Bank presidents serving on a rotating basis  The Fed targets the federal funds rate to carry out monetary policy  The federal funds rate is determined in the private market for overnight reserves of depository institutions (called the federal funds market)  At the end of a given period, usually a day, depository institutions must calculate how many dollars of reserves they want or need to hold against their reservable liabilities (deposits)  Some institutions may discover a reserve shortage (too few reservable assets relative to those they want to hold), whereas others may have reservable assets in excess of their wants  These reserves can be borrowed and lent on an overnight basis in a private market called the federal funds market  The interest rate in this market is called the federal funds rate  If it wishes to expand money and credit, the Fed will lower the target, which encourages more lending activity and, thus, greater demand in the economy  Conversely, if it wishes to tighten money and credit, the Fed will raise the target  The federal funds rate is linked to the interest rates that banks and other financial institutions charge for loans  Thus, whereas the Fed may directly influence only a very short-term interest rate, this rate influences other longer-term rates  However, this relationship is far from being on a one-to-one basis because longer-term market rates are influenced not only by what the Fed is doing today, but also by what it is expected to do in the future and by what inflation is expected to be in the future  This fact highlights the importance of expectations in explaining market interest rates  For that reason, a growing body of literature urges the Fed to be very transparent in explaining what its policy is, will be, and in making a commitment to adhere to that policy  The Fed has responded to this literature and is increasingly transparent in explaining its policy measures and what these measures are expected to accomplish  The Federal Reserve uses two methods to maintain its target for the federal funds rate: The Fed can also change the federal funds rate by changing reserve requirements, which specify what portion of customer deposits (primarily checking accounts) banks must hold as vault cash or on deposit at the Fed  Thus, reserve requirements affect the liquidity available within the federal funds market  Statute sets the numerical levels of reserve requirements, although the Fed has some discretion to adjust them  Currently, banks are required to hold 0% to 10% of customer deposits that qualify as net transaction accounts in reserves, depending on the size of the bank's deposits  This tool is used rarely—the percentage was last changed in 1992  Each of these tools works by altering the overall liquidity available for use by the banking system, which influences the amount of assets these institutions can acquire  These assets are often called credit because they represent loans the institutions have made to businesses and households, among others  The Fed's control over monetary policy stems from its exclusive ability to alter the money supply and credit conditions more broadly  The Fed directly controls the monetary base , which is made up of currency (Federal Reserve notes) and bank reserves  The size of the monetary base, in turn, influences broader measures of the money supply, which include close substitutes to currency, such as demand deposits (e g , checking accounts) held at banks  The Fed's definition of monetary policy as the actions it undertakes to influence the availability and cost of money and credit suggests two ways to measure the stance of monetary policy  One is to look at the cost of money and credit as measured by the rate of interest relative to inflation (or inflation projections), and the other is to look at the growth of money and credit itself  Thus, it is possible to look at either interest rates or the growth in the supply of money and credit in coming to a conclusion about the current stance of monetary policy—that is, whether it is expansionary (adding stimulus to the economy), contractionary (slowing economic activity), or neutral  During the high inflation experience of the 1970s the Fed placed greater emphasis on money supply growth, but since then, most central banks including the Fed have preferred to formulate monetary policy in terms of the cost of money and credit rather than in terms of their supply  The Fed conducts monetary policy by focusing on the cost of money and credit as proxied by the federal funds rate  A simple comparison of market interest rates over time as an indicator of changes in the stance of monetary policy is potentially misleading, however  Economists call the interest rate that is essential to decisions made by households and businesses to buy capital goods the real interest rate  It is often proxied by subtracting from the market interest rate the actual or expected rate of inflation  If inflation rises and market interest rates remain the same, then real interest rates have fallen, with a similar economic effect as if market rates (called nominal rates) had fallen by the same amount with a constant inflation rate  The federal funds rate is only one of the many interest rates in the financial system that determines economic activity  For these other rates, the real rate is largely independent of the amount of money and credit over the longer run because it is determined by the interaction of saving and investment (or the demand for capital goods)  The internationalization of capital markets means that for most developed countries the relevant interaction between saving and investment that determines the real interest rate is on a global basis  Thus, real rates in the United States depend not only on U S  national saving and investment but also on the saving and investment of other countries  For that reason, national interest rates are influenced by international credit conditions and business cycles  How do changes in short-term interest rates affect the overall economy? In the short run, an expansionary monetary policy that reduces interest rates increases interest-sensitive spending, all else equal  Interest-sensitive spending includes physical investment (i e , plant and equipment) by firms, residential investment (housing construction), and consumer-durable spending (e g , automobiles and appliances) by households  As discussed in the next section, it also encourages exchange rate depreciation that causes exports to rise and imports to fall, all else equal  To reduce spending in the economy, the Fed raises interest rates and the process works in reverse  An examination of U S  economic history will show that money- and credit-induced demand expansions can have a positive effect on U S  GDP growth and total employment  The extent to which greater interest-sensitive spending results in an increase in overall spending in the economy in the short run will depend in part on how close the economy is to full employment  When the economy is near full employment, the increase in spending is likely to be dissipated through higher inflation more quickly  When the economy is far below full employment, inflationary pressures are more likely to be muted  This same history, however, also suggests that over the longer run, a more rapid rate of growth of money and credit is largely dissipated in a more rapid rate of inflation with little, if any, lasting effect on real GDP and employment  Economists have two explanations for this paradoxical behavior  First, they note that, in the short run, many economies have an elaborate system of contracts (both implicit and explicit) that makes it difficult in a short period for significant adjustments to take place in wages and prices in response to a more rapid growth of money and credit  Second, they note that expectations for one reason or another are slow to adjust to the longer-run consequences of major changes in monetary policy  This slow adjustment also adds rigidities to wages and prices  Because of these rigidities, changes in the growth of money and credit that change aggregate demand can have a large initial effect on output and employment, albeit with a policy lag of six to eight quarters before the broader economy fully responds to monetary policy measures  Over the longer run, as contracts are renegotiated and expectations adjust, wages and prices rise in response to the change in demand and much of the change in output and employment is undone  Thus, monetary policy can matter in the short run but be fairly neutral for GDP growth and employment in the longer run  In societies in which high rates of inflation are endemic, price adjustments are very rapid  During the final stages of very rapid inflations, called hyperinflation, the ability of more rapid rates of growth of money and credit to alter GDP growth and employment is virtually nonexistent, if not negative  Either fiscal policy (defined here as changes in the structural budget deficit, caused by policy changes to government spending or taxes) or monetary policy can be used to alter overall spending in the economy  However, there are several important differences to consider between the two  First, economic conditions change rapidly, and in practice monetary policy can be more nimble than fiscal policy  The Fed meets every six weeks to consider changes in interest rates and can call an unscheduled meeting any time  Large changes to fiscal policy typically occur once a year at most  Once a decision to alter fiscal policy has been made, the proposal must travel through a long and arduous legislative process that can last months before it can become law, whereas monetary policy changes are made instantly  Both monetary and fiscal policy measures are thought to take more than a year to achieve their full impact on the economy due to pipeline effects  In the case of monetary policy, interest rates throughout the economy may change rapidly, but it takes longer for economic actors to change their spending patterns in response  For example, in response to a lower interest rate, a business must put together a loan proposal, apply for a loan, receive approval for the loan, and then put the funds to use  In the case of fiscal policy, once legislation has been enacted, it may take some time for authorized spending to be outlayed  An agency must approve projects and select and negotiate with contractors before funds can be released  In the case of transfers or tax cuts, recipients must receive the funds and then alter their private spending patterns before the economy-wide effects are felt  For both monetary and fiscal policy, further rounds of private and public decisionmaking must occur before multiplier or ripple effects are fully felt  Second, monetary policy is determined based only on the Fed's mandate, whereas fiscal policy is determined based on competing