prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: IT systems supporting federal agencies and our nation’s critical infrastructures are inherently at risk  These systems are highly complex and dynamic, technologically diverse, and often geographically dispersed  This complexity increases the difficulty in identifying, managing, and protecting the numerous operating systems, applications, and devices comprising the systems and networks  Compounding the risk, federal systems and networks are also often interconnected with other internal and external systems and networks, including the Internet  This increases the number of avenues of attack and expands their attack surface  As systems become more integrated, cyber threats will pose an increasing risk to national security, economic well-being, and public health and safety  Advancements in technology, such as data analytics software for searching and collecting information, have also made it easier for individuals and organizations to correlate data (including PII) and track it across large and numerous databases  For example, social media has been used as a mass communication tool where PII can be gathered in vast amounts  In addition, ubiquitous Internet and cellular connectivity makes it easier to track individuals by allowing easy access to information pinpointing their locations  These advances—combined with the increasing sophistication of hackers and others with malicious intent, and the extent to which both federal agencies and private companies collect sensitive information about individuals—have increased the risk of PII being exposed and compromised  Cybersecurity incidents continue to impact entities across various critical infrastructure sectors  For example, in its 2018 annual data breach investigations report, Verizon reported that 53,308 security incidents and 2,216 data breaches were identified across 65 countries in the 12 months since its prior report  Further, the report noted that cybercriminals can often compromise a system in just a matter of minutes—or even seconds, but that it can take an organization significantly longer to discover the breach  Specifically, the report stated nearly 90 percent of the reported breaches occurred within minutes, while nearly 70 percent went undiscovered for months  These concerns are further highlighted by the number of information security incidents reported by federal executive branch civilian agencies to DHS’s U S  Computer Emergency Readiness Team (US-CERT)  For fiscal year 2017, 35,277 such incidents were reported by the Office of Management and Budget (OMB) in its 2018 annual report to Congress, as mandated by the Federal Information Security Modernization Act (FISMA)  These incidents include, for example, web-based attacks, phishing, and the loss or theft of computing equipment  Different types of incidents merit different response strategies  However, if an agency cannot identify the threat vector (or avenue of attack), it could be difficult for that agency to define more specific handling procedures to respond to the incident and take actions to minimize similar future attacks  In this regard, incidents with a threat vector categorized as “other” (which includes avenues of attacks that are unidentified) made up 31 percent of the various incidents reported to US-CERT  Figure 1 shows the percentage of the different types of incidents reported across each of the nine threat vector categories for fiscal year 2017, as reported by OMB  These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security  The following examples highlight the impact of such incidents: In March 2018, the Mayor of Atlanta, Georgia, reported that the city was victimized by a ransomware cyberattack  As a result, city government officials stated that customers were not able to access multiple applications that are used to pay bills or access court related information  In response to the attack, the officials noted that they were working with numerous private and governmental partners, including DHS, to assess what occurred and determine how best to protect the city from future attacks  In March 2018, the Department of Justice reported that it had indicted nine Iranians for conducting a massive cybersecurity theft campaign on behalf of the Islamic Revolutionary Guard Corps  According to the department, the nine Iranians allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 U S  companies, and five federal government agencies, among other entities  In March 2018, a joint alert from DHS and the Federal Bureau of Investigation (FBI) stated that, since at least March 2016, Russian government actors had targeted the systems of multiple U S  government entities and critical infrastructure sectors  Specifically, the alert stated that Russian government actors had affected multiple organizations in the energy, nuclear, water, aviation, construction, and critical manufacturing sectors  In July 2017, a breach at Equifax resulted in the loss of PII for an estimated 148 million U S  consumers  According to Equifax, the hackers accessed people’s names, Social Security numbers (SSN), birth dates, addresses and, in some instances, driver’s license numbers  In April 2017, the Commissioner of the Internal Revenue Service (IRS) testified that the IRS had disabled its data retrieval tool in early March 2017 after becoming concerned about the misuse of taxpayer data  Specifically, the agency suspected that PII obtained outside the agency’s tax system was used to access the agency’s online federal student aid application in an attempt to secure tax information through the data retrieval tool  In April 2017, the agency began notifying taxpayers who could have been affected by the breach  In June 2015, OPM reported that an intrusion into its systems had affected the personnel records of about 4 2 million current and former federal employees  Then, in July 2015, the agency reported that a separate, but related, incident had compromised its systems and the files related to background investigations for 21 5 million individuals  In total, OPM estimated 22 1 million individuals had some form of PII stolen, with 3 6 million being a victim of both breaches  Safeguarding federal IT systems and the systems that support critical infrastructures has been a long-standing concern of GAO  Due to increasing cyber-based threats and the persistent nature of information security vulnerabilities, we have designated information security as a government-wide high-risk area since 1997  In 2003, we expanded the information security high-risk area to include the protection of critical cyber infrastructure  At that time, we highlighted the need to manage critical infrastructure protection activities that enhance the security of the cyber and physical public and private infrastructures that are essential to national security, national economic security, and/or national public health and safety  We further expanded the information security high-risk area in 2015 to include protecting the privacy of PII  Since then, advances in technology have enhanced the ability of government and private sector entities to collect and process extensive amounts of PII, which has posed challenges to ensuring the privacy of such information  In addition, high- profile PII breaches at commercial entities, such as Equifax, heightened concerns that personal privacy is not being adequately protected  Our experience has shown that the key elements needed to make progress toward being removed from the High-Risk List are top-level attention by the administration and agency leaders grounded in the five criteria for removal, as well as any needed congressional action  The five criteria for removal that we identified in November 2000 are as follows: Leadership Commitment  Demonstrated strong commitment and top leadership support  Capacity  The agency has the capacity (i e , people and resources) to resolve the risk(s)  Action Plan  A corrective action plan exists that defines the root cause, solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended  Monitoring  A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures  Demonstrated Progress  Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area  These five criteria form a road map for efforts to improve and ultimately address high-risk issues  Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list  Figure 2 shows the five criteria and illustrative actions taken by agencies to address the criteria  Importantly, the actions listed are not “stand alone” efforts taken in isolation from other actions to address high- risk issues  That is, actions taken under one criterion may be important to meeting other criteria as well  For example, top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress—actions which are also vital to monitoring criteria  As we reported in the February 2017 high-risk report, the federal government’s efforts to address information security deficiencies had fully met one of the five criteria for removal from the High-Risk List— leadership commitment—and partially met the other four, as shown in figure 3  We plan to update our assessment of this high-risk area against the five criteria in February 2019  Based on our prior work, we have identified four major cybersecurity challenges: (1) establishing a comprehensive cybersecurity strategy and performing effective oversight, (2) securing federal systems and information, (3) protecting cyber critical infrastructure, and (4) protecting privacy and sensitive data  To address these challenges, we have identified 10 critical actions that the federal government and other entities need to take (see figure 4)  The four challenges and the 10 actions needed to address them are summarized following the table  In addition, we also discuss in more detail each of the 10 actions in appendices II through XI  The federal government has been challenged in establishing a comprehensive cybersecurity strategy and in performing effective oversight as called for by federal law and policy  Specifically, we have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  We have also reported on challenges in performing oversight, including monitoring the global supply chain, ensuring a highly skilled cyber workforce, and addressing risks associated with emerging technologies  The federal government can take four key actions to improve the nation’s strategic approach to, and oversight of, cybersecurity  Develop and execute a more comprehensive federal strategy for national cybersecurity and global cyberspace  In February 2013 we reported that the government had issued a variety of strategy- related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  In October 2015, in response to our recommendation to develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy, the Director of OMB and the Federal Chief Information Officer issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  For example, a May 2017 presidential executive order required federal agencies to take a variety of actions, including better manage their cybersecurity risks and coordinate to meet reporting requirements related to cybersecurity of federal networks, critical infrastructure, and the nation  Additionally, the December 2017 National Security Strategy cites cybersecurity as a national priority and identifies related needed actions, such as including identifying and prioritizing risk, and building defensible government networks  Further, DHS issued a cybersecurity strategy in May 2018, which articulated seven goals the department plans to accomplish in support of its mission related to managing national cybersecurity risks  The strategy is intended to provide DHS with a framework to execute its cybersecurity responsibilities during the next 5 years to keep pace with the evolving cyber risk landscape by reducing vulnerabilities and building resilience; countering malicious actors in cyberspace; responding to incidents; and making the cyber ecosystem more secure and resilient  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we have previously recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically, the documents generally did not include milestones and performance measures to gauge results, nor did they describe the resources needed to carry out the goals and objective  Further, most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, the Department of Defense (DOD), and OMB, who contribute substantially to the nation’s cybersecurity programs  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  For more information on this action area, see appendix II  Mitigate global supply chain risks  The global, geographically disperse nature of the producers and suppliers of IT products is a growing concern  We have previously reported on potential issues associated with IT supply chain and risks originating from foreign- manufactured equipment  For example, in July 2017, we reported that the Department of State had relied on certain device manufacturers, software developers, and contractor support which had suppliers that were reported to be headquartered in a cyber-threat nation (e g , China and Russia)  We further pointed out that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  In July 2018, we testified that if such global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  These factors highlight the importance and urgency of federal agencies appropriately assessing, managing, and monitoring IT supply chain risk as part of their agency-wide information security programs  For more information on this action area, see appendix III  Address cybersecurity workforce management challenges  The federal government faces challenges in ensuring that the nation’s cybersecurity workforce has the appropriate skills  For example, in June 2018, we reported on federal efforts to implement the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015  We determined that most of the Chief Financial Officers (CFO) Act agencies had not fully implemented all statutory requirements, such as developing procedures for assigning codes to cybersecurity positions  Further, we have previously reported that DHS and DOD had not addressed cybersecurity workforce management requirements set forth in federal laws  In addition, we have reported in the last 2 years that federal agencies (1) had not identified and closed cybersecurity skills gaps, (2) had been challenged with recruiting and retaining qualified staff, and (3) had difficulty navigating the federal hiring process  A recent executive branch report also discussed challenges associated with the cybersecurity workforce  Specifically, in response to Executive Order 13800, the Department of Commerce and DHS led an interagency working group exploring how to support the growth and sustainment of future cybersecurity employees in the public and private sectors  In May 2018, the departments issued a report that identified key findings, including: the U S  cybersecurity workforce needs immediate and sustained improvements; the pool of cybersecurity candidates needs to be expanded through retraining and by increasing the participation of women, minorities, and veterans; a shortage exists of cybersecurity teachers at the primary and secondary levels, faculty in higher education, and training instructors; and comprehensive and reliable data about cybersecurity workforce position needs and education and training programs are lacking  The report also included recommendations and proposed actions to address the findings, including that private and public sectors should (1) align education and training with employers’ cybersecurity workforce needs by applying the National Initiative for Cybersecurity Education Cybersecurity Workforce Framework; (2) develop cybersecurity career model paths; and (3) establish a clearinghouse of information on cybersecurity workforce development education, training, and workforce development programs and initiatives  In addition, in June 2018, the executive branch issued a government reform plan and reorganization recommendations that included, among other things, proposals for solving the federal cybersecurity workforce shortage  In particular, the plan notes that the administration intends to prioritize and accelerate ongoing efforts to reform the way that the federal government recruits, evaluates, selects, pays, and places cyber talent across the enterprise  The plan further states that, by the end of the first quarter of fiscal year 2019, all CFO Act agencies, in coordination with DHS and OMB, are to develop a critical list of vacancies across their organizations  Subsequently, OMB and DHS are to analyze these lists and work with OPM to develop a government-wide approach to identifying or recruiting new employees or reskilling existing employees  Regarding cybersecurity training, the plan notes that OMB is to consult with DHS to standardize training for cybersecurity employees, and should work to develop an enterprise-wide training process for government cybersecurity employees  For more information on this action area, see appendix IV  Ensure the security of emerging technologies  As the devices used in daily life become increasingly integrated with technology, the risk to sensitive data and PII also grows  Over the last several years, we have reported on weaknesses in addressing vulnerabilities associated with emerging technologies, including: IoT devices, such as fitness trackers, cameras, and thermostats, that continuously collect and process information are potentially vulnerable to cyber-attacks; IoT devices, such as those acquired and used by DOD employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department; vehicles that are potentially susceptible to cyber-attack through technology, such as Bluetooth; the unknown impact of artificial intelligence cybersecurity; and advances in cryptocurrencies and blockchain technologies  Executive branch agencies have also highlighted the challenges associated with ensuring the security of emerging technologies  Specifically, in a May 2018 report issued in response to Executive Order 13800, the Department of Commerce and DHS issued a report on the opportunities and challenges in reducing the botnet threat  The opportunities and challenges are centered on six principal themes, including the global nature of automated, distributed attacks; effective tools; and awareness and education  The report also provides recommended actions, including that federal agencies should increase their understanding of what software components have been incorporated into acquired products and establish a public campaign to support awareness of IoT security  For more information on this action area, see appendix V  In our previously discussed reports related to this cybersecurity challenge, we made a total of 50 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 48 recommendations had not been implemented  These outstanding recommendations include 8 priority recommendations, meaning that we believe that they warrant priority attention from heads of key departments and agencies  These priority recommendations include addressing weaknesses associated with, among other things, agency-specific cybersecurity workforce challenges and agency responsibilities for supporting mitigation of vehicle network attacks  Until our recommendations are fully