political goals  Fiscal policy changes have macroeconomic implications regardless of whether that was policymakers' primary intent  Political constraints have prevented increases in budget deficits from being fully reversed during expansions  Over the course of the business cycle, aggregate spending in the economy can be expected to be too high as often as it is too low  This means that stabilization policy should be tightened as often as it is loosened, yet increasing the budget deficit has proven to be much more popular than implementing the spending cuts or tax increases necessary to reduce it  As a result, the budget has been in deficit in all but five years since 1961, which has led to an accumulation of federal debt that gives policymakers less leeway to potentially undertake a robust expansionary fiscal policy, if needed, in the future  By contrast, the Fed is more insulated from political pressures, as discussed in the previous section, and experience shows that it is willing to raise or lower interest rates  Third, the long-run consequences of fiscal and monetary policy differ  Expansionary fiscal policy creates federal debt that must be serviced by future generations  Some of this debt will be "owed to ourselves," but some (presently, about half) will be owed to foreigners  To the extent that expansionary fiscal policy crowds out private investment, it leaves future national income lower than it otherwise would have been  Monetary policy does not have this effect on generational equity, although different levels of interest rates will affect borrowers and lenders differently  Furthermore, the government faces a budget constraint that limits the scope of expansionary fiscal policy—it can only issue debt as long as investors believe the debt will be honored, even if economic conditions require larger deficits to restore equilibrium  Fourth, openness of an economy to highly mobile capital flows changes the relative effectiveness of fiscal and monetary policy  Expansionary fiscal policy would be expected to lead to higher interest rates, all else equal, which would attract foreign capital looking for a higher rate of return, causing the value of the dollar to rise  Foreign capital can only enter the United States on net through a trade deficit  Thus, higher foreign capital inflows lead to higher imports, which reduce spending on domestically produced substitutes and lower spending on exports  The increase in the trade deficit would cancel out the expansionary effects of the increase in the budget deficit to some extent (in theory, entirely if capital is perfectly mobile)  Expansionary monetary policy would have the opposite effect—lower interest rates would cause capital to flow abroad in search of higher rates of return elsewhere, causing the value of the dollar to fall  Foreign capital outflows would reduce the trade deficit through an increase in spending on exports and domestically produced import substitutes  Thus, foreign capital flows would (tend to) magnify the expansionary effects of monetary policy  Fifth, fiscal policy can be targeted to specific recipients  In the case of normal open market operations, monetary policy cannot  This difference could be considered an advantage or a disadvantage  On the one hand, policymakers could target stimulus to aid the sectors of the economy most in need or most likely to respond positively to stimulus  On the other hand, stimulus could be allocated on the basis of political or other noneconomic factors that reduce the macroeconomic effectiveness of the stimulus  As a result, both fiscal and monetary policy have distributional implications, but the latter's are largely incidental whereas the former's can be explicitly chosen  In cases in which economic activity is extremely depressed, monetary policy may lose some of its effectiveness  When interest rates become extremely low, interest-sensitive spending may no longer be very responsive to further rate cuts  Furthermore, interest rates cannot be lowered below zero so traditional monetary policy is limited by this "zero lower bound " In this scenario, fiscal policy may be more effective  As is discussed in the next section, some argue that the U S  economy experienced this scenario following the recent financial crisis  Of course, using monetary and fiscal policy to stabilize the economy are not mutually exclusive policy options  But because of the Fed's independence from Congress and the Administration, the two policy options are not always coordinated  If Congress and the Fed were to choose compatible fiscal and monetary policies, respectively, then the economic effects would be more powerful than if either policy were implemented in isolation  For example, if stimulative monetary and fiscal policies were implemented, the resulting economic stimulus would be larger than if one policy were stimulative and the other were neutral  Alternatively, if Congress and the Fed were to select incompatible policies, these policies could partially negate each other  For example, a stimulative fiscal policy and contractionary monetary policy may end up having little net effect on aggregate demand (although there may be considerable distributional effects)  Thus, when fiscal and monetary policymakers disagree in the current system, they can potentially choose policies with the intent of offsetting each other's actions  Whether this arrangement is better or worse for the economy depends on what policies are chosen  If one actor chooses inappropriate policies, then the lack of coordination allows the other actor to try to negate its effects  When the United States experienced the worst financial crisis since the Great Depression, the Fed undertook increasingly unprecedented steps in an attempt to restore financial stability  These steps included reducing the federal funds rate to the zero lower bound, providing direct financial assistance to financial firms, and "quantitative easing " These unconventional policy decisions continue to have consequences for monetary policy today, as the Fed embarks on monetary policy "normalization " The bursting of the housing bubble led to the onset of a financial crisis that affected both depository institutions and other segments of the financial sector involved with housing finance  As the delinquency rates on home mortgages rose to record numbers, financial firms exposed to the mortgage market suffered capital losses and lost access to liquidity  The contagious nature of this development was soon obvious as other types of loans and credit became adversely affected  This, in turn, spilled over into the broader economy, as the lack of credit soon had a negative effect on both production and aggregate demand  In December 2007, the economy entered a recession  As the housing slump's spillover effects to the financial system, as well as its international scope, became apparent, the Fed responded by reducing the federal funds target and the discount rate  Beginning on September 18, 2007, and ending on December 16, 2008, the federal funds target was reduced from 5 25% to a range between 0% and 0 25%, where it remained until December 2015  Economists call this the zero lower bound to signify that once the federal funds rate is lowered to zero, conventional open market operations cannot be used to provide further stimulus  The Fed attempted to achieve additional monetary stimulus at the zero bound through a pledge to keep the federal funds rate low for an extended period of time, which has been called forward guidance or forward commitment   The decision to maintain a target interest rate near zero was unprecedented  First, short-term interest rates have never before been reduced to zero in the history of the Federal Reserve  Second, the Fed waited much longer than usual to begin tightening monetary policy in the current recovery  For example, in the previous two expansions, the Fed began raising rates less than three years after the preceding recession ended  With liquidity problems persisting as the federal funds rate was reduced, it appeared that the traditional transmission mechanism linking monetary policy to activity in the broader economy was not working  Monetary authorities became concerned that the liquidity provided to the banking system was not reaching other parts of the financial system  As noted above, using only traditional monetary policy tools, additional monetary stimulus cannot be provided once the federal funds rate has reached its zero bound  To circumvent this problem, the Fed decided to use nontraditional methods to provide additional monetary policy stimulus  First, the Federal Reserve introduced a number of emergency credit facilities to provide increased liquidity directly to financial firms and markets  The first facility was introduced in December 2007, and several were added after the worsening of the crisis in September 2008  These facilities were designed to fill perceived gaps between open market operations and the discount window, and most of them were designed to provide short-term loans backed by collateral that exceeded the value of the loan  A number of the recipients were nonbanks that are outside the regulatory umbrella of the Federal Reserve; this marked the first time that the Fed had lent to nonbanks since the Great Depression  The Fed authorized these actions under Section 13(3) of the Federal Reserve Act, a seldom-used emergency provision that allowed it to extend credit to nonbank financial institutions and to nonfinancial firms as well  The Fed provided assistance through liquidity facilities, which included both the traditional discount window and the newly created emergency facilities mentioned above, and through direct support to prevent the failure of two specific institutions, American International Group (AIG) and Bear Stearns  The amount of assistance provided was an order of magnitude larger than normal Fed lending, as shown in Figure 1   Total assistance from the Federal Reserve at the beginning of August 2007 was approximately $234 million provided through liquidity facilities, with no direct support given  In mid-December 2008, this number reached a high of $1 6 trillion, with a near-high of $108 billion given in direct support  From that point on, it fell steadily  Assistance provided through liquidity facilities fell below $100 billion in February 2010, when many facilities were allowed to expire, and support to specific institutions fell below $100 billion in January 2011  The last loan from the crisis was repaid on October 29, 2014  Central bank liquidity swaps (temporary currency exchanges between the Fed and central foreign banks) are the only facility created during the crisis still active, but they have not been used on a large scale since 2012  All assistance through expired facilities has been fully repaid with interest  In 2010, the Dodd-Frank Act changed Section 13(3) to rule out direct support to specific institutions in the future  From the introduction of its first emergency lending facility in December 2007 to the worsening of the crisis in September 2008, the Fed sterilized the effects of lending on its balance sheet (i e , prevented the balance sheet from growing) by selling an offsetting amount of Treasury securities  After September 2008, assistance exceeded remaining Treasury holdings, and the Fed allowed its balance sheet to grow  Between September 2008 and November 2008, the Fed's balance sheet more than doubled in size, increasing from less than $1 trillion to more than $2 trillion  The loans and other assistance provided by the Federal Reserve to banks and nonbank institutions are considered assets on this balance sheet because they represent money owed to the Fed  With the federal funds rate at its zero bound and direct lending falling as financial conditions began to normalize in 2009, the Fed faced the decision of whether to try to provide additional monetary stimulus through unconventional measures  It did so through two unconventional tools—large-scale asset purchases (quantitative easing) and forward guidance  With short-term rates constrained by the zero bound, the Fed hoped to reduce long-term rates through large-scale asset purchases, which were popularly referred to as quantitative easing (QE)  Between 2009 and 2014, the Fed undertook three rounds of QE, buying U S  Treasury securities, agency debt, and agency mortgage-backed securities (MBS)  These securities now comprise most of the assets on the Fed's balance sheet  To understand the effect of quantitative easing on the economy, it is first necessary to describe its effect on the Fed's balance sheet  In 2009, the Fed's emergency lending declined rapidly as market conditions stabilized, which would have caused the balance sheet to decline if the Fed took no other action  Instead, asset purchases under the first round of QE (QE1) offset the decline in lending, and from November 2008 to November 2010, the overall size of the Fed's balance sheet did not vary by much  Its composition changed because of QE1, however—the amount of Fed loans outstanding fell to less than $50 billion at the end of 2010, whereas holdings of securities rose from less than $500 billion in November 2008 to more than $2 trillion in November 2010  The second round of QE, QE2, increased the Fed's balance sheet from $2 3 trillion in November 2010 to $2 9 trillion in mid-2011  It remained around that level until September 2012, when it began rising for the duration of the third round, QE3  It was about $4 5 trillion (comprised of $2 5 trillion of Treasury securities, $1 7 trillion MBS, and $0 4 trillion of agency debt) when QE3 ended in October 2014, and has remained at that level since  Table 1 summarizes the Fed's QE purchases  In total, the Fed's balance sheet increased by more than $2 5 trillion over the course of the three rounds of QE, making it about five times larger than it was before the crisis  This increase in the Fed's assets must be matched by a corresponding increase in the liabilities on its balance sheet  The Fed's liabilities mostly take the form of currency, bank reserves, and cash deposited by the U S  Treasury at the Fed  QE has mainly resulted in an increase in bank reserves, from about $46 billion in August 2008 to $820 billion at the end of 2008  Since October 2009, bank reserves have exceeded $1 trillion, and they have been between $2 5 trillion and $2 8 trillion since 2014  The increase in bank reserves can be seen as the inevitable outcome of the increase in assets held by the Fed because the bank reserves, in effect, financed the Fed's asset purchases and loan programs  Reserves increase because when the Fed makes loans or purchases assets, it credits the proceeds to the recipients' reserve accounts at the Fed  The intended purpose of QE was to put downward pressure on long-term interest rates  Purchasing long-term Treasury securities and MBS should directly reduce the rates on those securities, all else equal  The hope is that a reduction in those rates feeds through to private borrowing rates throughout the economy, stimulating spending on interest-sensitive consumer durables, housing, and business investment in plant and equipment  Indeed, Treasury and mortgage rates have been unusually low since the crisis compared with the past few decades, although the timing of declines in those rates does not match up closely to the timing of asset purchases  Determining whether QE reduced rates more broadly and stimulated interest-sensitive spending requires controlling for other factors, such as the weak economy, which tends to reduce both rates and interest-sensitive spending  The increase in the Fed's balance sheet has the potential to be inflationary because bank reserves are a component of the portion of the money supply controlled by the Fed (called the monetary base ), which grew at an unprecedented pace during QE  In practice, overall measures of the money supply have not grown as quickly as the monetary base, and inflation has remained below the Fed's goal of 2% for most of the period since 2008  The growth in the monetary base has not translated into higher inflation because bank reserves have mostly remained deposited at the Fed and have not led to increased lending or asset purchases by banks  Another concern is that by holding large amounts of MBS, the Fed is allocating credit to the housing sector, putting the rest of the economy at a disadvantage compared with that sector  Advocates of MBS purchases note that housing was the sector of the economy most in need of stabilization, given the nature of the crisis (this argument becomes less persuasive as the housing market continues to rebound); that MBS markets are more liquid than most alternatives, limiting the potential for the Fed's purchases to be disruptive; and that the Fed is legally permitted to purchase few other assets, besides Treasury securities  On October 29, 2014, the Fed announced that it would stop making large-scale asset purchases at the end of the month  Now that QE is completed, attention has turned to the Fed's "exit strategy" from QE and zero interest rates  The Fed laid out its plans to normalize monetary policy in a statement in September 2014  It plans to continue implementing monetary policy by targeting the federal funds rate  The basic challenge to doing so is that the Fed cannot effectively alter the federal funds rate by altering reserve levels (as it did before the crisis) because QE has flooded the market with excess bank reserves  In other words, in the presence of more than $2 trillion in bank reserves, the market-clearing federal funds rate is close to zero even if the Fed would like it to be higher  The most straightforward way to return to normal monetary policy would be to remove those excess reserves by shrinking the balance sheet through asset sales  The Fed does not intend to sell any securities, however  Instead, it is gradually reducing the balance sheet by ceasing to roll over securities as they mature, which began in September 2017—almost three years after QE ended  Initially, it allowed only $6 billion of Treasuries and $4 billion of MBS to run off each month, which was gradually increased to $30 billion of Treasuries and $20 billion of MBS per month, where it will remain until normalization is completed  The Fed believes that it would only cease shrinking the balance sheet or use QE again in the future if it its ability to stimulate the economy using reductions in the federal funds rate were insufficient  The Fed intends to ultimately reduce the balance sheet until it holds "no more securities than necessary to implement monetary policy efficiently and effectively " The Fed has stated that it foresees a balance sheet size that is consistent with this goal will be larger than it was before the crisis  In part, that is because other liabilities on the Fed's balance sheet are larger—there is more currency in circulation now than there was before the crisis, and the Treasury has kept larger balances on average in its account at the Fed  But the balance sheet will also be significantly larger because the Fed decided in January 2019 to continue using its new method of targeting the federal funds rate even after normalization is completed  Under the new method, the federal funds rate is not determined by supply and demand in the market for bank reserves, and the Fed would prefer to maintain abundant bank reserves so that it does not have to use open market operations to respond to changes in banks' demand for reserves  By contrast, if it went back to the pre-crisis method of targeting the federal funds rate, only minimal excess reserve balances would be necessary (but perhaps more than before the crisis), so its balance sheet could be much smaller  The Fed has not yet announced when the wind-down will be completed or how large the balance sheet would be upon completion, but the January 2019 FOMC minutes noted the wind-down could be completed as soon as this year  In that case, the balance sheet would not be much smaller than its current size of $4 trillion when normalization is completed—more than four times larger than its pre-crisis size  Although the Fed has stated that it intends to eventually stop holding MBS, the Fed would still have sizable MBS holdings in 2025, according to projections from the New York Fed  In order to raise the federal funds rate in the presence of large reserves, the Fed has raised the two market interest rates that are close substitutes—it has directly raised the rate it pays banks on reserves held at the Fed and used large-scale reverse repurchase agreements (repos) to alter repo rates  In 2008, Congress granted the Fed the authority to pay interest on reserves  Because banks can earn interest on excess reserves by lending them in the federal funds market or by depositing them at the Fed, raising the interest rate on bank reserves should also raise the federal funds rate  In this way, the Fed can lock up excess liquidity to avoid any potentially inflationary effects because reserves kept at the Fed cannot be put to use by banks to finance activity in the broader economy  In practice, the interest rate that the Fed has paid banks on reserves has been slightly higher than the federal funds rate, which some have criticized as a subsidy to banks  Reverse repos are another tool for draining liquidity from the system and influencing short-term market rates  They drain liquidity from the financial system because cash is transferred from market participants to the Fed  As a result, interest rates in the repo market, one of the largest short-term lending markets, rise  The Fed has long conducted open market operations through the repo market, but since 2013 it has engaged in a much larger volume of reverse repos with a