implemented, federal agencies may be limited in their ability to provide effective oversight of critical government-wide initiatives, address challenges with cybersecurity workforce management, and better ensure the security of emerging technologies  In addition to our prior work related to the federal government’s efforts to establish key strategy documents and implement effective oversight, we also have several ongoing reviews related to this challenge  These include reviews of: the CFO Act agencies’ efforts to submit complete and reliable baseline assessment reports of their cybersecurity workforces; the extent to which DOD has established training standards for cyber mission force personnel, and efforts the department has made to achieve its goal of a trained cyber mission force; and selected agencies’ ability to implement cloud service technologies and notable benefits this might have on agencies  The federal government has been challenged in securing federal systems and information  Specifically, we have reported that federal agencies have experienced challenges in implementing government-wide cybersecurity initiatives, addressing weaknesses in their information systems and responding to cyber incidents on their systems  This is particularly concerning given that the emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security  As such, it is important that federal agencies take appropriate steps to better ensure they have effectively implemented programs to protect their information and systems  We have identified three actions that the agencies can take  Improve implementation of government-wide cybersecurity initiatives  Specifically, in January 2016, we reported that DHS had not ensured that the National Cybersecurity Protection System (NCPS) had fully satisfied all intended system objectives related to intrusion detection and prevention, information sharing, and analytics  In addition, in February 2017, we reported that the DHS National Cybersecurity and Communications Integration Center’s (NCCIC) functions were not being performed in adherence with the principles set forth in federal laws  We noted that, although NCCIC was sharing information about cyber threats in the way it should, the center did not have metrics to measure that the information was timely, relevant and actionable, as prescribed by law  For more information on this action area, see appendix VI  Address weaknesses in federal information security programs  We have previously identified a number of weaknesses in agencies’ protection of their information and information systems  For example, over the past 2 years, we have reported that: most of the 24 agencies covered by the CFO Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management); three agencies—the Securities Exchange Commission, the Federal Deposit Insurance Corporation, and the Food and Drug Administration—had not effectively implemented aspects of their information security programs, which resulted in weaknesses in these agencies’ security controls; information security weaknesses in selected high-impact systems at four agencies—the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veterans Affairs—were cited as a key reason that the agencies had not effectively implemented elements of their information security programs; DOD’s process for monitoring the implementation of cybersecurity guidance had weaknesses and resulted in the closure of certain tasks (such as completing cyber risk assessments) before they were fully implemented; and agencies had not fully defined the role of their Chief Information Security Officers, as required by FISMA  We also recently testified that, although the government had acted to protect federal information systems, additional work was needed to improve agency security programs and cyber capabilities  In particular, we noted that further efforts were needed by agencies to implement our prior recommendations in order to strengthen their information security programs and technical controls over their computer networks and systems  For more information on this action area, see appendix VII  Enhance the federal response to cyber incidents  We have reported that certain agencies have had weaknesses in responding to cyber incidents  For example, as of August 2017, OPM had not fully implemented controls to address deficiencies identified as a result of its 2015 cyber incidents; DOD had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises; as of April 2016, DOD had not identified, clarified, or implemented all components of its support of civil authorities during cyber incidents; and as of January 2016, DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  For more information on this action area, see appendix VIII  In the public versions of the reports previously discussed for this challenge area, we made a total of 101 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 61 recommendations had not been implemented  These outstanding recommendations include 14 priority recommendations to address weaknesses associated with, among other things, the information security programs at the National Aeronautics and Space Administration, OPM, and the Security Exchange Commission  Until these recommendations are implemented, these federal agencies will be limited in their ability to ensure the effectiveness of their programs for protecting information and systems  In addition to our prior work, we also have several ongoing reviews related to the federal government’s efforts to protect its information and systems  These include reviews of: Federal Risk and Authorization Management Program (FedRAMP) implementation, including an assessment of the implementation of the program’s authorization process for protecting federal data in cloud environments; the Equifax data breach, including an assessment of federal oversight of credit reporting agencies’ collection, use, and protection of consumer PII; the Federal Communication Commission’s Electronic Comment Filing System security, to include a review of the agency’s detection of and response to a May 2017 incident that reportedly impacted the system; DOD’s efforts to improve the cybersecurity of its major weapon DOD’s whistleblower program, including an assessment of the policies, procedures, and controls related to the access and storage of sensitive and classified information needed for the program; IRS’s efforts to (1) implement security controls and the agency’s information security program, (2) authenticate taxpayers, and (3) secure tax information; and the federal approach and strategy to securing agency information systems, to include federal intrusion detection and prevention capabilities and the intrusion assessment plan  The federal government has been challenged in working with the private sector to protect critical infrastructure  This infrastructure includes both public and private systems vital to national security and other efforts, such as providing the essential services that underpin American society  As the cybersecurity threat to these systems continues to grow, federal agencies have millions of sensitive records that must be protected  Specifically, this critical infrastructure threat could have national security implications and more efforts should be made to ensure that it is not breached  To help address this issue, the National Institute of Standards and Technology (NIST) developed the cybersecurity framework—a voluntary set of cybersecurity standards and procedures for industry to adopt as a means of taking a risk-based approach to managing cybersecurity  However, additional action is needed to strengthen the federal role in protecting the critical infrastructure  Specifically, we have reported on other critical infrastructure protection issues that need to be addressed  For example: DHS did not track vulnerability reduction from the implementation and verification of planned security measures at the high-risk chemical facilities that engage with the department, as a basis for assessing performance  Entities within the 16 critical infrastructure sectors reported encountering four challenges to adopting the cybersecurity framework, such as being limited in their ability to commit necessary resources towards framework adoption and not having the necessary knowledge and skills to effectively implement the framework  DOD and the Federal Aviation Administration identified a variety of operations and physical security risks that could adversely affect DOD missions  Major challenges existed to securing the electricity grid against cyber threats  These challenges included monitoring implementation of cybersecurity standards, ensuring security features are built into smart grid systems, and establishing metrics for cybersecurity  DHS and other agencies needed to enhance cybersecurity in the maritime environment  Specifically, DHS did not include cyber risks in its risk assessments that were already in place nor did it address cyber risks in guidance for port security plans  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  For more information on this action area, see appendix IX  We made a total of 21 recommendations to federal agencies to address these weaknesses and others  These recommendations include, for example, a total of 9 recommendations to 9 sector-specific agencies to develop methods to determine the level and type of cybersecurity framework adoption across their respective sectors  As of August 2018, all 21 recommendations had not been implemented  Until these recommendations are implemented, the federal government will continue to be challenged in fulfilling its role in protecting the nation’s critical infrastructure  In addition to our prior work related to the federal government’s efforts to protect critical infrastructure, we also have several ongoing reviews focusing on: the physical and cybersecurity risks to pipelines across the country responsible for transmitting oil, natural gas, and other hazardous liquids; the cybersecurity risks to the electric grid; and the privatization of utilities at DOD installations  The federal government has been challenged in protecting privacy and sensitive data  Advances in technology, including powerful search technology and data analytics software, have made it easy to correlate information about individuals across large and numerous databases, which have become very inexpensive to maintain  In addition, ubiquitous Internet connectivity has facilitated sophisticated tracking of individuals and their activities through mobile devices such as smartphones and fitness trackers  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of PII maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  Federal agencies should take two types of actions to address this challenge area  In addition, we have previously proposed two matters for congressional consideration aimed toward better protecting PII  Improve federal efforts to protect privacy and sensitive data  We have issued several reports noting that agencies had deficiencies in protecting privacy and sensitive data that needed to be addressed  For example: The Department of Health and Human Services’ (HHS) Centers for Medicare and Medicaid Services (CMS) and external entities were at risk of compromising Medicare Beneficiary Data due to a lack of guidance and proper oversight  The Department of Education’s Office of Federal Student Aid had not properly overseen its school partners’ records or information security programs  HHS had not fully addressed key security elements in its guidance for protecting the security and privacy of electronic health information  CMS had not fully protected the privacy of users’ data on state- based marketplaces  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives aimed at eliminating the unnecessary collection, use, and display of SSNs  For more information on this action area, see appendix X  Appropriately limit the collection and use of personal information and ensure that it is obtained with appropriate knowledge or consent  We have issued a series of reports that highlight a number of the key concerns in this area  For example: The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent; Federal laws for smartphone tracking applications have not generally been well enforced; The FBI has not fully ensured privacy and accuracy related to the use of face recognition technology  For more information on this action area, see appendix XI  We have previously suggested that Congress consider amending laws, such as the Privacy Act of 1974 and the E-Government Act of 2002, because they may not consistently protect PII  Specifically, we found that while these laws and guidance set minimum requirements for agencies, they may not consistently protect PII in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles  However, revisions to the Privacy Act and the E-Government Act have not yet been enacted  Further, we also suggested that Congress consider strengthening the consumer privacy framework and review issues such as the adequacy of consumers’ ability to access, correct, and control their personal information; and privacy controls related to new technologies such as web tracking and mobile devices  However, these suggested changes have not yet been enacted  We also made a total of 29 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 28 recommendations had not been implemented  These outstanding recommendations include 6 priority recommendations to address weaknesses associated with, among other things, publishing privacy impact assessments and improving the accuracy of the FBI’s face recognition services  Until these recommendations are implemented, federal agencies will be challenged in their ability to protect privacy and sensitive data and ensure that its collection and use is appropriately limited  In addition to our prior work, we have several ongoing reviews related to protecting privacy and sensitive data  These include reviews of: IRS’s taxpayer authentication efforts, including what steps the agency is taking to monitor and improve its authentication methods; the extent to which the Department of Education’s Office of Federal Student Aid’s policies and procedures for overseeing non-school partners’ protection of federal student aid data align with federal requirements and guidance; data security issues related to credit reporting agencies, including a review of the causes and impacts of the August 2017 Equifax data breach; the extent to which Equifax assessed, responded to, and recovered from its August 2017 data breach; federal agencies’ efforts to remove PII from shared cyber threat indicators; and how the federal government has overseen Internet privacy, including the roles of the Federal Communications Commission and the Federal Trade Commission, and strengths and weaknesses of the current oversight authorities  In conclusion, since 2010, we have made over 3,000 recommendations to agencies aimed at addressing the four cybersecurity challenges  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  Of the roughly 3,000 recommendations made since 2010, nearly 1,000 had not been implemented as of August 2018  We have also designated 35 as priority recommendations, and as of August 2018, 31 had not been implemented  The federal government and the nation’s critical infrastructure are dependent on IT systems and electronic data, which make them highly vulnerable to a wide and evolving array of cyber-based threats  Securing these systems and data is vital to the nation’s security, prosperity, and well-being  Nevertheless, the security over these systems and data is inconsistent and urgent actions are needed to address ongoing cybersecurity and privacy challenges  Specifically, the federal government needs to implement a more comprehensive cybersecurity strategy and improve its oversight, including maintaining a qualified cybersecurity workforce; address security weaknesses in federal systems and information and enhance cyber incident response efforts; bolster the protection of cyber critical infrastructure; and prioritize efforts to protect individual’s privacy and PII  Until our recommendations are addressed and actions are taken to address the four challenges we identified, the federal government, the national critical infrastructure, and the personal information of U S  citizens will be increasingly susceptible to the multitude of cyber-related threats that exist  We are sending copies of this report to the appropriate congressional committees  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Nick Marinos at (202) 512-9342 or marinosn@gao gov or Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix XII  Critical Infrastructure Protection: DHS Should Take Actions to Measure Reduction in Chemical Facility Vulnerability and Share Information with First Responders  GAO-18-538  Washington, D C : August 8, 2018  High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation  GAO-18-645T  Washington, D C : July 25, 2018  Information Security: Supply Chain Risks Affecting Federal Agencies  GAO-18-667T  Washington, D C : July 12, 2018  Information Technology: Continued Implementation of High-Risk Recommendations Is Needed to Better Manage Acquisitions, Operations, and Cybersecurity  GAO-18-566T  Washington, D C : May 23, 2018  Cybersecurity: DHS Needs to Enhance Efforts to Improve and Promote the Security of Federal and Private-Sector Networks, GAO-18-520T  Washington, D C : April 24, 2018  Electronic Health Information: CMS Oversight of Medicare Beneficiary Data Security Needs Improvement  GAO-18-210  Washington, D C : March 6, 2018  Technology Assessment: Artificial Intelligence, Emerging Opportunities, Challenges, and Implications  GAO-18-142SP  Washington, D C : March 28, 2018  GAO Strategic Plan 2018-2023: Trends Affecting Government and Society  GAO-18-396SP  Washington, D C : February 22, 2018  Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption  GAO-18-211  Washington, D C : February 15, 2018  Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements  GAO-18-175  Washington, D C : February 6, 2018  Homeland Defense: Urgent Need for DOD and FAA to Address Risks and Improve Planning for Technology That Tracks Military Aircraft  GAO-18-177  Washington, D C : January 18, 2018  Federal Student Aid: Better Program Management and Oversight of Postsecondary Schools Needed to Protect Student Information  GAO-18-121  Washington, D C : December 15, 2017  Defense Civil Support: DOD Needs to Address Cyber Incident Training Requirements  GAO-18-47  Washington, D C : November 30, 2017  Federal Information Security: Weaknesses Continue to Indicate Need for Effective Implementation of Policies and Practices  GAO-17-549  Washington, D C : September 28, 2017  Information Security: OPM Has Improved Controls, but Further Efforts Are Needed  GAO-17-614  Washington, D C : August 3, 2017  Defense Cybersecurity: DOD’s Monitoring of Progress in Implementing Cyber Strategies Can Be Strengthened  GAO-17-512  Washington, D C : August 1, 2017  State Department Telecommunications: Information on Vendors and Cyber-Threat Nations  GAO-17-688R  Washington, D C : July 27, 2017  Internet of Things: Enhanced Assessments and Guidance Are Needed to Address Security Risks in DOD  GAO-17-668  Washington, D C : July 27, 2017  Information Security: SEC Improved Control of Financial Systems but Needs to Take Additional Actions  GAO-17-469  Washington, D C : July 27, 2017  Information Security: Control Deficiencies Continue to Limit IRS’s Effectiveness in Protecting Sensitive Financial and Taxpayer Data  GAO-17-395  Washington, D C : July 26, 2017  Social Security Numbers: OMB Actions Needed to Strengthen Federal Efforts to Limit Identity Theft Risks by Reducing Collection, Use, and Display  GAO-17-553  Washington, D C : July 25, 2017  Information Security: FDIC Needs to Improve Controls over Financial Systems and Information  GAO-17-436  Washington, D C : May 31, 2017  Technology Assessment: Internet of Things: Status and implications of an increasingly connected world  GAO-17-75  Washington, D C : May 15, 2017  Cybersecurity: DHS’s National Integration Center Generally Performs Required Functions but Needs to Evaluate Its Activities More Completely  GAO-17-163  Washington, D C : February 1, 2017  High-Risk Series: An Update  GAO-17-317  Washington, D C : February 2017  IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; Selected Departments Need to Assess Skill Gaps  GAO-17-8  Washington, D C : November 30, 2016  Electronic Health Information: HHS Needs to Strengthen Security and Privacy Guidance and Oversight  GAO-16-771  Washington, D C : September 26, 2016  Defense Civil Support: DOD Needs to Identify National Guard’s Cyber Capabilities and Address Challenges in Its Exercises  GAO-16-574  Washington, D C : September 6, 2016  Information Security: FDA Needs to Rectify Control Weaknesses That Place Industry and Public Health Data at Risk  GAO-16-513  Washington, D C : August 30, 2016  Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority  GAO-16-686  Washington, D C : August 26, 2016  Federal Hiring: OPM Needs to Improve Management and Oversight of Hiring Authorities  GAO-16-521  Washington, D C : August 2, 2016  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 