broader range of nonbank counterparties, including the government-sponsored enterprises (such as Fannie Mae and Freddie Mac) and certain money market funds, through a new Overnight Reverse Repurchase Operations Facility  The Fed is currently not capping the amount of overnight reverse repos offered through this facility  There has been some concern about the potential ramifications of the Fed becoming a dominant participant in this market and expanding its counterparties  For example, will counterparties only be willing to transact with the Fed in a panic, and will the Fed be exposed to counterparty risk with nonbanks that it does not regulate? The Fed has distinct roles as a central bank and a regulator  Its main regulatory responsibilities are as follows: B ank regulation   The Fed supervises bank holding companies (BHCs) and thrift holding companies (THCs), which include all large and thousands of small depositories, for safety and soundness  The Dodd-Frank Act requires the Fed to subject BHCs with more than $50 billion in consolidated assets to enhanced prudential regulation (i e , stricter standards than are applied to similar firms) in an effort to mitigate the systemic risk they pose  The Fed is also the prudential regulator of U S  branches of foreign banks and state banks that have elected to become members of the Federal Reserve System  Often in concert with the other banking regulators, it promulgates rules and supervisory guidelines that apply to banks in areas such as capital adequacy, and examines depository firms under its supervision to ensure that those rules are being followed and those firms are conducting business prudently  The Fed's supervisory authority includes consumer protection for banks under its jurisdiction that have $10 billion or less in assets  P rudential regulat ion of nonbank systemically important financial institutions   The Dodd-Frank Act allows the Financial Stability Oversight Council (FSOC) to designate nonbank financial firms as systemically important (SIFIs)  Designated firms are supervised by the Fed for safety and soundness  Since enactment, the number of designated firms has ranged from four, initially, to none today  R egulation of the payment system   The Fed regulates the retail and wholesale payment system for safety and soundness  It also operates parts of the payment system, such as interbank settlements and check clearing  The Dodd-Frank Act subjects payment, clearing, and settlement systems designated as systemically important by the FSOC to enhanced supervision by the Fed (along with the Securities and Exchange Commission and the Commodity Futures Trading Commission, depending on the type of system)  M argin requirements   The Fed sets margin requirements on the purchases of certain securities, such as stocks, in certain private transactions  The purpose of margin requirements is to mandate what proportion of the purchase can be made on credit  The Fed attempts to mitigate systemic risk and prevent financial instability through these regulatory responsibilities, as well as through its lender of last resort activities and participation on the FSOC (whose mandate is to identify risks and respond to emerging threats to financial stability)  The Fed has focused more on attempting to mitigate systemic risk through its regulations since the financial crisis, and has also restructured its internal operations to facilitate a macroprudential approach to supervision and regulation 


Report 2: Justice Management Division (JMD) JMD provides the Federal Bureau of Prisons senior management with guidance as it relates to Department of Justice (DOJ) policy for all matters pertaining to organization, management, and administration, including the use of human capital flexibilities such as retention incentives  BOP is responsible for incarcerating all federal offenders sentenced to prison  To carry out its mission, BOP, under the oversight of DOJ’s JMD, manages the human resource operations of its institutions, including the use of retention incentives  BOP administers, monitors, and oversees retention incentives through its Central Office, regional offices, and institutions  Central Office  The Central Office serves as BOP’s headquarters and provides oversight of BOP operations and program areas  Within the Central Office is BOP’s Human Resource Management Division (HRMD) which is responsible for developing, implementing and administering human resource policies and programs, including the use of retention incentives that meet OPM and DOJ requirements  In addition, the Central Office’s Program Review Division (PRD) is responsible for assessing BOP programs, including human resources, to ensure that they are managed and operated effectively  Regional offices  BOP has six regional offices that cover the Mid- Atlantic, North Central, Northeast, South Central, Southeast, and Western regions of the United States  These offices, each led by a regional director, oversee the operations of the 122 federal institutions within their respective geographic regions of the country  According to BOP officials, regional office staff also provide local level oversight of institutions’ human capital programs, such as retention incentives, among other things  Institutions  BOP institutions are managed by a warden and other officials, including an executive assistant and associate warden who generally provide overall direction and, in part, administer the institution’s human capital policies, including policies on retention incentives  Correctional services staff represent the largest segment of each institution’s workforce and are responsible for the correctional treatment, custody, and supervision of inmates  Non-correctional services staff include, among others, those employees assigned to non-correctional services management, facility operations, and the health services unit  Workers in health services and psychology services are responsible for providing inmates with medical, dental, and mental health services and include, for example, dentists, pharmacists, physicians, nurses, psychologists, and drug treatment specialists  The Federal Employees Pay Comparability Act of 1990 first authorized OPM to allow federal agencies to give incentives, including retention incentives, to employees  The Federal Workforce Flexibility Act of 2004 provided federal agencies increased flexibilities regarding these incentives  For example, individual retention incentives that were capped at 25 percent of an employee’s basic pay rate could be increased up to 50 percent in cases of critical agency need with OPM’s approval  Generally, under OPM regulations, an agency is authorized to pay a retention incentive to employees  This happens when the agency determines that the unusually high or unique qualifications of the employee or a special need of the agency for the employee’s services makes it essential to retain the employee and that the employee would be likely to leave federal service in the absence of an incentive  In addition, OPM requires agencies to develop plans for using retention incentives outlining, in part, the required documentation for justifying the retention incentive and any criteria for determining the amount of incentive and the length of the service period  Generally, agencies must require that employees sign a written service agreement that outlines the terms of the service such as the employee’s agreement to remain a certain length of time with the agency  Additionally, according to OPM regulations, to qualify for a retention incentive, each employee must have a performance rating of at least “fully successful” or an agency’s equivalent performance rating  BOP funds the majority of its retention incentives through its Salaries and Expenses appropriation account which represented almost 93 percent of BOP’s budget in FY 2016  According to BOP officials, BOP’s Central Office allocates funding from the Salaries and Expenses account to the regional offices  These regional offices then determine how to allocate their budget among various salary and expense activities, including retention incentives  HRMD delegates retention incentive determinations to each institution  In accordance with OPM requirements and BOP’s October 2016 Program Statement on Compensation, the wardens make retention incentive requests based on documented evidence that the employee possesses unusually high or unique qualifications or meets a special need of the agency and has a performance rating of at least “successful or its equivalent ” These incentives are calculated as a percentage of the employee’s basic pay and are disbursed in installments to the employee each pay period  In addition to retention incentives, BOP has authority to provide other compensation-based human capital flexibilities to employees, in certain circumstances  The following summarizes some of the compensation- based human capital flexibilities that BOP uses in addition to retention incentives, to retain and recruit staff: Recruitment and relocation incentives  BOP pays recruitment incentives to new hires and relocation incentives to current employees who elect to move to a different geographic area, when a position is likely to be difficult to fill in the absence of an incentive  Student loan repayments  Using this authority, BOP may repay federally-insured student loans to attract job candidates or retain current employees  Special salary rates  With OPM approval, BOP may establish higher rates of pay for an occupation or group of occupations nationwide or in a local area when it finds the government’s recruitment or retention efforts are, or would likely become, significantly handicapped without those higher rates  Physicians and dental comparability allowances  Comparability allowances may be paid to certain eligible physicians or dental professionals who enter into service agreements  These allowances are paid only to categories of physicians and dentists for which the agency is experiencing recruitment and retention problems and are fixed at the minimum amounts necessary to deal with such problems  BOP retention incentive expenditures generally increased from $10 7 million in fiscal year 2012 to $14 0 million in fiscal year 2016  Additionally, as illustrated in table 1, the number of employees who received retention incentives increased each year from 2,024 employees in fiscal year 2012 to 2,460 employees in fiscal year 2016  In general, BOP employees who received retention incentives received the incentive for more than one year  For example, from fiscal year 2012 through fiscal year 2016, a total of 3,382 BOP employees received retention incentive payments  Of those, 82 percent (2,766 of 3,382) received retention incentive payments for at least 2 years and 39 percent received retention incentives all 5 years, as shown in figure 1  From fiscal years 2012 through 2016, BOP spent more than 97 percent of its total retention incentive expenditures on employees at four California institutions and for medical professionals nationwide  BOP’s total retention incentive expenditures for the four California institutions and medical professionals nationwide in fiscal year 2016 are provided in figure 2  Four California Institutions  The California institutions—United States Penitentiary (USP) Atwater, Federal Correctional Institution (FCI) Herlong, FCI Mendota, and Federal Correctional Complex (FCC) Victorville—constituted the largest portion of BOP’s total retention incentive expenditures, and the level of their expenditures remained relatively steady from fiscal year 2012 through 2016  BOP provides group retention incentives for staff at the General Schedule (GS) grades level 12 and below and those in the Federal Wage System at three institutions—USP Atwater, FCI Herlong, and FCC Victorville  BOP also provides individual retention incentives to its employees at GS grades level 12 and below and in the Federal Wage System at FCI Mendota  As shown in figure 3, our analysis of BOP data found that from fiscal years 2012 through 2016, these four California institutions had the largest percentage of retention incentive expenditures across institutions as well as the largest percentage of employees who received retention incentives  Additionally, the four California institutions’ retention incentive expenditures remained relatively steady—around $8 1 to $8 2 million during the 5-year period—even though the overall number of employees who received the incentives generally increased  BOP officials told us that these California institutions’ retention incentive expenditures remained relatively steady in spite of an overall increase in the number of employees receiving incentives, in part, because in fiscal year 2013 BOP reduced the retention incentive rate—the percentage of an employee’s basic pay that determines the employee’s retention incentive— by 3 percent at the four California institutions  BOP officials reported using retention incentives primarily at these four institutions to supplement correctional officers’ salaries and compensate for the gap between BOP’s and other institutions’ salaries  Specifically, officials told us that these four California institutions were consistently understaffed as a result of their lower salaries in comparison to salaries offered at California state and local prisons and at other BOP institutions in California metropolitan areas  The Department of Labor’s Bureau of Labor Statistics reports that the average salary for correctional officers in California in 2016 was $70,020  For the same year, the annual average salary for BOP correctional officers at these four institutions was $50,859  To bring these four California institutions’ salaries in line with those offered by state, local, and other BOP institutions in California metropolitan areas, BOP officials told us that they first use recruitment incentives to attract and hire staff and then provide retention incentives to employees with a performance rating of at least “successful ” Medical Professionals  From fiscal years 2012 through 2016, BOP retention incentive expenditures for medical professionals increased by an average of approximately 21 percent per year  Our analysis showed that most recently—for fiscal years 2015 and 2016—BOP retention incentive expenditures for medical professionals accounted for the largest portion of BOP’s total retention incentive expenditures across the various occupation groups and was primarily responsible for the overall increase in BOP’s total retention incentive expenditures from fiscal year 2012 through fiscal year 2016  For example, in fiscal year 2016, BOP spent approximately 42 percent of total retention incentives expenditures for medical professionals ($5 8 million), 27 percent on correctional officers ($3 8 million), and the remaining 31 percent on employees in other occupations  In total, BOP retention incentive expenditures for medical professionals increased from approximately $2 7 million in fiscal year 2012 to $5 8 million in fiscal year 2016, as shown in figure 4  The increase accounted for 92 percent of BOP’s total increase in retention incentive expenditures during the five-year period  In comparison, BOP’s retention incentive expenditures for correctional officers and all other occupations remained relatively steady from fiscal year 2012 through fiscal year 2016, increasing by an average of approximately 1 percent per year  According to our analysis, the increase in retention incentive expenditures for medical professionals during the five years is partially explained by the increase in the number of institutions providing retention incentives to medical professionals  Specifically, from fiscal years 2012 through 2016, the number of institutions providing retention incentives to medical professionals increased from 53 institutions with 341 employees in medical occupations receiving retention incentives to 84 institutions providing retention incentives to a total of 646 employees in medical occupations  According to BOP officials, BOP primarily uses retention incentives for medical professionals in an effort to retain these employees by supplementing BOP salaries which are generally lower than salaries offered to medical professionals in the private sector  Officials told us that BOP has designated medical professional positions as hard-to-fill and, therefore, BOP retaining these professionals in a correctional setting requires the use of a variety of incentives, including retention incentives, in order to increase pay  BOP has a number of internal controls in place to ensure that retention incentive applications meet BOP and other requirements  BOP officials told us that these controls are part of a multilayered application and review process that begins at the institution and culminates at BOP’s Central Office  Our review of a random sample of 40 application packet case files for retention incentives awarded from fiscal year 2014 through fiscal year 2016 found that they all generally incorporated the internal controls described by officials  The key controls in this process include: Application review at the institution and regional levels  According to BOP officials, the retention incentive application process begins with an institution’s human resources office, whose staff complete a retention incentive application on behalf of an employee  The institution’s human resources office verifies that the information in the application justifies a retention incentive and that funds are available to pay the incentive  Although it is not required, BOP officials said that they use a retention incentive application checklist to help institutions ensure that retention incentive applications are complete  The institution’s human resources office then submits the completed application packet, which includes supporting documentation, to the warden for review  Next, the application packet is forwarded to the respective BOP regional director who also reviews it for accuracy and completeness  The regional director then adds an approval statement and forwards the packet to the Central Office for final review and approval  Of the 40 randomly selected application packet case files that we reviewed, 36 included a retention incentive checklist used by the institutions and all contained information to justify the retention incentive as well as a statement of the regional director’s approval  Central Office’s final application approval  BOP policy requires that all retention incentive applications undergo two levels of review in BOP’s Central Office: first by the Human Resource Management Division’s (HRMD) Staffing and Employee Relations Section (SERS) and next by HRMD’s Personnel Director, for final review and approval  According to BOP officials, during the review process there is ongoing communication between the various entities to ensure that applications are complete and accurate; for example, if SERS finds an error in the application or requests additional information, SERS returns the application to the regional or institutional level for correction and re-review  All of the 40 BOP application packet case files that we reviewed included approvals by HRMD’s Personnel Director or an authorized official, as required by BOP policy  Annual review and re-certification to continue retention incentives  According to BOP policy, on an annual basis, institutions’ human resources offices are required to review employees’ retention incentives to determine whether the incentive is still warranted  Payment of a retention incentive may be recertified and continued as long as the conditions giving rise to the original determination to pay the incentive still exist and funds are available  For each retention incentive, an institution’s human resources office must determine whether to continue, adjust, or terminate the incentive within one year of the initial or most recent approval  If the human resources office decides to continue the retention incentive, the institution’s warden must again submit a retention incentive application  Applications to continue the retention incentive proceed through the same review and approval process as initial applications  Of the 40 application files that we reviewed, 29 were continuations and 8 were initial requests for a retention incentive  According to BOP officials, after the initial approval of a retention incentive, an institution’s human resources office has primary responsibility for the monitoring of retention incentive payments  According to officials, institutions use a variety of internal controls to monitor the expiration, continuation, or termination of retention incentives, for example: Monitoring expiration dates  BOP officials stated that institutions’ human resources offices monitor retention incentives in order to identify incentives that are approaching their expiration date and need to be terminated or renewed  For example, according to BOP officials from USP Atwater, FCC Butner and FCI Phoenix, staff from their institutions’ human resources offices may generate a retention incentive activity report and cross reference this report with their locally generated tracking sheets  This process helps identify retention incentives approaching their expiration dates so that the human resources offices can submit a request for continuation before the incentive expires  Using automated reminders to prompt file review  BOP officials stated that institutions use automated reminders to alert human resources staff to check the records of retention incentive recipients for human resources-related events such as promotions or relocations that could affect the continuation of a retention incentive  Following a checklist of steps for relocation processes  BOP officials told us that in April 