Report 2:  The awards include (1) scholarships for candidates enrolled in preparatory or undergraduate prerequisite courses in preparation for entry to a health professions school, (2) pre-graduate scholarships for candidates enrolled in courses leading to a bachelor’s degree, including pre-medicine, pre-dentistry, and pre-podiatry, and (3) health professions scholarships for candidates who are enrolled in an eligible health profession degree program  According to IHS, in fiscal year 2017, there were 805 new scholarship applications submitted  After evaluating the applications, 331 applications were deemed eligible for funding, and the program was able to fund 108 new awards  The IHS Scholarship program also reviewed applications from previously awarded scholars who were continuing their education  In fiscal year 2017, 154 continuation awards were funded  In addition to the scholarship program, according to IHS officials, the agency funds two medical students enrolled at the Uniformed Service University of the Health Sciences each year  Each graduate agrees to a 10-year obligation to IHS after medical school graduation and completion of training  In future years, IHS endeavors to fund two additional medical students at the Uniformed Service University of Health Sciences  Externships and internships  IHS provides scholarship recipients with opportunities to receive clinical experience in IHS facilities  In fiscal year 2017, the agency funded 94 students, who were employed for 30 to 120 workdays per calendar year  In addition, IHS provides externships to students temporarily called to active duty as Commissioned Corps officers through the Commissioned Officer Student Training and Extern Program (COSTEP)  IHS officials said that the agency funded about 60-70 students in COSTEP in 2016  IHS also offers a Virtual Internship program through a partnership with the Department of State  Virtual interns spend 10 hours a week from September through May working remotely on their projects, which have included producing bilingual Navajo and English videos for rural health clinics, developing Navajo-specific health education materials on palliative care, improving behavioral health data collection methods, and creating social media strategies and campaigns for health promotion  For the 2017-2018 academic year, about 15 students are participating in virtual internships with IHS  Residency rotations  IHS service units offer rotation opportunities for medical, nursing, optometry, dental, and pharmacy residents as a recruitment tool because research shows students are likely to stay and practice medicine in the area where they studied  For example, the Oklahoma City area has a Memorandum of Agreement with the Oklahoma State College of Medicine, which permits area officials to annually recruit up to two residents from the current year’s residency class to become federal employees while completing their residency program  For every year that IHS sponsors the residents’ position at the university, the resident has a one-year service obligation  In addition, IHS officials from Chinle stated that the service unit participates in educational agreements with numerous universities and residency programs to host medical students, nursing students, and medical residents for rotations  According to officials, recent graduates from residency programs applying for permanent positions with the Chinle Comprehensive Health Care Facility often cite prior rotations at the service unit, or word of mouth from students or residents who have rotated through the service unit, as a reason for applying  The IHS Pharmacy Resident Program is another recruitment program that offers residency training to pharmacists who are willing to serve in high-need locations  Pharmacy residents who are Commissioned Corps officers are required to complete 2 years of service at an IHS federal or tribal facility  Twenty-six Commissioned Corps and civilian pharmacists participate in the Pharmacy Residency Program  See app  II for information on residency programs at tribally operated facilities  IHS officials said they have conducted webinars and career fairs in an attempt to connect with health professional students  For example, in 2016, IHS conducted two informational webinars to recruit Commissioned Corps applicants to facilities in the Great Plains area with critical clinical vacancies  According to IHS officials, approximately 60 applicants attended the two webinars, resulting in 15 nurse hires  In addition, Nashville area officials stated that the area office conducted a marketing campaign at the National Congress of American Indians Conference  Officials explained that the area office provided information about desirable aspects of living in the Nashville area and collected e-mail addresses and areas of interest from potential job candidates  IHS’s Office of Human Resources also partners with HRSA’s Bureau of Health Workforce by participating in nationwide virtual career fairs to promote the National Health Service Corps scholarship and loan repayment opportunities  IHS has also worked with the Office of the Surgeon General to increase the recruitment and retention of Commissioned Corps officers  In May 2017, the Office of the Surgeon General gave IHS priority access to new Commissioned Corps leads—meaning IHS has at least 30 days to make contact with potential applicants to the Commissioned Corps before other agencies have the opportunity to contact them  According to IHS officials, since being given priority access to Commissioned Corps leads, the agency has made 20 direct clinical care selections, of which 15 have entered on duty  In addition to its recruitment and retention strategies, IHS uses strategies to mitigate the negative effects of vacancies by helping to maintain patient access to services, and helping to reduce provider burnout when positions are vacant  Specifically, IHS provides telehealth services; implements alternative staffing models, including hiring nurse practitioners and physician assistants in lieu of physicians; temporarily assigns Commissioned Corps officers to alternate duty stations as needed; and contracts with temporary providers  IHS’s telehealth services include two agency-wide programs that provide teleophthalmology and telebehavioral health services  Teleophthalmology  The IHS Joslin Vision Network (IHS-JVN) Teleophthalmology Program provides annual diabetic eye exams to AI/AN patients in almost all IHS areas with federally operated facilities  According to IHS, patients’ retinal images are scanned locally and sent to a reading center where doctors interpret the images and report back  Officials told us the IHS-JVN program examined 22,000 patients in 2016  Telebehavioral health  The Telebehavioral Health Center of Excellence provides direct care services through video conferencing to patients at remote facilities from providers at IHS facilities that are able to provide the services  These services are provided in all IHS areas with federally operated facilities, and more than 5,800 patient visits occurred in 2016  Additionally, officials told us there are regional telebehavioral health programs, such as in the Oklahoma City area that, combined with the Telebehavioral Health Center of Excellence, saw over 10,000 patients in 2016  IHS officials stated that patients appreciate the telebehavioral services in their communities, because they are the only behavioral health services available in many communities  The IHS psychiatrist who provides services is located in Oklahoma City because, according to IHS officials, it is easier to recruit providers to a more urban location  In addition to these agency-wide telehealth programs, IHS officials identified multiple other local telehealth arrangements that facility staff have developed to help maintain patient access to medical services  For example, there is a diabetes consultant for the Portland area who conducts telenutrition services  There is also a teledermatology program for the Phoenix Area federal facilities operated out of the Phoenix Indian Medical Center  Additionally, several service units—including Pine Ridge Hospital, Rosebud Hospital, and the Sioux San Medical Center—have contracts for emergency department telehealth services  Figure 7 shows telehealth equipment in the Rosebud Hospital emergency department  Staff from multiple facilities told us they have implemented alternative staffing models to focus on hiring for non-physician practitioner positions because these positions are slightly easier to fill  For example, Northern Navajo Medical Center officials told us the facility, facing an emergency department physician shortage, hired physician assistants and nurse practitioners instead  These officials said they converted two physician positions into four physician assistant and nurse practitioner positions  In addition, Chinle officials stated that they added two physician assistants to the urgent care department due to complaints about patient wait times, and patient wait times have decreased as a result  Officials also mentioned dental therapists as an additional type of clinical professional who may be added to the Chinle Health Care Facility staffing model because the service unit has been unable to recruit and retain enough dentists to meet patient need  IHS officials stated that they have worked with the Office the Surgeon General to deploy Commissioned Corps officers, mainly to the Great Plains area, and have also coordinated voluntary temporary duty assignments of Commissioned Corps officers (within IHS and from other agencies) to temporarily fill staffing shortages or meet other mission- critical needs  IHS officials stated that Commissioned Corps officers may also be temporarily assigned to an IHS site to provide services, such as behavioral health support during a suicide cluster  IHS officials from 9 of the 10 geographic areas with federally operated facilities and all seven facilities in our review told us they regularly use temporary contract providers—such as through locum tenens contracts and contracts with university fellowship programs—to maintain patient access to care when positions are vacant  Locum tenens  Officials from the Kayenta Health Center said they contract with temporary providers to compensate for vacancies, and the facility contracts with about 9 providers who rotate to fill 3 vacant emergency department positions  Officials from the Portland area stated that they use temporary providers when there is a staffing shortage with providers  They explained that the Portland area has provider vacancies that have been open for years, and temporary providers fill these vacancies for an extended period of time, usually with a rotating series of providers  Chinle Health Care Facility officials said temporary providers, when of sufficiently high quality, have been recruited to join the permanent corps of civilian service staff  However, they told us locum tenens can cost between $50,000-$200,000 more annually than permanent physicians’ salaries, exclusive of benefits, depending on the specialties and hourly rates associated with the contracts  They said they are finding that increasingly higher hourly rates are needed to ensure a sufficient supply of high-quality temporary providers  IHS officials at all levels of the agency told us they prefer to hire permanent providers, rather than use locum tenens contracts  Facility officials explained that persistent turnover in temporary staff may jeopardize continuity of care  For example, Sioux San Medical Center officials expressed concern about the quality of the care provided by temporary contractors, as well as the consistency of the care provided because the contractors rotate frequently  IHS officials told us that many providers prefer to be on contract due to the higher compensation rates as a contractor, even when taking federal benefits into account  University physicians  IHS officials explained that area offices may also contract with university fellowship programs to provide visiting providers  For example, according to IHS, the Chinle Health Care Facility has entered into long-term contractual agreements with two academic fellowship programs—University of California-San Francisco Health Program and the University of Utah Global Health Fellowship  Officials told us these programs provide U S  residency- trained, board certified physicians interested in global health to work 6-month assignments alternating with another fellow at an international site  In addition, IHS officials stated that the Navajo area office is collaborating with the University of California-San Francisco and its global health fellowship to assign global health fellows to a Navajo Area site for 6 months out of each year  The officials explained that 24 fellows were placed in Navajo-area facilities in 2017 at costs substantially lower than that of locum tenens contracts  According to IHS, the Great Plains area office has collaborated with the University of Washington’s global health fellowship program to assign global health fellows in Internal Medicine to Pine Ridge Hospital for 11- month placements  Agency-wide information on the extent to which facilities use these temporary providers, and the amount spent on them, is not readily available to IHS leadership  While IHS has agency-wide information on vacancies through the Capital Human Resource Management System, IHS delegates the acquisitions process for temporary provider contracts to the head of each area-level Contracting Office  Therefore, agency-wide information on the number of full-time equivalent employees that are temporary providers working at IHS facilities, as well as the cost of these providers, is not readily available  As discussed, officials we spoke with at IHS facilities told us that temporary providers can cost more depending on the specialties and hourly rates  Without agency-wide information on the extent to which such providers are used, IHS is not fully informed about facilities’ reliance and expenditures on temporary providers or their potential effect on patient care, which is inconsistent with federal internal control standards regarding the availability of relevant information to facilitate management decision making and performance monitoring  Specifically, federal internal controls standards state that agency management should obtain, process, and use quality information to make informed decisions and evaluate the agency’s performance in achieving key objectives and addressing risks  IHS’s lack of agency-wide information on the costs and number of temporary providers used at its facilities impedes its ability to make decisions about how best to target its resources to address gaps in provider staffing and ensure that health services are available and accessible across IHS facilities  Maintaining a stable clinical workforce capable of providing quality and timely care is critical for IHS to ensure that comprehensive health services are available and accessible to American Indian/Alaska Native people  However, despite efforts to recruit and retain providers, IHS continues to face considerable challenges to overcome its long-standing struggle to fill sizeable provider vacancies, including geographic isolation and limited amenities  Although IHS is authorized to offer recruitment and retention incentives, such as loan repayments and subsidized housing, the demand for these incentives has been greater than the agency can meet due to resource constraints  However, more complete information on contract providers could help IHS officials make decisions on where to better target its limited resources to address gaps in provider staffing and ensure that health services are available and accessible to American Indian/Alaska Native people across IHS facilities  We are making the following recommendation to IHS: The Director of IHS should obtain, on an agency-wide basis, information on temporary provider contractors, including their associated cost and number of full-time equivalents, and use this information to inform decisions about resource allocation and provider staffing  (Recommendation 1) We provided a draft of this report to HHS and the Department of Veterans Affairs (VA) for review and comment  We received written comments from HHS that are reprinted in appendix III  HHS concurred with our recommendation  In its comments, HHS stated that IHS plans to update its policies by December 2018 to include a centralized reporting mechanism requirement for all temporary contracts issued for providers  HHS also stated that, upon finalization of the policy, IHS will broadly incorporate and implement the reporting mechanism agency-wide and maintain it on an annual basis  HHS also provided technical comments, which we incorporated as appropriate  VA provided comments on a draft of this report in an email, stating that VA officials continue to work to improve recruitment and retention of providers at VHA to ensure that they have the correct number of providers with the appropriate skills  We are sending copies of this report to HHS, the Department of Veterans Affairs, and appropriate congressional committees  In addition, the report will be available at no charge on GAO’s website at http://www gao gov/  If you or your staff have any questions about this report, please contact me at (202) 512-7114 or farbj@gao gov  Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report  Other major contributors to this report are listed in appendix IV  Appendix I: Provider Vacancies with the Indian Health Service (IHS) IHS data collected in November 2017, included the number of positions and vacancies for several types of providers, including physicians, nurses, dentists, pharmacists, nurse practitioners, certified registered nurse anesthetists, certified nurse midwives, and physician assistants  Most of these positions are in the 8 of 12 IHS areas in which IHS has substantial direct care responsibilities  Vacancies for nurse practitioners, nurse midwives, dentists, pharmacists, and physician assistants are provided in this appendix  Nurse practitioners  Nationwide, 97 of 303 positions were vacant in November 2017, and vacancy rates in the 8 areas in which IHS has substantial direct care responsibilities ranged from 12 percent in the Oklahoma City area to 47 percent in the Albuquerque area  (See fig  8) Certified nurse midwives  Nationwide, 8 of 55 positions were vacant in November 2017  See table 1  Dentists  Nationwide, 81 of 306 positions were vacant in November 2017 and vacancy rates in the 8 areas in which IHS has substantial direct care responsibilities ranged from 14 percent in the Phoenix area to 39 percent in the Bemidji area  (See fig  9 ) Pharmacists  Nationwide, 80 of 637 positions were vacant in November 2017 and vacancy rates in the 8 areas in which IHS has substantial direct care responsibilities ranged from 3 percent in the Bemidji area to 17 percent in the Albuquerque area  (See fig  10 ) Physician assistants  Nationwide, 37 of 125 positions were vacant in November 2017  See table 2  Tribal officials from the Chickasaw Nation and Choctaw Nation described their use of strategies to address vacancies, which were very similar to strategies used by the Indian Health Service (IHS)  Like the IHS, one tribe uses the availability of housing units near its medical facility as a recruitment tool for health care providers  Both tribes that described their strategies to recruit and retain providers told us they use their physician residency program in Family Medicine as a recruitment tool  Availability of housing units near the medical facility  Tribal officials from the Choctaw Nation told us the tribe uses housing units—58 housing units that range from studio apartments to multi- room houses—as a recruitment strategy for providers  The provider housing units are occupied by physicians, as well as by physician residents who need housing during their residency or for medical students doing clinical rotations through the facility  According to tribal officials, a factor they considered in making housing units available for providers was the location of its hospital in a rural area of Oklahoma, in a town with a population of about 1,000, which lacks sufficient housing  In September 2017, tribal officials told us all the available housing units were occupied, and the tribe was in the process of constructing at least two 4-bedroom houses  See fig  11 for photos of a completed multi-room house and one under construction  Offering the housing units to provider staff is also part of the tribe’s overall strategy of offering quality-of-life benefits to attract and retain providers  Implementing Accredited Physician Residency Programs  Tribal officials we interviewed noted that they developed physician training programs—specifically graduate medical education, commonly known as residency training—which they use as an important recruitment tool for physicians  One tribe has implemented its Family Medicine residency program, while the other tribe intends for its Family Medicine residency program to be operational in July 2018  Both residency programs are accredited by the American Osteopathic Association, in addition to the American College of Osteopathic Family Practice for one tribe and the American Council for Graduate Medical Education for the other tribe  One program is accredited for 3 resident physicians per year for a total of 9 physician residents at a time, while the other program is accredited for 4 resident physicians per year  We previously found that physicians may practice in geographic areas similar to those where they complete their residency training  Tribal officials with the implemented Family Medicine residency program told us it is successful in that they hired 7 of the 9 residents who completed the residency program  There is also a retention benefit—current providers have the opportunity to stay up-to-date on the latest medical treatment methods by serving as either mentors or as faculty for the residents  In addition to the contact named above, Kathleen M  King (Director), Ann Tynan (Assistant Director), Kelly DeMots (Assistant Director/Analyst-in- Charge), Sam Amrhein, Kristen Anderson, Muriel Brown, Kaitlin Farquharson, Peter Mann-King, Maria Ralenkotter, Lisa Rogers, and Jennifer Whitworth made key contributions to this report 

ground_truth: Congressional interest in Overseas Contingency Operation (OCO) funding has continued as Members debate ways of funding priorities without breaching discretionary spending limits set in law. Since the terrorist attacks of September 11, 2001, Congress has appropriated approximately $2 trillion in discretionary budget authority designated as emergency requirements or for Overseas Contingency Operations/Global War on Terrorism (OCO/GWOT) in support of the broad U.S. government response to the 9/11 attacks and for other related international affairs activities. This figure amounts to approximately 9.4% of total discretionary spending during this period. Congress has used supplemental appropriation acts or designated funding for emergency requirements or OCO/GWOT—or both—in statute. These funds are not subject to limits on discretionary spending in congressional budget resolutions or to the statutory discretionary spending limits established by the Budget Control Act of 2011 (BCA; P.L. 112-125). The Balanced Budget and Emergency Deficit Control Act of 1985 (BBEDCA; P.L. 99-177) allows emergency funding to be excluded from budget control limits. The BCA added the OCO/GWOT designation to the BBEDCA exemption, thereby providing Congress and the President with an alternate way to exclude funding from the BCA spending limits. While there is no overall statutory limit on the amount of emergency or OCO/GWOT spending, both Congress and the President have fundamental roles in determining how much of the spending to provide each fiscal year. Congress must designate any such funding in statute on an account-by-account basis. The President is also required to designate it as such after it is appropriated to be available for expenditure. Debate over what should constitute OCO/GWOT or emergency activities and expenses has shifted over time, reflecting differing viewpoints about the extent, nature, and duration of U.S. military operations in Afghanistan, Iraq, Syria, and elsewhere. Funding designated for OCO/GWOT has also been used to fund base-budget requirements of the DOD and State Department and to prevent or respond to crises abroad, including armed conflict, as well as human-caused and natural disasters. Some defense officials and policymakers argue OCO funding allows for flexible response to contingencies, and provides a "safety valve" to the spending caps and threat of sequestration—the automatic cancellation of budget authority largely through across-the-board reductions of nonexempt programs and activities—under the BCA. Critics, however, have described OCO/GWOT as a loophole or "gimmick"—morphing from an account for replacing combat losses of equipment, resupplying expended munitions, and transporting troops through war zones, to a "slush fund" for activities unrelated to contingency operations. Congress appropriated approximately $103 billion for OCO in FY2017 (8.5% of all discretionary appropriations), $78 billion for OCO in FY2018 (5.5% of all discretionary appropriations), and $68.8 billion for OCO so far in FY2019. Discretionary appropriations for FY2019 are not yet final; a continuing resolution expired December 21, 2018. Following passage of the Bipartisan Budget Act of 2018 (P.L. 115-123), which raised discretionary budget caps for defense and foreign affairs agencies in FY2018 and FY2019, the Administration proposed shifting some OCO funding into the base, or regular, budget. Although Congress has generally not followed Administration requests for reduced funding for foreign affairs and domestic activities and has increased funding for defense, the President has asked cabinet secretaries to propose spending cuts of 5% in FY2020. Such proposals, if requested in a budget submission, may create difficult choices for Congress in FY2020 and FY2021—the final two years of the BCA discretionary spending limits. Congress's decisions on OCO/GWOT designations will affect how much agency funding is available for military operations and foreign affairs activities overseas, how much is subject to the BCA caps, and how much is incorporated into regular budgets and long-term budget projections.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: This report provides background information and potential oversight issues for Congress on war-related and other international emergency or contingency-designated funding since FY2001  Since the terrorist attacks of September 11, 2001, Congress has appropriated approximately $2 trillion in discretionary budget authority designated for emergencies or OCO/GWOT in support of the broad U S  government response to the 9/11 attacks and for other related international affairs activities  This figure includes $1 8 trillion for the Department of Defense (DOD), $154 billion for the Department of State and U S  Agency for International Development (USAID), and $3 billion for the Department of Homeland Security (DHS) and Coast Guard (see Figure 1 )  This CRS report is meant to serve as a reference on certain funding designated as emergency requirement s or for Overseas Contingency Ope rations/Global War on Terrorism (OCO/GWOT), as well as related budgetary and policy issues  It does not provide an estimate of war costs within the OCO/GWOT account (all of which may not be for activities associated with war or defense) or such costs in the DOD base budget or other agency funding (which may be related to war activities, such as the cost of health care for combat veterans)  For additional information on the FY2019 budget and related issues, see CRS Report R45202, The Federal Budget: Overview and Issues for FY2019 and Beyond , by [author name scrubbed]; CRS In Focus IF10942, FY2019 National Defense Authorization Act: An Overview of H R  5515 , by [author name scrubbed] and [author name scrubbed]; and CRS Report R45168, Department of State, Foreign Operations and Related Programs: FY2019 Budget and Appropriations , by [author name scrubbed], [author name scrubbed], and [author name scrubbed]  For additional information on the Budget Control Act as amended, see CRS Report R44874, The Budget Control Act: Frequently Asked Questions , by [author name scrubbed] and [author name scrubbed], and CRS Report R44039, The Defense Budget and the Budget Control Act: Frequently Asked Questions , by [author name scrubbed]  For additional information on U S  policy in Afghanistan and the Middle East, see CRS Report R45122, Afghanistan: Background and U S  Policy , by [author name scrubbed], CRS Report R45096, Iraq: Issues in the 115th Congress , by [author name scrubbed], and CRS Report RL33487, Armed Conflict in Syria: Overview and U S  Response , coordinated by [author name scrubbed]  Congress may consider one or more supplemental appropriations bills (colloquially called supplementals) for a fiscal year to provide funding for unforeseen needs (such as a response to a national security threat or a natural disaster), or to increase appropriations for other activities that have already been funded  Supplemental appropriations measures generally provide additional funding for selected activities over and above the amount provided through annual or continuing appropriations  Throughout the 20 th century, Congress relied on supplemental appropriations to fund war-related activities, particularly in the period immediately following the start of hostilities  For example, in 1951, a year after the start of the Korean War, Congress approved DOD supplemental appropriations totaling $32 8 billion ($268 billion in constant FY2019 dollars)  In 1952, DOD supplemental appropriations totaled just $1 4 billion ($11 billion in constant FY2019), as the base budget incorporated costs related to the war effort  A similar pattern occurred, to varying degrees, during the Vietnam War and 1990-1991 Gulf War  During the post-9/11 conflicts, primarily conducted in Afghanistan and Iraq but also in other countries, Congress has, for an extended period and to a much greater degree than in previous conflicts in the 20 th century, appropriated supplemental and specially designated funding over and above the base DOD budget—that is, funding for planned or regularly occurring costs to man, train, and equip the military force  Since FY2001, DOD funding designated for OCO/GWOT has averaged 17% of the department's total budget authority (see Figure 2 )  By comparison, during the conflict in Vietnam—the only other to last more than a decade—DOD funding designated for non-base activities averaged 6% of the department's total budget authority  Supplemental appropriations can provide flexibility for policymakers to address demands that arise after funding has been appropriated  However, that flexibility has caused some to question whether supplementals should only be used to respond to unforeseen events, or whether they should also provide funding for activities that could reasonably be covered in regular appropriations acts  Congress used supplemental appropriations to provide funds for defense and foreign affairs activities related to operations in Afghanistan and Iraq following 9/11, and each subsequent fiscal year through FY2010  Initially understood as reflecting needs that were not anticipated during the regular appropriations cycle, supplemental appropriations were generally enacted as requested, and almost always designated as emergency requirements  Beginning in FY2004, DOD received some of its war-related funding in its regular annual appropriations; these funds were designated as emergency  When funding needs for war and non-war-related activities were higher than anticipated, the Bush Administration submitted supplemental requests  In the FY2011 appropriations cycle, the Obama Administration moved away from submitting supplemental appropriations requests to Congress for war-related activities and used the regular budget and appropriation process to fund operations  This approach implied that while the funds might be war-related, they largely supported predictable ongoing activities rather than unanticipated needs  In concert with this change in budgetary approach, the Obama Administration began formally using the term Overseas Contingency Op erations in place of the Bush Administration's term Global War on Terror   Both the Obama and Trump Administrations requested that OCO funding be designated in a manner that would effectively exempt such funding from the BCA limits on discretionary defense spending  Currently, there is no overall procedural or statutory limit on the amount of emergency or OCO/GWOT-designated spending that may be appropriated on an annual basis  Both Congress and the President have roles in determining how much emergency or OCO/GWOT spending is provided to federal agencies each fiscal year  Such spending must be designated as such within the President's budget request for congressional consideration  The President must separately designate the spending after Congress enacts appropriations for it to be available for expenditure  The emergency funding designation predated the OCO/GWOT designation  Through definitions statutorily established by the Balanced Budget and Emergency Deficit Control Act of 1985 (BBEDCA; P L  99-177 ), spending designated as emergency requirements is for "unanticipated" purposes, such as those that are "sudden     urgent     unforeseen     and temporary " The BBEDCA does not further specify the types of activities that are eligible for that designation  Thus, any discretionary funding designated by Congress and the President as being for an emergency is effectively exempted from certain statutory and procedural budget enforcement mechanisms, such as the BCA limits on discretionary spending  Debate of what should constitute OCO/GWOT or emergency activities and expenses has shifted over time, reflecting differing viewpoints about the extent, nature, and duration of U S  military operations in Afghanistan, Iraq, Syria, and elsewhere  Over the years, both Congress and the President have at times adopted more, and at times less, expansive definitions of such designations to accommodate the strategic, budgetary, and political needs of the moment  Prior to February 2009, U S  operations in response to the 9/11 attacks were collectively referred to as the Global War on Terror , or GWOT  Between September 2001 and February 2009, there was no separate budgetary designation for GWOT funds—instead, funding associated with those operations was designated as an emergency requirement  The term OCO was not applied to the post-9/11 military operations in Iraq and Afghanistan until 2009  In February 2009, the Obama Administration released A New Era of Responsibili ty: Renewing America's Promise , a presidential fiscal policy document  That document did not mention or reference GWOT; instead, it used the term OCO in reference to ongoing military operations in Iraq and Afghanistan  The first request for emergency funding for OCO—not GWOT—was delivered to Congress in April 2009  Since the FY2010 budget cycle, DOD has requested both base budget and OCO funding as part of its annual budget submission to Congress  Beginning with the National Defense Authorization Act for Fiscal Year 2010 (NDAA; P L  111-84 ), the annual defense authorization bills have referenced the authorization of additional appropriations for OCO rather than the names of U S  military operations conducted primarily in Afghanistan and Iraq  In 2011, the BCA ( P L  112-125 ) amended the BBEDCA to create the Overseas Contingency Ope rations/Global War on Terrorism designation, which provided Congress and the President with an alternate way to exempt funding from the BCA caps without using the emergency designation  Beginning with the Consolidated Appropriations Act, 2012 ( P L  112-74 ), annual appropriations bills have referenced the OCO/GWOT designation  The foreign affairs agencies began formally requesting OCO/GWOT funding in FY2012, distinguishing between what is referred to as enduring, ongoing or base costs versus any extraordinary, temporary costs of the State Department and USAID in supporting ongoing U S  operations and policies in Iraq, Afghanistan, and Pakistan  Congress, having used OCO/GWOT exemption for DOD, adopted this approach for foreign affairs, though its uses for State, Foreign Operations, and Related Programs (SFOPS) activities have never been permanently defined in statute  For the first foreign affairs OCO/GWOT appropriation, in FY2012, funds were