2016 they instituted a checklist that outlines steps that an institution’s human resources staff must take when employees relocate to a different institution  Based on our review of this checklist, one step on the sheet prompts human resources staff to review the employee’s retention incentive  According to BOP policy, when an employee receiving a retention incentive transfers to another location, the human resources office where the employee was receiving the retention incentive is responsible for submitting a request to terminate the incentive  The termination must be effective the last day of the pay period that the employee occupies the position  Submitting forgiveness waivers  BOP officials told us that institutions submit forgiveness waivers if a request to continue a retention incentive is not submitted and approved prior to the retention incentive expiring  BOP officials said that a forgiveness waiver is considered an acknowledgement of an administrative error and is a late submission of a retention incentive renewal that was still warranted  The waiver is not a request to forgive an overpayment since the employee was still considered to be eligible for the retention incentive  Of the 40 retention incentive applications that we reviewed, 5 applications included forgiveness waivers to excuse the tardiness of the filing and request continuations of the retention incentive  According to BOP officials, BOP conducts periodic audits and reviews of its human capital activities and related internal controls, to ensure that retention incentives are being used appropriately  The following offices conduct various audits and reviews involving BOP’s retention incentives: BOP’s Program Review Division (PRD) audits regional and institutional human resources functions  PRD audits BOP’s regional and institutional human resources offices to ensure that they are in compliance with BOP policies and procedures  According to BOP officials, as part of the audit process, PRD audits retention incentives to ensure that they have the proper approvals and are justified  PRD audits each institution’s human resources office at least every three years  During these audits, PRD generates retention incentive activity reports (the same reports that institutions run when monitoring for expiration dates), to check the accuracy of retention incentive programs under review  Following each audit, PRD issues a final report with findings to the institution and to the staff operating the program area under audit

ground_truth: Congress has delegated responsibility for monetary policy to the Federal Reserve (the Fed), the nation's central bank, but retains oversight responsibilities for ensuring that the Fed is adhering to its statutory mandate of "maximum employment, stable prices, and moderate long-term interest rates." To meet its price stability mandate, the Fed has set a longer-run goal of 2% inflation. The Fed's control over monetary policy stems from its exclusive ability to alter the money supply and credit conditions more broadly. Normally, the Fed conducts monetary policy by setting a target for the federal funds rate, the rate at which banks borrow and lend reserves on an overnight basis. It meets its target through open market operations, financial transactions traditionally involving U.S. Treasury securities. Beginning in 2007, the federal funds target was reduced from 5.25% to a range of 0% to 0.25% in December 2008, which economists call the zero lower bound. By historical standards, rates were kept unusually low for an unusually long time to mitigate the effects of the financial crisis and its aftermath. Starting in December 2015, the Fed has been raising interest rates and expects to gradually raise rates further. The Fed raised rates once in 2016, three times in 2017, and four times in 2018, by 0.25 percentage points each time. In light of increased economic uncertainty and financial volatility, the Fed announced in January 2019 that it would be "patient" before raising rates again. The Fed influences interest rates to affect interest-sensitive spending, such as business capital spending on plant and equipment, household spending on consumer durables, and residential investment. In addition, when interest rates diverge between countries, it causes capital flows that affect the exchange rate between foreign currencies and the dollar, which in turn affects spending on exports and imports. Through these channels, monetary policy can be used to stimulate or slow aggregate spending in the short run. In the long run, monetary policy mainly affects inflation. A low and stable rate of inflation promotes price transparency and, thereby, sounder economic decisions. The Fed's relative independence from Congress and the Administration has been justified by many economists on the grounds that it reduces political pressure to make monetary policy decisions that are inconsistent with a long-term focus on stable inflation. But independence reduces accountability to Congress and the Administration, and recent legislation and criticism of the Fed by the President has raised the question about the proper balance between the two. While the federal funds target was at the zero lower bound, the Fed attempted to provide additional stimulus through unsterilized purchases of Treasury and mortgage-backed securities (MBS), a practice popularly referred to as quantitative easing (QE). Between 2009 and 2014, the Fed undertook three rounds of QE. The third round was completed in October 2014, at which point the Fed's balance sheet was $4.5 trillion—five times its precrisis size. After QE ended, the Fed maintained the balance sheet at the same level until September 2017, when it began to very gradually reduce it to a more normal size. The Fed has raised interest rates in the presence of a large balance sheet through the use of two new tools—by paying banks interest on reserves held at the Fed and by engaging in reverse repurchase agreements (reverse repos) through a new overnight facility. In January 2019, the Fed announced that it would continue using these tools to set interest rates permanently, in which case the balance sheet may not get much smaller than its current size of $4 trillion. With regard to its mandate, the Fed believes that unemployment is currently lower than the rate that it considers consistent with maximum employment, and inflation is close to the Fed's 2% goal by the Fed's preferred measure. Even after recent rate increases, monetary policy is still considered expansionary. This monetary policy stance is unusually stimulative compared with policy in this stage of previous expansions, and is being coupled with a stimulative fiscal policy (larger structural budget deficit). Debate is currently focused on how quickly the Fed should raise rates. Some contend the greater risk is that raising rates too slowly at full employment will cause inflation to become too high or cause financial instability, whereas others contend that raising rates too quickly will cause inflation to remain too low and choke off the expansion.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2:  Institutions respond to the report with corrective actions that the institution will take to address the findings  When the institution has resolved all corrective actions from the audit, the audit is closed  Additionally, each quarter, PRD provides HRMD with a report that summarizes its quarterly audit findings  According to BOP officials, HRMD uses these reports to identify any agency-wide trends that need to be addressed  Our review of BOP data showed that between fiscal years 2012 and 2016, PRD conducted nearly 200 audits  For example, in the fourth quarter of fiscal year 2016, PRD audited five institutions’ and regional offices’ human resource management functions  During these audits, PRD identified nine deficiencies, one of which pertained to retention incentives  Specifically, it found that one audited institution did not terminate an employee’s retention incentive after the employee had relocated to another institution  To correct the deficiency, the institution cancelled the retention incentive which discontinued future disbursements  According to BOP officials, a bill was generated to recoup the overpayment from the employee  BOP institutions conduct annual operation reviews of internal functions, such as human resources  BOP officials told us that each institution conducts annual operational reviews of various internal functions, such as human resources  According to BOP’s Program Review Guidelines for Human Resource Servicing Offices, during these reviews, institutions are required to review supporting documentation for staff currently receiving an incentive to determine if the incentives are still warranted  If the initial request for the retention incentive was made over the preceding 12 months, institutions are also required to ensure that it was approved  According to BOP officials, the results of these reviews are reported to PRD through the Central Office  DOJ’s Justice Management Division (JMD) audits BOP’s human resources programs  According to BOP officials, JMD conducts audits of component-level human resources programs to determine whether BOP’s systems are compliant with DOJ policy and aligned with DOJ’s Human Capital Strategic Plan  JMD’s most recent audit of BOP’s human resources programs that included a review of BOP’s retention incentives occurred in September 2010 at BOP’s Human Resource Service Center in Grand Prairie, Texas  JMD found that in some cases BOP granted retention incentives prior to the signing of service agreements  JMD also found that BOP lacked documentation to authorize a group retention incentive for employees at its Victorville, California institution  BOP’s written response to the findings stated that JMD incorrectly applied the service agreement requirement, as service agreements were not warranted in the specific case that it identified  Additionally, BOP stated that the documents JMD identified as missing from the case files in question were kept in separate files and not required to be part of the retention incentive application  JMD agreed with BOP’s responses and in January 2013, JMD closed out the audit’s findings noting that these responses satisfied all required corrective actions  While BOP takes a number of steps to determine current workforce needs and how to fill those needs, BOP does not strategically plan for how retention incentives can be used to meet long-term human capital goals  BOP officials stated that planning for human capital needs is conducted at institutions during quarterly workforce utilization meetings or manpower salary meetings  During these meetings, executive staff at the institution discuss the current state of the institution’s workforce  According to the BOP officials, while considering attrition, hiring, and turnover