provided for a wide range of recipient countries beyond the countries in the President's request, including Yemen, Somalia, Kenya, and the Philippines  In addition to country-specific uses, OCO/GWOT-designated funds were also appropriated for the Global Security Contingency Fund  All budgetary legislation is subject to a set of enforcement procedures associated with the Congressional Budget Act of 1974 ( P L  93-344 ), as well as other rules, such as those imposed by the Budget Control Act of 2011 ( P L  112-125 ) as amended  Those rules provide mechanisms to enforce both procedural and statutory limits on discretionary spending  Enacted on August 2, 2011, the BCA as amended sets limits on defense and nondefense spending  As part of an agreement to increase the statutory limit on public debt, the BCA aimed to reduce annual federal budget deficits by a total of at least $2 1 trillion from FY2012 through FY2021, with approximately half of the savings to come from defense  The spending limits (or caps ) apply separately to defense and nondefense discretionary budget authority  The caps are enforced by a mechanism called sequestration   Sequestration automatically cancels previously enacted appropriations (a form of budget authority) by an amount necessary to reach prespecified levels  The BCA effectively exempted certain types of discretionary spending from the statutory limits, including funding designated for OCO/GWOT  As a result, Congress and the President have designated funding for OCO to support activities that, in previous times, had been funded within the base budget  This was done, in part, as a response to the discretionary spending limits enacted by the BCA  By designating funding for OCO for certain activities not directly related to contingency operations, Congress and the President can effectively continue to increase topline defense, foreign affairs, and other related discretionary spending without triggering sequestration  Congress has repeatedly amended the legislation to raise the spending limits (thus lowering its deficit-reduction effect by corresponding amounts)  Congress has passed four bills that revised the automatic spending caps initially established by the BCA, including the following: American Taxpayer Relief Act of 2012 (ATRA; P L  112-240 ); Bipartisan Budget Act of 2013 (BBA 2013; P L  113-67 ); Bipartisan Budget Act of 2015 (BBA 2015; P L  114-74 ); and Bipartisan Budget Act of 2018 (BBA 2018; P L  115-123 )  On February 9, 2018, three days before President Donald Trump submitted his FY2019 budget request, Congress passed the Bipartisan Budget Act of 2018 (BBA 2018, P L  115-123 )  The act raised the discretionary spending limits set by the BCA from $1 069 trillion for FY2017 to $1 208 trillion for FY2018 and to $1 244 trillion for FY2019  The BBA 2018 increased FY2019 discretionary defense funding levels (excluding OCO) by the largest amounts to date—$85 billion, from $562 billion to $647 billion, and nondefense funding (including SFOPS) by $68 billion, from $529 billion to $597 billion  It did not change discretionary spending limits for FY2020 and FY2021  DOD documents indicate the department in recent years has used OCO funding for activities viewed as unrelated to war  For example, the department's FY2019 budget request estimates $358 billion in OCO funding from FY2015 through FY2019  Of that amount, DOD categorizes $68 billion (19%) for activities unrelated to operations in Afghanistan, Iraq, and Syria  These activities are described as "EDI/Non-War," referring in part to the European Deterrence Initiative, and "Base-to-OCO," referring to OCO funding used for base-budget requirements  Similarly, a DOD Cost of War report from June 2018 shows $1 8 trillion in war-related appropriations from FY2001 through FY2018 for operations primarily conducted in Afghanistan, Iraq, and Syria  Of that total, DOD categorizes $219 billion (12%) as other than "war funds " These funds are described as "Classified," "Modularity," "Fuel (non-war)," "Noble Eagle (Base)," and "Non-War " International affairs agencies also began increasing the share of their budgets designated for OCO, and applying the designation to an increasing range of activities apparently unrelated to conflicts  OCO as a share of the international affairs budget grew from about 21% in FY2012 to nearly 35% in FY2017  Unlike DOD, however, the State Department and USAID have not specified whether any OCO-designated funds are considered part of the agencies' base budgets  According to a DOD budget document from FY2016, the Obama Administration planned to "transition all enduring costs currently funded in the OCO budget to the base budget beginning in 2017 and ending by 2020 " The plan was to describe "which OCO costs should endure as the United States shifts from major combat operations, how the Administration will budget for the uncertainty surrounding unforeseen future crises, and the implications for the base budgets of DOD, the Intelligence Community, and State/OIP  This transition will not be possible if the sequester-level discretionary spending caps remain in place " The BCA remained in effect and OCO funding was used for base-budget requirements  Some defense officials and policymakers say OCO funding enables a flexible and timely response to an emergency or contingency and provides a political and fiscal safety valve to the BCA caps and threat of sequestration  They say if OCO funding were not used in such a manner and discretionary spending limits remained in place, DOD and other federal agencies would be forced to cut base budgets and revise strategic priorities  For example, former Defense Secretary Jim Mattis has said if Congress allows the FY2020 and FY2021 defense spending caps to take effect, the 2018 National Defense Strategy, which calls for the United States to bolster its military advantage against potential competitors such as Russia and China, "is not sustainable " Critics, including Acting White House Chief of Staff Mick Mulvaney, have described the OCO account as a "slush fund" for military and foreign affairs spending unrelated to contingency operations  Mulvaney, former director of the White House Office of Management and Budget (OMB), has described the use of OCO funding for base budget requirements as "budget gimmicks " Critics argue what was once generally restricted to a fund for replacing combat losses of equipment, resupplying expended munitions, transporting troops to and through war zones, and distributing foreign aid to frontline states has "ballooned into an ambiguous part of the budget to which government financiers increasingly turn to pay for other, at times unrelated, costs " OMB criteria for OCO funding include the combat losses of ground vehicles, aircraft, and other equipment; replenishment of munitions expended in combat operations; facilities and infrastructure in the theater of operations; transport of personnel, equipment, and supplies to and from the theater; among other items and activities  Determining which activities are directly related, tangentially related, or unrelated to war operations is often a point of debate  Some have questioned the use of OCO funding to purchase F-35 fighter jets: "It is jumping the shark     There's no pretense that it has anything to do with the region " Others have argued it makes sense for the military to use OCO funding to purchase new aircraft to replace planes used in current conflicts and no longer in production: "What are the conditions that are making the combatant commanders and those with train/equip authority to say, 'We need more of this?'" Congress has appropriated approximately $2 trillion in discretionary budget authority for war-related and other international emergency or contingency-designated activities since 9/11  This figure is a CRS estimate of funding designated for emergencies or OCO/GWOT in support of the broad U S  government response to the 9/11 attacks, as well as other foreign affairs activities, from FY2001 through FY2019  This includes $1 8 trillion for DOD, $154 billion for the Department of State and USAID, and $3 billion for DHS and the Coast Guard (see Table 1 )  These figures do not include emergency-designated funding appropriated in this period for domestic programs, such as disaster response  From FY2001 through FY2009, DOD received $1 8 trillion in appropriations for OCO/GWOT, or approximately 17% of the department's total discretionary budget authority of $10 8 trillion during the period  The department's OCO/GWOT funding peaked in FY2008 both in terms of nominal dollars, at $186 9 billion, and as a share of its discretionary budget, at 28 1% (see Figure 3 ), after the Bush Administration surged additional U S  military personnel to Iraq  The department's OCO funding also increased as a share of its discretionary spending from FY2009 to FY2010 following the Obama Administration's deployment of more U S  military personnel to Afghanistan, and again in FY2017 following enactment of legislation in response to the Trump Administration's request for additional appropriations  In FY2019, the department's OCO/GWOT funding totaled $68 8 billion, or 10% of its discretionary spending  In terms of appropriations titles, more than two-thirds of OCO/GWOT funding since FY2001 has been for Operation and Maintenance (O&M)—nearly double the percentage of base budget funding for O&M over the same period (see Figure 4 )  O&M funds pay for the operating costs of the military such as fuel, maintenance to repair facilities and equipment, and the mobilization of forces  DOD describes "war-related operational costs" as operations, training, overseas facilities and base support, equipment maintenance, communications, and replacement of combat losses and enhancements  In terms of the military services, more than half (55%) of OCO/GWOT funding since FY2001 has gone to the Army—more than double the percentage of base budget funding for the service during this period (see Figure 5 )  Emergency appropriations were initially provided as general "defense-wide" appropriations  Beginning in FY2003, as operations evolved and planning developed, allocations increased and were specifically provided for the services  OCO funding for DOD has not decreased at the same rate as the number of U S  troops in Afghanistan, Iraq, and Syria has decreased  For example, the number of U S  military personnel in Afghanistan, Iraq, and Syria decreased from a peak of 187,000 personnel in FY2008 (including 148,000 in Iraq and 39,000 in Afghanistan) to an assumed level of nearly 18,000 personnel in FY2019 (including 11,958 personnel in Afghanistan and 5,765 personnel in Iraq and Syria)—a decline of approximately 169,000 personnel (90%)  Meanwhile, OCO funding decreased from a peak of $187 billion in FY2008 to $69 billion in FY2019—a decline of approximately $118 billion (63%)  While the number of U S  forces in Afghanistan, Iraq, and Syria has decreased since FY2009, the number of U S  troops deployed or stationed elsewhere to support those personnel has fallen by a lesser degree and, in recent years, remained relatively steady  For example, the number of support forces—that is, personnel from units and forces operating outside of Afghanistan, Iraq, Syria, and other countries (including those stationed in the continental United States or otherwise mobilized) decreased from 112,000 personnel in FY2009 to an assumed level of 76,073 personnel in FY2019—a decline of 35,927 personnel (32%)  In addition, when these support forces are combined with in-country force levels, the total force level decreases by a percentage more similar to the OCO budget, from 297,000 personnel in FY2009 to an assumed level of 93,796 personnel in FY2019—a decline of 203,204 personnel (68%) (see Figure 6 )  Some of these support forces serve in U S  Central Command's area of responsibility, which includes 20 countries in West Asia, North Africa, and Central Asia, and whose forward headquarters is based in Al Udeid Air Base in Qatar  According to DOD, the reason OCO funding has not fallen in proportion to the number of U S  troops in Afghanistan, Iraq, and Syria is "due to the fixed, and often inelastic, costs of infrastructure, support requirements, and in-theater presence to support contingency operations " For example, in FY2019, the department requested $20 billion in OCO funding for "in-theater support"—nearly 30% of the OCO request and more than any other functional category  However, some analysts have noted the U S  military's fixed costs in Afghanistan remained relatively stable at roughly $7 billion a year from FY2005 through FY2013 until after the BCA went into effect—and have since increased to roughly $32 billion a year, suggesting "that roughly $25 billion in 'enduring' or base budget costs migrated into the Afghanistan budget, effectively circumventing the budget caps  The actual funding needed for operations in Afghanistan is roughly $20 billion in FY2019 " Title 10, Section 101, of the United States Code, defines a contingency operation as any Secretary of Defense-designated military operation "in which members of the armed forces are or may become involved in military actions, operations, or hostilities against an enemy of the United States or against an opposing military force " Since the 1990s NATO intervention in the Balkans, DOD Financial Management Regulations (FMR) have defined contingency operations costs as those expenses necessary to cover incremental costs "that would not have been incurred had the contingency operation not been supported " Such incremental costs would not include, for example, base pay for troops or planned equipment modernization, as those expenditures are normal peacetime needs of the DOD  In September 2010, the Office of Management and Budget (OMB), in collaboration with DOD, issued criteria for the department to use in making war/overseas contingency operations funding requests (see Appendix A )  In January 2017, the Government Accountability Office (GAO) concluded the criteria for deciding whether items belong in the base budget or OCO funding "are outdated and do not address the full scope of activities" in the budget request  "For example, they do not address geographic areas such as Syria and Libya, where DOD has begun military operations; DOD's deterrence and counterterrorism initiatives; or requests for OCO funding to support requirements not related to ongoing contingency operations" it states  Section 1524 of the National Defense Authorization Act for Fiscal Year 2018 ( P L  115-91 ), directed the Secretary of Defense to "update the guidelines regarding the budget items that may be covered by overseas contingency operations accounts " Congress has enacted legislation directing DOD to compile reports on the costs of certain contingency operations  Section 1266 of the National Defense Authorization Act for Fiscal Year 2018 ( P L  115-91 ) directs the Secretary of Defense to submit the Department of Defense Supplemental and Cost of War Execution report, known as the Cost of War report, on a quarterly basis to the congressional defense committees and the GAO: "Not later than 45 days after the end of each fiscal year quarter, the Secretary of Defense shall submit to the congressional defense committees and the Comptroller General of the United States the Department of Defense Supplemental and Cost of War Execution report for such fiscal year quarter " The conference report accompanying the Department of Defense and Labor, Health and Human Services, and Education Appropriations Act, 2019 and Continuing Appropriations Act, 2019 ( P L  115-245 ) requires DOD to report incremental costs for operations in Afghanistan, Iraq, and other countries in the U S  Central Command area of responsibility and directs: the Secretary of Defense to continue to report incremental costs for all named operations in the Central Command Area of Responsibility on a quarterly basis and to submit, also on a quarterly basis, commitment, obligation, and expenditure data for the Afghanistan Security Forces Fund, the Counter-Islamic State of Iraq and Syria Train and Equip Fund, and for all security cooperation programs funded under the Defense Security Cooperation Agency in the Operation and Maintenance, Defense-Wide Account  DOD's June 2018 Cost of War report to Congress details $1 5 trillion in obligations associated with certain contingency operations from FY2001 through FY2018  That figure includes $757 1 billion for those conducted primarily in Iraq—Operation Iraqi Freedom (OIF), Operation New Dawn (OND), and Operation Inherent Resolve (OIR); $727 7 billion for those conducted primarily in Afghanistan—Operation Enduring Freedom (OEF) and Operation Freedom's Sentinel (OFS); and $27 8 billion for those conducted primarily in the United States (see Table 2 and Figure 7 )  DOD's quarterly Cost of War reports are intended to provide Congress, GAO, and other stakeholders insight into the how the department obligates war-related appropriations  The reports include base and OCO obligations related to war activities, as well as obligation data broken down by certain major operations, service, component, agency, and appropriation  However, as GAO has noted, "the proportion of OCO appropriations not associated with specific operations identified in the statutory Cost of War reporting requirement has trended upward" in part because the criteria DOD uses for making OCO funding requests is outdated and not always used  More recently, the June 2018 Cost of War report does not appear to reference three recently classified overseas contingency operations targeting militants affiliated with al-Qaeda and the Islamic State of Iraq and Syria (ISIS): Operation Yukon Journey in the Middle East, Northwest Africa Counterterrorism, and East Africa Counterterrorism  Some observers have noted other limitations to Cost of War reports, such as incomplete accounting of costs, limited distribution of the documents and underlying data, and formatting that makes it difficult to reconcile the data with information contained in budget justification documents  Between FY2001 and FY2018, Congress appropriated a total of $154 billion in OCO funds for State Department and USAID  For FY2018 (the most recent full-year appropriations for foreign affairs agencies), OCO funding amounted to 22% of the total appropriations for State Department, Foreign Operations and Related Programs appropriation  The Obama Administration's FY2012 International Affairs budget request was the first to include a request for OCO funds for "extraordinary and temporary costs of operations in Iraq, Afghanistan, and Pakistan " At the time, the Administration indicated that the use of this designation was intended to provide a transparent, whole-of-government approach to the exceptional war-related costs incurred in those three countries, thus better aligning the associated military and civilian costs  This first foreign affairs OCO request identified the significant resource demands placed on the State Department as a result of the transitions from military-led to civilian-led missions in Iraq and Afghanistan, as well as the importance of a stable Pakistan for the U S  effort in Afghanistan  The FY2012 foreign affairs OCO request included: for Iraq, funding for the U S  Embassy in Baghdad, consulates throughout Iraq, security costs in light of the then-planned U S  military withdrawal, a then-planned civilian-led Police Development and Criminal Justice Program, military and development assistance in Iraq, and oversight of U S  foreign assistance through the Special Inspector General for Iraq Reconstruction; for Afghanistan, funding to strengthen the Afghan government and build institutional capacity, support State/USAID and other U S  government agency civilians deployed in Afghanistan, provide short-term economic assistance to address counterinsurgency and stabilization efforts, and provide oversight of U S  foreign assistance programs in Afghanistan through the Office of the Special Inspector General for Afghanistan Reconstruction; and for Pakistan, funding to support U S  diplomatic presence and diplomatic security in Pakistan, provide Pakistan Counterinsurgency Capability Funds (PCCF) to train and equip Pakistani forces to eliminate insurgent sanctuaries and promote stability and security in neighboring Afghanistan and the region  In subsequent years, the Administration designated certain State Department activities in Syria and other peacekeeping activities as OCO, and Congress accepted and broadened this expanded use of OCO in annual appropriations  In the FY2017 budget request, the Administration further broadened its use of State OCO funds, applying the designation to funds for countering Russian aggression, counterterrorism, humanitarian assistance, and aid to Africa  In addition to OCO funds requested through the normal appropriations process, the Administration in recent years requested emergency supplemental funding (designated as OCO) to support State/USAID efforts in countering the Islamic State and to respond to global health threats such as the Ebola and Zika viruses  For FY2019, the Trump Administration requested no OCO/GWOT funding for the Department of State and USAID, although the FY2019 House and Senate SFOPS bills ( H R  6385 and S  3108 , 115 th Congress) would have appropriated approximately $8 billion in OCO-designated funding for various priorities  The estimated $154 1 billion in emergency and OCO/GWOT appropriations enacted to date for State/USAID includes major non-war-related programs, such as aid for the 2004 tsunami along Indian Ocean coasts, 2010 earthquake in Haiti, 2013 Ebola outbreak in West Africa, and 2015 worldwide outbreak of the Zika virus; as well as diplomatic operations (e g , paying staff, providing security, and building and maintaining embassies)  OCO/GWOT has also funded a variety of foreign aid programs, ranging from the Economic Support Fund to counter-narcotics in Afghanistan, Pakistan, and Iraq, among other activities in other countries  Figure 8 depicts the emergency or OCO appropriations for foreign affairs activities  Since 2012, when the OCO designation was first used for foreign affairs, more OCO funds have been appropriated than were requested each year, and those have also been authorized to be used in additional countries  Since January 2002, approximately $3 billion of post-9/11 emergency and OCO-designated funding has been provided to the U S  Coast Guard (USCG) for its traditional homeland security missions and for USCG operations in support of U S  Navy activities  This funding has been provided at various times as either an appropriation to the Coast Guard's operating expenses accounts, or as a transfer from Navy accounts to the Coast Guard  Open-source information on the use of those funds has varied  One FY2009 supplemental appropriations request included funding as a transfer, with the intent of funding "Coast Guard operations in support of OIF and OEF, as well as other classified activities " The FY2017 OCO request for annual appropriations for Navy Operations and Maintenance included $163 million for Coast Guard operational support for the deployment of patrol boats to the Northern Arabian Gulf and a port security unit to Guantanamo Bay, among other pay and equipment expenses  The Trump Administration initially requested a total of $89 billion in OCO funding for FY2019  All the funding was requested by DOD  In an amendment to the budget after Congress raised the BCA spending caps as part of the Bipartisan Budget Act of 2018 (BBA 2018; P L  115-123 ), the Administration removed the OCO designation from $20 billion of the funding, in effect, shifting that amount into the DOD base budget request  In a statement on the budget amendment, Mulvaney said the request fixes "long-time budget gimmicks" in which OCO funding has been used for base budget requirements  Beginning in FY2020, "the Administration proposes returning to OCO's original purpose by shifting certain costs funded in OCO to the base budget where they belong," he wrote  Of the revised amount of $69 billion requested for DOD OCO funding in FY2019: $46 3 billion (67%) was for Operation Freedom's Sentinel (OFS) in Afghanistan and related missions; $13 billion (22%) for Operation Inherent Resolve (OIR) in Iraq and Syria and related missions; $4 8 billion (9%) for the European Deterrence Initiative (EDI) to boost the U S  military presence in eastern Europe to deter Russian military aggression; and $0 9 billion (1%) for security cooperation (see Figure 9 )  The FY2019 OCO budget assumes a total force level (average annual troop strength) of 93,796 personnel  That figure includes: 11,958 primarily in Afghanistan (OFS); 5,765 primarily in Iraq and Syria (OIR); 59,463 for in-theater support; and 16,610 primarily in the continental United States (CONUS) or otherwise mobilized (see Figure 10 )  The number of personnel actually in-country or in-theater at any given time may exceed or fall below those assumed levels  The FY2019 force level assumes an increase of 3,153 personnel (3 5%) from the FY2018 assumed level, all of which is assumed for in-theater support  (For analysis of troop level and budget trends, see the section, " Trends in OCO Funding and Troop Levels ," earlier in this report ) As previously discussed, DOD acknowledges "OCO funding has not declined at the same rate as the in-country troop strength … due to the fixed, and often inelastic, costs of infrastructure, support requirements, and in-theater presence to support contingency operations " The departments lists the following as OCO cost drivers: In-theater support, including infrastructure costs like command, control, communications, computers, and intelligence (C4I) and base operations for U S  Central Command (CENTCOM) locations; Persistent demand for combat support such as intelligence, surveillance, and reconnaissance (ISR) assets used to enhance force protection; Equipment reset, which lags troop level changes and procurement of contingency-focused assets like munitions, unmanned aerial vehicles and force protection capabilities that may not be linked directly to in-country operations; and International programs and deterrence activities, which are linked to U S  engagement in contingency operations and support U S  interests but are not directly proportional to U S  troop presence  DOD also breaks down the FY2019 OCO budget request by functional category (see Table 3 )  By this measure, the largest portion of OCO funding was $20 billion for in-theater support, followed by operations and force protection (including the incremental cost of military operations in Afghanistan, Iraq, Syria, and other countries), at $14 7 billion; and unspecified classified programs, at $9 9 billion  According to the Congressional Budget Office (CBO), approximately $47 billion (68%) of the FY2019 OCO budget request consists of enduring activities—that is, "those that would probably continue in the absence of overseas conflicts"—that could be funded in the DOD base budget  CBO associates enduring activities with the following DOD functional categories: in-theater support, classified programs, equipment reset and readiness, European Deterrence Initiative, security cooperation, and joint improvised-threat defeat  Executive Branch budget documents for FY2019 show differing projections for how much OCO would be apportioned over the Future Years Defense Program (also known as the FYDP, pronounced "fiddip," the five-year period from FY2019 through FY2023)  For example, Table 1-11 in DOD's National Defense Budget Estimates for FY2019, citing OMB data, projects five-year OCO funding at $359 billion  However, Table 1-9 of the same document puts the figure at $149 billion after assuming a higher amount of OCO funding shifting into the base budget  According to OMB, the President's initial FY2019 budget request projected increasing caps on defense discretionary base budget authority by $84 billion (15%) to $660 billion in FY2020 and by $87 billion (15%) to $677 billion in FY2021  It also projected defense funding for Overseas Contingency Operations (OCO) totaling $73 billion in FY2020 and $66 billion in FY2021  Thus, projected defense discretionary funding would total $733 billion in FY2020 and $743 billion in FY2021  FY2019 DOD budget documents show the same defense discretionary topline for FY2020 and FY2021  But they list an "Outyears Placeholder for OCO" of $20 billion in fiscal years FY2020-FY2023, and an "OCO to Base" amount of $53 billion in FY2020 and $45 8 billion in each year from FY2021-FY2023  The documents do not break down what accounts or activities are included in these amounts  The emergence of any new contingencies or conflicts would likely change DOD assumptions about OCO needs  Congress has appropriated a total of $68 8 billion for DOD OCO funding in FY2019, including the following amounts: $67 9 billion in defense funds provided in the Department of Defense and Labor, Health and Human Services, and Education Appropriations Act, 2019 and Continuing Appropriations Act, 2019 ( P L  115-245 ), which Congress passed on September 26, 2018; and $921 million in defense funds provided in the Energy and Water, Legislative Branch, and Military Construction and Veterans Affairs Appropriations Act, 2019 ( P L  115-244 ), which Congress passed on September, 21, 2018  For the Department of State and USAID, as well as the Department of Homeland Security and U S  Coast Guard, FY2019 OCO levels have not yet been determined  They remain at prorated FY2018 levels because of continuing resolutions (CR) to fund certain agencies through December 21, 2018  The FY2019 House and Senate SFOPS bills ( H R  6385 and S  3108 , 115 th Congress) would have appropriated approximately $8 billion in OCO-designated funding for various priorities  The House committee-reported version of the Homeland Security appropriations bill ( H R  6776 , 115 th Congress) would not have appropriated any OCO/GWOT funding for the Coast Guard, while the Senate committee-reported version of the bill ( S  3109 , 115 th Congress) would have appropriated $165 million for OCO/GWOT funding for the Coast Guard  Any decision by the 116 th Congress to change discretionary defense and nondefense spending limits that remain in effect for FY2020 and FY2021 under the Budget Control Act (BCA; P L  112-25 ) could impact future OCO funding levels  Lawmakers may consider the following questions: Will Congress keep the BCA as is and rely on OCO funding that is not subject to the caps to meet agency requirements? Will Congress repeal the BCA and use less OCO funding? Will Congress amend the BCA limits for future years and continue to use OCO funding, as it has in the past? Will Congress significantly reduce DOD and international affairs funding to stay within the BCA caps and not use OCO funding? In a November 2018 report, the National Defense Strategy Commission, a bipartisan panel created by Congress, issued recommendations related to OCO and the BCA  Recommendation No  24 states, "Congress should eliminate the final two years of caps under the BCA " Recommendation 29 states, "To better prepare for major-power competition, Congress should gradually integrate OCO spending back into the base Pentagon budget  This also requires a dollar-for-dollar increase in the BCA spending caps, should they remain in force, so that this transfer does not result in an overall spending cut " Both House and Senate FY2019 committee-reported appropriations bills from the 115 th Congress included about $8 billion in OCO funding for State/USAID  It remains to be seen if the 116 th Congress will pass this OCO level as requested or extend the continuing resolution  Congress could enact legislation to authorize and appropriate a level of base and OCO spending to meet current or revised discretionary defense spending caps in any number of ways  In FY2019 budget documents from OMB and DOD, the Trump Administration projected increasing defense spending in FY2020 and FY2021 beyond the statutory limits of the Budget Control Act of 2011 ( P L  112-25 ), but by differing amounts based on differing OCO projections  These figures serve as possible scenarios or options for Congress to consider  According to OMB budget documents, the President's initial FY2019 budget request projected $733 billion in defense discretionary spending in FY2020, including a base budget of $660 billion (which assumes an $84 billion, or 15%, increase in the BCA defense cap—or repeal of the legislation altogether) and an OCO defense budget of $73 billion (see Figure 11 )  According to DOD budget documents, the President's revised FY2019 budget request projected $733 billion in defense discretionary spending in FY2020, including a base budget of $713 billion (which assumes a $137 billion, or 24%, increase in the BCA defense cap—what would be the largest increase to the BCA defense caps yet—or repeal of the legislation altogether) and an OCO budget of $20 billion  Alternatively, assuming no change in the cap and congressional support for the Administration's projected $733 billion topline in FY2020, Congress could keep the BCA defense cap unchanged at $576 billion and designate an additional $157 billion for OCO  According to OMB budget documents, the President's initial FY2019 budget request projected $743 billion in defense discretionary spending in FY2021, including a base budget of $677 billion (which assumes an $87 billion, or 15%, increase in the BCA defense cap—or repeal of the legislation altogether) and an OCO budget of $66 billion (see Figure 11 )  According to DOD budget documents, the President's revised FY2019 budget request projected $743 billion in defense discretionary spending in FY2021, including a base budget of $723 billion (which assumes a $133 billion, or 23%, increase in the BCA defense cap—or repeal of the legislation altogether) and an OCO budget of $20 billion  Alternatively, assuming no change in the cap and congressional support for the Administration's projected $743 billion topline in FY2020, Congress could keep the BCA defense cap unchanged at $590 billion and designate an additional $153 billion for OCO  As previously discussed, these figures would change with different toplines for the national defense budget function (050)  Former Defense Secretary Jim Mattis and the National Defense Strategy Commission have recommended that Congress increase the defense budget between 3% and 5% a year above inflation ("real growth") to meet U S  strategic goals  President Donald Trump has said the discretionary defense spending request would total $700 billion in FY2020, a decrease of 2% in nominal terms from FY2019  Trump said, "We know what the budget—the new budget is for the Defense Department  It will probably be $700 billion " However, some media outlets have since reported that the President intends to request a discretionary defense budget of $750 billion in FY2020  Senator James Inhofe, chairman of the Senate Armed Services Committee, and Representative Mac Thornberry, ranking member of the House Armed Services Committees in the 116 th Congress, have argued, "Any cut in the defense budget would be a senseless step backward " Thornberry has also said transferring recurring OCO costs into the regular budget "makes sense … it makes for more predictable budgeting, but it's all about what happens on the topline " Representative Adam Smith, chairman of the House Armed Services Committee in the 116 th Congress, has said of the defense budget: "I think the number is too high, and it's certainly not going to be there in the future … We've got a debt, we've got a deficit, we've got infrastructure problems, we've got healthcare, education—there's a whole lot that is necessary to make our country safe, secure, and prosperous " Acting Defense Secretary Patrick Shanahan has talked about a flat topline for national defense: "When you look at the $700 billion, it's not just for one year drop down, [or] a phase, it's a drop and then held constant" over the FYDP  Under Secretary of Defense (Comptroller)/Chief Financial Officer David Norquist, who is also performing the duties of the Deputy Secretary of Defense, at one time was reportedly preparing two budgets for FY2020—one assuming $733 billion for national defense and another assuming $700 billion  An analyst has noted "returning enduring OCO costs to the base budget, particularly a vast majority of those enduring costs over a short period as DOD has outlined, could significantly complicate an agreement between congressional Democrats and Republicans to increase both the defense and nondefense BCA budget caps for FY2020 and FY2021 " As analyst noted, "OCO has become an even less-defined pot of money … Congress needs to properly question the DOD budget planners on the future of OCO " In a January 2017 report, GAO concluded, "Without a reliable estimate of DOD's enduring OCO costs, decision makers will not have a complete picture of the department's future funding needs or be able to make informed choices and trade-offs in budget formulation and decision making " The department states it has not fully estimated those costs in part because of the BCA  In a response to GAO, DOD wrote, "Developing reliable estimates of enduring OCO costs is an important first step to any future effort to transition enduring OCO costs to the base budget  In the context of such an effort, the Department would consider developing and reporting formal estimates of those costs  However, until there is sufficient relief from the budgetary caps established in the Budget Control Act of 2011, the Department will need OCO to finance counterterrorism operations, in particular [OFS] and [OIR] " In an October 2018 report, the Congressional Budget Office estimated OCO funding for DOD enduring activities—that is, those that would probably continue in the absence of overseas conflicts—totaled more than $50 billion a year (in 2019 dollars) from 2006 to 2018—and are projected to total about $47 billion a year starting in FY2020  This figure appears to be consistent with projections published by DOD  According to the department's FY2019 budget documents, DOD projected $53 billion for "OCO to Base" in FY2020 and $45 8 billion for "OCO to Base" for FY2021 through FY2023  Some analysts have concluded: Uncertainty created by current reliance on OCO, particularly to fund base budget needs, could be detrimental to national security on three levels: (a) by undermining budget controls and contributing thereby to larger deficits, (b) by generating insecurity in the defense workforce and in defense suppliers, and (c) by creating long-term uncertainty in defense planning  The alternative, transitioning