rates, the executive staff decide strategies they will employ to attract and retain employees for their current needs  While officials we spoke with at four institutions have discussed retention incentives at their workforce utilization meetings, details about the content of these discussions ranged  According to these officials and our review of meeting minutes from the four institutions, discussions about retention incentives respond to each institution’s short-term staffing situation rather than address future staffing needs based on an overall strategic human capital plan  For example: USP Atwater officials told us that they review the current turnover rate, budget, projected vacancies, and use of retention incentives at annual budget development meetings  Meeting minutes reflected the following on retention incentives: “retention … still necessary to retain staff and hard-to-fill positions ” FCC Butner is a medical facility that offers retention incentives to all medical officers (all types of doctors) and nurses (practitioners, registered, etc ) at the institution  According to Butner officials, during workforce utilization meetings, Butner officials discuss recruitment and staffing trends for the institution and plans for how to address any staffing challenges  Meeting minutes we reviewed did not indicate specific discussions about the use of retention incentives  FCC Pollock executive staff discuss current institutional salary expenditures and projections and the status of vacant positions at workforce utilization meetings  While meeting minutes we reviewed indicated discussions about projected expenditures for incentive awards, the minutes did not differentiate between retention incentive awards, and other incentive awards such as recruitment or relocation incentive awards  FCI Phoenix officials stated that in their workforce utilization meetings, executive staff discuss salary projections and vacancy statuses  Meeting minutes we reviewed did not indicate specific discussions about the use of retention incentives  BOP decisions about retention incentives are currently not tied to any strategic human capital plan for how to use human capital flexibilities— such as retention incentives—to address their ongoing challenge of retaining staff in hard-to-fill positions  According to officials, retention incentives are awarded on an as-needed basis, determined by an institution’s warden, if funds are available  According to key principles for effective strategic human capital planning, such planning is an important component of an agency’s effort to develop long-term strategies for acquiring, developing, and retaining staff needed for an agency to achieve its goals  Specifically, senior leaders should be involved in developing, communicating, and implementing strategic human capital plans  Within an agency’s strategic human capital plan, the human capital policies, practices, and programs—for example, an agency’s retention incentive program—should clearly link to the human capital and program goals of the organization  By not having a strategic human capital plan that clearly establishes strategies that will be used to achieve specific human capital goals, BOP cannot ensure that its institutions are strategically managing their workforces in a manner that meets the agency’s human capital needs  In August 2017, BOP officials told us that they began drafting a strategic human capital operating plan that will include strategic objectives, action plans, performance objectives and measures, and evaluation/reporting requirements  Officials stated that the plan will also include planning regarding the use of human capital flexibilities, such as retention incentives  BOP officials told us that they anticipate that the strategic human capital operating plan will be a supplement to their workforce utilization meetings and that an agency-wide plan will provide a set of strategies for all institutions to consider  However, BOP could not provide documentation of the project beginning or whether it would include a strategic approach specific to retention incentives  Including retention incentives in BOP’s strategic human capital operating plan would create a roadmap for the agency and the institutions to use to move from being reactive in their current workforce needs—for example, awarding retention incentives on an ad hoc basis when funds are available—to being strategic in how retention incentives are used and to ensure that these and other flexibilities help the agency achieve its long-term workforce goals  From fiscal year 2012 through fiscal year 2016, BOP spent more than $59 million on retention incentives but has not established any measures to evaluate their effectiveness  According to officials, BOP has not evaluated the effectiveness of its use of retention incentives because BOP officials consider a retention incentive successful if an employee does not leave the agency  However, BOP also uses other human capital flexibilities along with retention incentives to help retain staff  For example, BOP uses physician and dental comparability allowances—additional pay to a physician or dentist who enters into an agreement for a specified period of service—to help retain these medical personnel  According to officials, it would otherwise be difficult to compete with private sector salaries without the use of all available incentives  However, BOP has not studied whether or how retention incentives have contributed to employees’ retention in relation to other incentives such as physician and dental comparability allowances  According to our work on strategic human capital management and OPM’s guidance, it is crucial for organizations to evaluate the success of their human capital strategies, such as the use of retention incentives  In measuring the performance of these strategies and their contribution to key programmatic results, agencies can make adjustments, if necessary  For example, agencies can use evaluation results to make targeted investments in certain human capital strategies—such as the use of retention incentives—creating a cycle of strategic workforce management, where evaluation informs planning, planning dictates strategies, and strategies are evaluated for effectiveness  While BOP uses retention incentives to address critical skills gaps—such as with medical professionals—evaluating the effectiveness of retention incentives would help BOP determine whether and how retention incentives, as well as other human capital flexibilities, contribute to an employee’s continued employment at BOP or if adjustments to BOP retention strategies must be made for improved results  BOP officials agreed that evaluating the effectiveness of retention incentives would help them be more strategic about their human capital needs and spending on incentives  By including and implementing such an evaluation in its upcoming strategic human capital operating plan, BOP could better determine if it is making maximum use of its funds to retain the necessary qualified personnel or if changes must be made to most effectively retain its staff  As the largest employer within DOJ with some staff working in remote locations and undesirable conditions, BOP relies on a number of available flexibilities, including retention incentives, to help retain its employees  However, BOP currently lacks a strategic approach for using and evaluating retention incentives to address human capital goals  Given BOP’s ongoing staffing challenges, for example, retaining staff in hard-to- fill medical positions, developing a plan that includes a thoughtful blueprint for using retention incentives could help BOP better anticipate and address staffing needs  Moreover, evaluating its use of retention incentives could help BOP determine whether these incentives are effective or whether adjustments are needed to better retain its employees  By using evaluation results to inform planning, and planning to inform how retention incentives are used, BOP would be better positioned to achieve its long-term human capital goals and address its critical staffing needs  We are making two recommendations to BOP: 1  The Director of BOP should include in the forthcoming strategic human capital operating plan, 1) human capital goals and 2) strategies on how human capital flexibilities—including retention incentives—will be used to meet these goals  (Recommendation 1) 2  The Director of BOP should evaluate the effectiveness of BOP’s use of retention incentives to help determine whether the incentives have helped BOP achieve its human capital goals or if adjustments in retention incentives are needed  (Recommendation 2) We requested comments on a draft of this report from DOJ  In an email received November 15, 2017, the DOJ liaison stated that DOJ concurred with our recommendations  The Department did not provide official written comments to include in our report, but did provide written technical comments, which we incorporated as appropriate  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies of this report to the Attorney General and the Director of BOP  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-9627 or maurerd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in Appendix III  This report examines (1) how BOP has used its authority to pay retention incentives; (2) what internal controls are in place for the use of retention incentives; and (3) the extent to which BOP plans for and evaluates the use of retention incentives  To determine how BOP has used its authority to pay retention incentives, we reviewed BOP’s July 2012 report on its use of recruitment, relocation, and retention (3R) incentives  We then obtained underlying retention incentive expenditure data from DOJ’s Justice Management Division because it serves as the focal point for performance and financial information for all Department of Justice components and employees, including BOP  In particular, we obtained employee-level retention incentive payroll data for fiscal years 2012 through 2016  We selected this time period because it includes the most recent five complete fiscal years for which data were available and because we believe five years is sufficient time to identify trends in BOP’s retention incentive expenditures  We analyzed and aggregated the employee-level data by institution, occupation, and employee grade level  To identify trends, we compared per fiscal year expenditures across the various categories of occupations and locations across the five years  Additionally, we categorized institutions by BOP region, institutions that use group retention incentives, and institutions that use individual retention incentives  We also categorized occupations as medical professionals, correctional officers, and all other occupations and compared aggregate retention incentive expenditures for the different groups  Using information