longer-term OCO expenses to the base budget, could be achieved through a combination of increased budget caps, targeted cuts in inefficient Defense programs, and increased revenues  For example, a potential enduring activity in the OCO budget is the European Deterrence Initiative (EDI)  It was previously known as the European Reassurance Initiative (ERI), an effort that began in June 2014 to increase the number of U S  military personnel and prepositioned equipment in Central and Eastern Europe intended in part to reassure NATO allies after Russia's military seized Crimea  As some analysts have noted, "Because it is in the OCO part of the budget request, EDI funding does not include a projection for how much funding will be allocated in future years, which can create uncertainty in the minds of allies and adversaries alike about the U S  military's commitment to the program " On the other hand, some contend that it is precisely EDI's flexibility that allows the commander of European Command to quickly respond to changing security and posture needs in Europe, and ensure that monies intended for European deterrence will not be redirected to other DOD priorities  In its November 2018 report, the National Defense Strategy Commission quoted the late military strategist Bernard Brodie, who wrote "strategy wears a dollar sign " The panel concluded that relying on OCO funding to increase the defense budget "is not the way to provide adequate and stable resources" for the type of great power competition outlined in the Secretary of Defense's 2018 National Defense Strategy (NDS), which calls for the United States to bolster its competitive military advantage relative to threats posed by China and Russia: Because of budgetary constraints imposed by the BCA, lawmakers and the Department of Defense have increasingly relied upon the overseas contingency operations (OCO) fund to pay for warfighting operations in the greater Middle East, as well as other activities and initiatives  Yet this approach to resourcing has produced problems and distortions of its own  For one thing, the amount of money devoted to OCO since the BCA was enacted no longer corresponds to warfighting operations in the greater Middle East  Furthermore, such operations are no longer a top priority as articulated in the NDS  Finally, reorienting the military toward high-end competition and conflict will require new capabilities beyond the current program of record  OCO is not the way to provide adequate and stable resources for such a long-term endeavor, given its lack of predictability and the limitations on what OCO funds can be used to buy " Appendix A  Statutes, Guidance, and Regulations The designation of funding as emergency requirements or for Overseas Contingency Operations/Global War on Terrorism (OCO/GWOT) is governed by several statues as well as Office of Management and Budget (OMB) guidance and the Department of Defense (DOD) Financial Management Regulation (FMR)  The Balanced Budget and Emergency Deficit Control Act (BBEDCA) of 1985 BBEDCA, as amended, includes the statutory definitions of emergency and unanticipated as they relate to budget enforcement through sequestration  The act also allows for appropriations to be designated by Congress and the President as emergency requirements or for Overseas Contingency Operations/Global War on Terrorism   Such appropriations are effectively exempt from the statutory discretionary spending limits  Title 10, United States Code—Armed Forces 10 U S C  101—Definitions Section 101 provides definitions of terms applicable to Title 10  While it does not define overseas contingency operations, it does include a definition of a contingency operations   Administration and Internal Guidance In addition to statutory requirements, the DOD and the Department of State are subject to guidance on OCO spending from the Administration  In October 2006 , under the Bush Administration, then-Deputy Secretary of Defense Gordon England directed the services to break with long-standing DOD regulatory policies and expand their request for supplemental funding to reflect incremental costs related to the "longer war on terror " There was no specific definition for the "longer war on terror," now one of the core missions of the DOD  In February 2009, at the beginning of the Obama Administration, the Office of Management and Budget (OMB) issued updated budget guidance that required DOD to move some OCO costs back into the base budget  However, within six months of issuing the new criteria, officials waived restrictions related to pay and that would have prohibited end-strength growth  In a letter from OMB to the then-Under Secretary of Defense (Comptroller) Robert Hale, the agency characterized its 2009 criteria as "very successful" for delineating base and OCO spending but stated, "This update clarifies language, eliminates areas of confusion and provides guidance for areas previously unanticipated " GAO subsequently reported that the revised guidance significantly changed the criteria used to build the fiscal year 2010 OCO funding request by: specifying stricter definitions for repair and procurement of equipment; limiting applicability of OCO funds for RDT&E; excluding pay and allowances for end-strength above the level requested in the budget; excluding enduring family support initiatives; and excluding base realignment and closures (BRAC) amounts  OMB again revised its guidance in September 2010 following a number of GAO reports that had concluded DOD reporting on OCO costs was of "questionable reliability," due in part to imprecisely defined financial management regulations related to OCO spending  (as of September 9, 2010) Source: Letter from Steven M  Kosiak, Associate Director for Defense and Foreign Affairs, OMB, to Robert Hale, Under Secretary of Defense, Comptroller, "Revised War Funding Criteria," September 9, 2010  DOD Financial Management Regulations DOD incorporated the September 2010 OMB criteria for war costs into the Financial Management Regulation  Table 1 includes the general cost categories DOD uses in accounting for costs of contingency operations  Appendix B  Transfer Authorities, Special Purpose Accounts In addition to the supplemental appropriations and emergency or OCO/GWOT designation, the Department of Defense and the Department of State also have the authority to shift funds from one budget account to another in response to operational needs  For DOD, these transfers (sometimes called reprogramings ) are statutorily authorized by 10 U S C  2214—Transfer of funds: procedures and limitations  This authority allows the Secretary of Defense to reallocate funds for higher priority items, based on unforeseen military requirements, after receiving written approval from the four congressional defense committees  DOD may also reprogram funds within an account from one activity to another, as long as the general purpose for the use of those funds remains unchanged  Specific limits to transfer or reprogramming authorities have also been added to these general authorities through provisions in annual defense authorization and appropriation acts  The FY2019 defense appropriations bill sets the base budget transfer cap at $4 billion and the OCO transfer cap at $2 billion  The Department of State's OCO transfer authority has been provided in appropriations acts and has specifically authorized the Administration to transfer OCO funds only to other OCO funds within Title VIII SFOPS appropriations, not between OCO and base accounts  The transfer authority is capped, specified by account, and requires regular congressional notification procedures  Overseas Contingency Operations Transfer Fund (OCOTF) The OCOTF was established for DOD in FY1997 as a no year transfer account (meaning amounts are available until expended) in order to provide additional flexibility to meet operational requirements  Transfers from the OCOTF are processed using existing reprogramming procedures  A quarterly report is submitted to the congressional oversight committees, documenting all transfers from the OCOTF to DOD components base budget accounts  Beginning in FY2002, funds to support Southwest Asia, Kosovo, and Bosnia contingency requirements were appropriated directly to DOD components' Operation and Maintenance (O&M) and Military Personnel accounts rather than to the OCOTF for later disbursement  FY2014 was the last year the Administration requested a direct appropriation to the OCOTF  Contingency Operations Funded in the DOD Base Budget As first mandated by section 8091 of the Department of Defense Appropriations Act, 2008 ( P L  110-116 ), Congress has required DOD to provide separate annual budget justification documents detailing the costs of U S  armed forces' participation in all named contingency operations where the total cost of the operation exceeds $100 million or is staffed by more than 1,000 U S  military personnel  Funding for certain DOD contingency operations has been moved to the base budget request, and is no longer designated as emergency or OCO/GWOT requirements  This movement of funding from the OCO request to the base budget request typically occurs as the operational activities of an enduring contingency operation evolve over time and DOD determines that certain elements of the associated military operations have become stable enough to be planned, financed, and executed within the base budget  For example, funding for Operation Noble Eagle, which provides fighter aircraft on 24/7 alert at several U S  military bases, was moved from the GWOT request to the base budget request in 2005  Contingency operations and other activities funded wholly or in part through DOD's base budget have included: NATO Operations in the Balkans   The U S  Army and U S  Air Force provide support to the North Atlantic Treaty Organization-led operations in the Balkans region  Most U S  forces are deployed to Kosovo in support of the NATO-led Kosovo Force (KFOR)  A small number of U S  personnel are deployed to the NATO headquarters in Sarajevo in Bosnia and Herzegovina; Joint Task Force - Bravo   U S  forces support this task force, which operates from Soto Cano Air Base in Honduras and supports joint, combined, and interagency exercises and operations in Central America to counter the influence of transnational organized crime; carry out humanitarian assistance and disaster relief; and build military capacity with regional partners and allied nations to promote regional cooperation and security; Operation Juniper Shield  Previously known as Operation Enduring Freedom-Trans Sahara (OEF-TS), this operation supports efforts to defeat violent extremist organizations in East Africa  This operation also provides military-to-military engagement with partner African countries, as well as readiness for crisis response and evacuation of U S  military, diplomatic, and civilian personnel; Operation Noble Eagle   This operation funds the continuing efforts to defend the United States from airborne attacks, maintain the sovereignty of the United States airspace, and defend critical U S  facilities from potentially hostile threats or unconventional attacks; Operation Enduring Freedom- Horn of Africa   This operation was established to support efforts to defeat violent extremist organizations in East Africa; provide military-to-military engagement with partner African countries, as well as readiness for crisis response and evacuation of U S  military, diplomatic, and civilian personnel throughout East Africa; Operation Enduring Freedom- Caribbean and Central America   A U S  regional military operation initiated in 2008, under the operational control of Special Operations Command-South, this operation was established to focus on counterterrorism to support DOD's overall military objectives and the larger fight against terrorism  Operation Observant Compass   This operation was established to support the deployment of approximately 100 U S  military personnel assisting the Ugandan People's Defense Force and neighboring partner African countries in countering the Lord's Resistance Army operations  Operation Spartan Shield  This operation was established to support ongoing U S  Central Command missions  Other Congressionally Authorized Funds or Programs Through the OCO authorization and appropriation process, Congress has created numerous funds and programs that are designed to finance specific overseas contingency operations-related activities that do not fit into traditional budgetary accounts  Many of these funds and programs are supplied with amounts that are available until expended—however, authorization for the specified fund or program has an expiration date, thereby requiring further congressional action for reauthorization of affected funds or programs  Congress has also provided increased transfer authority to provide greater flexibility for U S  government activities in situations that are typically unpredictable  Examples of these types of congressionally authorized OCO programs or funds have included: Afghan istan Security Forces Fund (ASFF) and Counter-ISIS Train and Equip Fund (CTEF)   These funds were established to provide funding and support for the training, equipping, and expansion of selected military and security forces in support of U S  objectives; Counterterrorism Partnership s Fund   This fund was established to provide funding and support to partner nations engaged in counterterrorism and crisis response activities; Command er's Emergency Response Program  This program was established to support infrastructure improvements, such as road repair and construction and enable military commanders on the ground to respond to urgent humanitarian relief and reconstruction needs by undertaking activities that will immediately aid local populations and assist U S  forces in maintaining security gains; Joint Improvised Explosive Device (IEDs) Defeat Fund   This fund was established to coordinate and focus all counter-IED efforts, including ongoing research and development, throughout DOD  Due to the enduring nature of the threat, DOD began moving associated funding to the base budget in FY2010; Mine Resistant Ambush Protected Vehicle (MRAP) Fund   This fund was intended to expedite the procurement and deployment of MRAPs to Iraq and Afghanistan; European Deterrence Initiative (EDI)   Initially the European Reassurance Initiative (ERI), this effort was established to provide funding and support to NATO allies and partners to "reassure allies of the U S  commitment to their security and territorial integrity as members of the NATO Alliance, provide near-term flexibility and responsiveness to the evolving concerns of our allies and partners in Europe, especially Central and Eastern Europe, and help increase the capability and readiness of U S  allies and partners;" Global Security Contingency Fund   This fund was established to provide funding for the Department of State and the Department of Defense "to facilitate an interagency approach to confronting security challenges;" Complex Crise s Fund   This fund was established to provide funding through the State Department and USAID "to help prevent crises and promote recovery in post-conflict situations during unforeseen political, social, or economic challenges that threaten regional security;" Migration and Refugee Assistance Fund   This fund was established to provide funding to respond to refugee crises in Africa, the Near East, South and Central Asia, and Europe and Eurasia; and Ukraine Security Assistance Initiative   This initiative was established to provide assistance, including training, equipment, lethal weapons, of a defensive nature; logistics support; supplies and services; sustainment; and intelligence support to the military and national security forces of Ukraine  This is an update to a report originally co-authored by [author name scrubbed], former CRS Specialist in Defense Readiness and Infrastructure  It references research previously compiled by [author name scrubbed], former CRS Specialist in U S  Defense Policy and Budget; Christopher Mann, Analyst in Defense Policy and Trade; [author name scrubbed], Analyst in U S  Defense Acquisition Policy; [author name scrubbed], CRS Specialist on Congress and the Legislative Process; and [author name scrubbed], CRS Analyst in Public Finance  [author name scrubbed], Research Assistant, helped compile the graphics 


Report 2:  The awards include (1) scholarships for candidates enrolled in preparatory or undergraduate prerequisite courses in preparation for entry to a health professions school, (2) pre-graduate scholarships for candidates enrolled in courses leading to a bachelor’s degree, including pre-medicine, pre-dentistry, and pre-podiatry, and (3) health professions scholarships for candidates who are enrolled in an eligible health profession degree program  According to IHS, in fiscal year 2017, there were 805 new scholarship applications submitted  After evaluating the applications, 331 applications were deemed eligible for funding, and the program was able to fund 108 new awards  The IHS Scholarship program also reviewed applications from previously awarded scholars who were continuing their education  In fiscal year 2017, 154 continuation awards were funded  In addition to the scholarship program, according to IHS officials, the agency funds two medical students enrolled at the Uniformed Service University of the Health Sciences each year  Each graduate agrees to a 10-year obligation to IHS after medical school graduation and completion of training  In future years, IHS endeavors to fund two additional medical students at the Uniformed Service University of Health Sciences  Externships and internships  IHS provides scholarship recipients with opportunities to receive clinical experience in IHS facilities  In fiscal year 2017, the agency funded 94 students, who were employed for 30 to 120 workdays per calendar year  In addition, IHS provides externships to students temporarily called to active duty as Commissioned Corps officers through the Commissioned Officer Student Training and Extern Program (COSTEP)  IHS officials said that the agency funded about 60-70 students in COSTEP in 2016  IHS also offers a Virtual Internship program through a partnership with the Department of State  Virtual interns spend 10 hours a week from September through May working remotely on their projects, which have included producing bilingual Navajo and English videos for rural health clinics, developing Navajo-specific health education materials on palliative care, improving behavioral health data collection methods, and creating social media strategies and campaigns for health promotion  For the 2017-2018 academic year, about 15 students are participating in virtual internships with IHS  Residency rotations  IHS service units offer rotation opportunities for medical, nursing, optometry, dental, and pharmacy residents as a recruitment tool because research shows students are likely to stay and practice medicine in the area where they studied  For example, the Oklahoma City area has a Memorandum of Agreement with the Oklahoma State College of Medicine, which permits area officials to annually recruit up to two residents from the current year’s residency class to become federal employees while completing their residency program  For every year that IHS