from BOP’s website and testimonial evidence from BOP officials on its health care system, for the purposes of this report, we defined medical professionals as BOP employees in occupations that provide medical, dental, and mental health care services and who do not solely provide these services in an administrative function  For the purposes of our analyses, medical professionals are dentists, dental assistants and hygienists, diagnostic radiological technologists, health aid and technicians, medical doctors (including psychiatrists), medical technologists, nurses, pharmacists, pharmacy technicians, physician assistants, and practical nurses and psychologists  To assess the employee-level retention incentive payroll data’s reliability, we obtained and analyzed documentation on systems’ capabilities and data control, interviewed data users and managers responsible for maintaining data, conducted checks for completeness and logical consistency, and compared the employee-level data to aggregated institution-level retention incentive expenditure data from BOP’s Financial Management Information System  We found the employee-level data to be sufficiently reliable for the purpose of this report  Additionally for this objective, we reviewed documents such as the DOJ’s Financial Management Information System Sub-Object Classification Code Guide and the Office of Personnel Management (OPM) Handbook of Occupational Groups and Families to respectively identify the system codes used to track retention incentives expenditures and to identify the names for each occupational series code in the datasets  We also interviewed BOP Human Resource Management headquarters officials to obtain information on the primary purposes for BOP’s use of retention incentives and their views on identified retention incentive expenditures trends  We also interviewed U S  Department of Health and Human Services’ (HHS) Public Health Service (PHS) officials to better understand how BOP and PHS manage costs, including retention incentive expenditures, for PHS staff assigned to BOP  BOP partners with PHS to acquire medical staff to provide medical care for BOP’s inmate population  BOP reimburses PHS for the costs of compensation and benefits—including retention incentive payments, if applicable—for PHS staff assigned to BOP  PHS has final approval authority for retention incentives paid to PHS staff assigned to BOP facilities  Furthermore, we obtained aggregated retention incentive expenditure data from PHS on the total amount of funds BOP reimbursed PHS for fiscal years 2012 through 2016  For the reliability of PHS’s data, we reviewed the system’s data fields to check that the appropriate fields were used to provide data and interviewed data users and managers to discuss how expenditures are recorded and maintained  We found the PHS data to be sufficiently reliable for the purpose of this report  To identify and describe the internal controls that BOP has in place related to retention incentives, we obtained and analyzed documentation regarding BOP requirements and guidance for the use of retention incentives  We also interviewed officials from BOP’s Central Office who are responsible for the administration, management, and oversight of BOP’s human capital management systems, including retention incentives  We focused on the management and administrative controls used by BOP to review, approve, re-certify, and monitor retention incentives  Additionally, we interviewed the warden and human capital officers at 4 of the 122 institutions to obtain illustrative examples regarding the internal controls in place at these institutions to ensure the proper disbursement of retention incentives  We interviewed BOP officials at Federal Correctional Complex Pollock in Pollock, LA; Federal Correctional Complex Butner in Butner, NC; United States Penitentiary, Atwater in Atwater, CA and Federal Correctional Institution Phoenix, in Phoenix, AZ  These institutions were selected to ensure variation in the number and types of employees receiving retention incentives, BOP region, and security-level  Although the information we obtained from the interviews with officials at these four institutions cannot be generalized to other BOP institutions, these interviews provided important insights and perspectives about the use of retention incentives at BOP institutions  We also reviewed a non-generalizable random sample of 40 retention incentive application packet case files to determine the extent to which these files contained documentation on the internal control activities in place to monitor the application, approval, and funds disbursement processes of BOP’s retention incentive program  To identify our sample, we used employee-level expenditure data to randomly select 40 application files from the universe of BOP employees who received retention incentives from fiscal years 2014 through 2016  Each application file was reviewed by two GAO analysts who each assessed the extent to which each application contained the appropriate justification, approval signatures, and other documentation such as an application checklist and whether the application was an initial or continuation application  To determine the extent to which BOP plans for and evaluates the use of retention incentives, we interviewed BOP officials regarding their experiences with retention incentives, how they use retention incentives to strategically manage their workforce needs, how the agency evaluates the effectiveness of retention incentives, and how retention incentives contribute to BOP’s broader human capital goals  We then compared these efforts to our work on strategic human capital planning, specifically in terms of planning for and evaluating the use of human capital flexibilities  Additionally, we interviewed the warden and human capital officers at four BOP institutions mentioned above to obtain illustrative examples of how workforce planning occurs at these institutions  We also reviewed the DOJ’s Office of Inspector General Report 16-02 “Review of the Federal Bureau of Prisons’ Medical Staffing Challenges” (March 2016) and our past work to better understand the challenges that BOP faces in retaining medical professionals and other staff  Table 2 provides the Bureau of Prisons’ (BOP) fiscal year 2016 retention incentive expenditures by various occupations and groups of occupations, such as medical professionals, correctional officers, and other occupations  A range of occupations are reflected in the table primarily as a result of four California institutions—United States Penitentiary (USP) Atwater, Federal Correctional Institution (FCI) Herlong, FCI Mendota, and Federal Correctional Complex Victorville—providing retention incentives to all employees at General Schedule grades level 12 and below and those in the Federal Wage System  In addition to the contact named above, Dawn Locke (Assistant Director) and Meghan Squires (Analyst-in-Charge) managed the work  Also, David Alexander, Renee Caputo, Willie Commons III, Jamarla Edwards, Robert Goldenkoff, Chelsa Gurkin, Eric Hauswirth, Janice Latimer, Lerone Reid, Rachel Stoiko, and Adam Vogt made significant contributions to this report 
Report 2:  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 

ground_truth: BOP is the largest employer within DOJ and is responsible for the care and custody of an inmate population of about 186,000. BOP has faced challenges retaining staff at correctional facilities, although it has used retention incentives, along with other human capital flexibilities. GAO was asked to review BOP's use of retention incentives. This report addresses: (1) how BOP used its authority to pay retention incentives; (2) internal controls BOP has in place for the use of retention incentives; and (3) the extent to which BOP plans for and evaluates the use of retention incentives. GAO obtained employee-level retention incentive expenditure data from DOJ's Justice Management Division for fiscal years 2012 through 2016. GAO also reviewed agency documentation, such as policy statements and 40 randomly selected retention incentive application packet case files from fiscal years 2014 through 2016. GAO also interviewed officials from BOP's Central Office and four correctional facilities that use retention incentives, selected to reflect variation in the number and types of employees receiving retention incentives, BOP regions, and BOP institution security levels. From fiscal years 2012 to 2016, the Department of Justice's (DOJ) Federal Bureau of Prisons' (BOP) total retention incentive expenditures generally increased from $10.7 to $14.0 million and the number of employees receiving retention incentives increased from 2,024 to 2,460. During those five years, BOP spent more than 97 percent of its total retention incentive expenditures on employees at four BOP institutions in California and for medical professionals nationwide. Further, total retention incentive expenditures for medical professionals increased by an average of 21 percent per year (see figure). According to BOP officials, BOP uses retention incentives, for example, to supplement BOP's medical professionals' salaries which are generally lower than private sector salaries. BOP has a variety of internal controls in place throughout the retention incentive process that help ensure retention incentive applications and approvals meet requirements. For example, each application goes through multiple levels of review to verify its accuracy and completeness. BOP takes steps to determine workforce needs and how to fill those needs, but has not strategically planned for and evaluated its use of retention incentives. According to BOP, planning for human capital needs is conducted at institutions during quarterly meetings, but discussions about these incentives respond to short-term staffing situations rather than proactively addressing future staffing needs. Including human capital goals and strategies in BOP's human capital plan would create a roadmap so the agency could move from being reactive to its current workforce needs to being strategic in trying to achieve its long-term workforce goals. Additionally BOP has not evaluated the effectiveness of its use of retention incentives in retaining staff. As a result, BOP does not know whether retention incentives have contributed to employees' retention in relation to other incentives used by BOP. Consistent with key principles for strategic human capital planning, planning for and evaluating the use of retention incentives could help BOP better determine if these incentives are an efficient and effective means by which to retain staff. GAO recommends that BOP (1) include human capital goals and how retention incentives will be used to achieve these goals in its human capital plan; and (2) evaluate the use of retention incentives. BOP concurred with GAO's recommendations.