sponsors the residents’ position at the university, the resident has a one-year service obligation  In addition, IHS officials from Chinle stated that the service unit participates in educational agreements with numerous universities and residency programs to host medical students, nursing students, and medical residents for rotations  According to officials, recent graduates from residency programs applying for permanent positions with the Chinle Comprehensive Health Care Facility often cite prior rotations at the service unit, or word of mouth from students or residents who have rotated through the service unit, as a reason for applying  The IHS Pharmacy Resident Program is another recruitment program that offers residency training to pharmacists who are willing to serve in high-need locations  Pharmacy residents who are Commissioned Corps officers are required to complete 2 years of service at an IHS federal or tribal facility  Twenty-six Commissioned Corps and civilian pharmacists participate in the Pharmacy Residency Program  See app  II for information on residency programs at tribally operated facilities  IHS officials said they have conducted webinars and career fairs in an attempt to connect with health professional students  For example, in 2016, IHS conducted two informational webinars to recruit Commissioned Corps applicants to facilities in the Great Plains area with critical clinical vacancies  According to IHS officials, approximately 60 applicants attended the two webinars, resulting in 15 nurse hires  In addition, Nashville area officials stated that the area office conducted a marketing campaign at the National Congress of American Indians Conference  Officials explained that the area office provided information about desirable aspects of living in the Nashville area and collected e-mail addresses and areas of interest from potential job candidates  IHS’s Office of Human Resources also partners with HRSA’s Bureau of Health Workforce by participating in nationwide virtual career fairs to promote the National Health Service Corps scholarship and loan repayment opportunities  IHS has also worked with the Office of the Surgeon General to increase the recruitment and retention of Commissioned Corps officers  In May 2017, the Office of the Surgeon General gave IHS priority access to new Commissioned Corps leads—meaning IHS has at least 30 days to make contact with potential applicants to the Commissioned Corps before other agencies have the opportunity to contact them  According to IHS officials, since being given priority access to Commissioned Corps leads, the agency has made 20 direct clinical care selections, of which 15 have entered on duty  In addition to its recruitment and retention strategies, IHS uses strategies to mitigate the negative effects of vacancies by helping to maintain patient access to services, and helping to reduce provider burnout when positions are vacant  Specifically, IHS provides telehealth services; implements alternative staffing models, including hiring nurse practitioners and physician assistants in lieu of physicians; temporarily assigns Commissioned Corps officers to alternate duty stations as needed; and contracts with temporary providers  IHS’s telehealth services include two agency-wide programs that provide teleophthalmology and telebehavioral health services  Teleophthalmology  The IHS Joslin Vision Network (IHS-JVN) Teleophthalmology Program provides annual diabetic eye exams to AI/AN patients in almost all IHS areas with federally operated facilities  According to IHS, patients’ retinal images are scanned locally and sent to a reading center where doctors interpret the images and report back  Officials told us the IHS-JVN program examined 22,000 patients in 2016  Telebehavioral health  The Telebehavioral Health Center of Excellence provides direct care services through video conferencing to patients at remote facilities from providers at IHS facilities that are able to provide the services  These services are provided in all IHS areas with federally operated facilities, and more than 5,800 patient visits occurred in 2016  Additionally, officials told us there are regional telebehavioral health programs, such as in the Oklahoma City area that, combined with the Telebehavioral Health Center of Excellence, saw over 10,000 patients in 2016  IHS officials stated that patients appreciate the telebehavioral services in their communities, because they are the only behavioral health services available in many communities  The IHS psychiatrist who provides services is located in Oklahoma City because, according to IHS officials, it is easier to recruit providers to a more urban location  In addition to these agency-wide telehealth programs, IHS officials identified multiple other local telehealth arrangements that facility staff have developed to help maintain patient access to medical services  For example, there is a diabetes consultant for the Portland area who conducts telenutrition services  There is also a teledermatology program for the Phoenix Area federal facilities operated out of the Phoenix Indian Medical Center  Additionally, several service units—including Pine Ridge Hospital, Rosebud Hospital, and the Sioux San Medical Center—have contracts for emergency department telehealth services  Figure 7 shows telehealth equipment in the Rosebud Hospital emergency department  Staff from multiple facilities told us they have implemented alternative staffing models to focus on hiring for non-physician practitioner positions because these positions are slightly easier to fill  For example, Northern Navajo Medical Center officials told us the facility, facing an emergency department physician shortage, hired physician assistants and nurse practitioners instead  These officials said they converted two physician positions into four physician assistant and nurse practitioner positions  In addition, Chinle officials stated that they added two physician assistants to the urgent care department due to complaints about patient wait times, and patient wait times have decreased as a result  Officials also mentioned dental therapists as an additional type of clinical professional who may be added to the Chinle Health Care Facility staffing model because the service unit has been unable to recruit and retain enough dentists to meet patient need  IHS officials stated that they have worked with the Office the Surgeon General to deploy Commissioned Corps officers, mainly to the Great Plains area, and have also coordinated voluntary temporary duty assignments of Commissioned Corps officers (within IHS and from other agencies) to temporarily fill staffing shortages or meet other mission- critical needs  IHS officials stated that Commissioned Corps officers may also be temporarily assigned to an IHS site to provide services, such as behavioral health support during a suicide cluster  IHS officials from 9 of the 10 geographic areas with federally operated facilities and all seven facilities in our review told us they regularly use temporary contract providers—such as through locum tenens contracts and contracts with university fellowship programs—to maintain patient access to care when positions are vacant  Locum tenens  Officials from the Kayenta Health Center said they contract with temporary providers to compensate for vacancies, and the facility contracts with about 9 providers who rotate to fill 3 vacant emergency department positions  Officials from the Portland area stated that they use temporary providers when there is a staffing shortage with providers  They explained that the Portland area has provider vacancies that have been open for years, and temporary providers fill these vacancies for an extended period of time, usually with a rotating series of providers  Chinle Health Care Facility officials said temporary providers, when of sufficiently high quality, have been recruited to join the permanent corps of civilian service staff  However, they told us locum tenens can cost between $50,000-$200,000 more annually than permanent physicians’ salaries, exclusive of benefits, depending on the specialties and hourly rates associated with the contracts  They said they are finding that increasingly higher hourly rates are needed to ensure a sufficient supply of high-quality temporary providers  IHS officials at all levels of the agency told us they prefer to hire permanent providers, rather than use locum tenens contracts  Facility officials explained that persistent turnover in temporary staff may jeopardize continuity of care  For example, Sioux San Medical Center officials expressed concern about the quality of the care provided by temporary contractors, as well as the consistency of the care provided because the contractors rotate frequently  IHS officials told us that many providers prefer to be on contract due to the higher compensation rates as a contractor, even when taking federal benefits into account  University physicians  IHS officials explained that area offices may also contract with university fellowship programs to provide visiting providers  For example, according to IHS, the Chinle Health Care Facility has entered into long-term contractual agreements with two academic fellowship programs—University of California-San Francisco Health Program and the University of Utah Global Health Fellowship  Officials told us these programs provide U S  residency- trained, board certified physicians interested in global health to work 6-month assignments alternating with another fellow at an international site  In addition, IHS officials stated that the Navajo area office is collaborating with the University of California-San Francisco and its global health fellowship to assign global health fellows to a Navajo Area site for 6 months out of each year  The officials explained that 24 fellows were placed in Navajo-area facilities in 2017 at costs substantially lower than that of locum tenens contracts  According to IHS, the Great Plains area office has collaborated with the University of Washington’s global health fellowship program to assign global health fellows in Internal Medicine to Pine Ridge Hospital for 11- month placements  Agency-wide information on the extent to which facilities use these temporary providers, and the amount spent on them, is not readily available to IHS leadership  While IHS has agency-wide information on vacancies through the Capital Human Resource Management System, IHS delegates the acquisitions process for temporary provider contracts to the head of each area-level Contracting Office  Therefore, agency-wide information on the number of full-time equivalent employees that are temporary providers working at IHS facilities, as well as the cost of these providers, is not readily available  As discussed, officials we spoke with at IHS facilities told us that temporary providers can cost more depending on the specialties and hourly rates  Without agency-wide information on the extent to which such providers are used, IHS is not fully informed about facilities’ reliance and expenditures on temporary providers or their potential effect on patient care, which is inconsistent with federal internal control standards regarding the availability of relevant information to facilitate management decision making and performance monitoring  Specifically, federal internal controls standards state that agency management should obtain, process, and use quality information to make informed decisions and evaluate the agency’s performance in achieving key objectives and addressing risks  IHS’s lack of agency-wide information on the costs and number of temporary providers used at its facilities impedes its ability to make decisions about how best to target its resources to address gaps in provider staffing and ensure that health services are available and accessible across IHS facilities  Maintaining a stable clinical workforce capable of providing quality and timely care is critical for IHS to ensure that comprehensive health services are available and accessible to American Indian/Alaska Native people  However, despite efforts to recruit and retain providers, IHS continues to face considerable challenges to overcome its long-standing struggle to fill sizeable provider vacancies, including geographic isolation and limited amenities  Although IHS is authorized to offer recruitment and retention incentives, such as loan repayments and subsidized housing, the demand for these incentives has been greater than the agency can meet due to resource constraints  However, more complete information on contract providers could help IHS officials make decisions on where to better target its limited resources to address gaps in provider staffing and ensure that health services are available and accessible to American Indian/Alaska Native people across IHS facilities  We are making the following recommendation to IHS: The Director of IHS should obtain, on an agency-wide basis, information on temporary provider contractors, including their associated cost and number of full-time equivalents, and use this information to inform decisions about resource allocation and provider staffing  (Recommendation 1) We provided a draft of this report to HHS and the Department of Veterans Affairs (VA) for review and comment  We received written comments from HHS that are reprinted in appendix III  HHS concurred with our recommendation  In its comments, HHS stated that IHS plans to update its policies by December 2018 to include a centralized reporting mechanism requirement for all temporary contracts issued for providers  HHS also stated that, upon finalization of the policy, IHS will broadly incorporate and implement the reporting mechanism agency-wide and maintain it on an annual basis  HHS also provided technical comments, which we incorporated as appropriate  VA provided comments on a draft of this report in an email, stating that VA officials continue to work to improve recruitment and retention of providers at VHA to ensure that they have the correct number of providers with the appropriate skills  We are sending copies of this report to HHS, the Department of Veterans Affairs, and appropriate congressional committees  In addition, the report will be available at no charge on GAO’s website at http://www gao gov/  If you or your staff have any questions about this report, please contact me at (202) 512-7114 or farbj@gao gov  Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report  Other major contributors to this report are listed in appendix IV  Appendix I: Provider Vacancies with the Indian Health Service (IHS) IHS data collected in November 2017, included the number of positions and vacancies for several types of providers, including physicians, nurses, dentists, pharmacists, nurse practitioners, certified registered nurse anesthetists, certified nurse midwives, and physician assistants  Most of these positions are in the 8 of 12 IHS areas in which IHS has substantial direct care responsibilities  Vacancies for nurse practitioners, nurse midwives, dentists, pharmacists, and physician assistants are provided in this appendix  Nurse practitioners  Nationwide, 97 of 303 positions were vacant in November 2017, and vacancy rates in the 8 areas in which IHS has substantial direct care responsibilities ranged from 12 percent in the Oklahoma City area to 47 percent in the Albuquerque area  (See fig  8) Certified nurse midwives  Nationwide, 8 of 55 positions were vacant in November 2017  See table 1  Dentists  Nationwide, 81 of 306 positions were vacant in November 2017 and vacancy rates in the 8 areas in which IHS has substantial direct care responsibilities ranged from 14 percent in the Phoenix area to 39 percent in the Bemidji area  (See fig  9 ) Pharmacists  Nationwide, 80 of 637 positions were vacant in November 2017 and vacancy rates in the 8 areas in which IHS has substantial direct care responsibilities ranged from 3 percent in the Bemidji area to 17 percent in the Albuquerque area  (See fig  10 ) Physician assistants  Nationwide, 37 of 125 positions were vacant in November 2017  See table 2  Tribal officials from the Chickasaw Nation and Choctaw Nation described their use of strategies to address vacancies, which were very similar to strategies used by the Indian Health Service (IHS)  Like the IHS, one tribe uses the availability of housing units near its medical facility as a recruitment tool for health care providers  Both tribes that described their strategies to recruit and retain providers told us they use their physician residency program in Family Medicine as a recruitment tool  Availability of housing units near the medical facility  Tribal officials from the Choctaw Nation told us the tribe uses housing units—58 housing units that range from studio apartments to multi- room houses—as a recruitment strategy for providers  The provider housing units are occupied by physicians, as well as by physician residents who need housing during their residency or for medical students doing clinical rotations through the facility  According to tribal officials, a factor they considered in making housing units available for providers was the location of its hospital in a rural area of Oklahoma, in a town with a population of about 1,000, which lacks sufficient housing  In September 2017, tribal officials told us all the available housing units were occupied, and the tribe was in the process of constructing at least two 4-bedroom houses  See fig  11 for photos of a completed multi-room house and one under construction  Offering the housing units to provider staff is also part of the tribe’s overall strategy of offering quality-of-life benefits to attract and retain providers  Implementing Accredited Physician Residency Programs  Tribal officials we interviewed noted that they developed physician training programs—specifically graduate medical education, commonly known as residency training—which they use as an important recruitment tool for physicians  One tribe has implemented its Family Medicine residency program, while the other tribe intends for its Family Medicine residency program to be operational in July 2018  Both residency programs are accredited by the American Osteopathic Association, in addition to the American College of Osteopathic Family Practice for one tribe and the American Council for Graduate Medical Education for the other tribe  One program is accredited for 3 resident physicians per year for a total of 9 physician residents at a time, while the other program is accredited for 4 resident physicians per year  We previously found that physicians may practice in geographic areas similar to those where they complete their residency training  Tribal officials with the implemented Family Medicine residency program told us it is successful in that they hired 7 of the 9 residents who completed the residency program  There is also a retention benefit—current providers have the opportunity to stay up-to-date on the latest medical treatment methods by serving as either mentors or as faculty for the residents  In addition to the contact named above, Kathleen M  King (Director), Ann Tynan (Assistant Director), Kelly DeMots (Assistant Director/Analyst-in- Charge), Sam Amrhein, Kristen Anderson, Muriel Brown, Kaitlin Farquharson, Peter Mann-King, Maria Ralenkotter, Lisa Rogers, and Jennifer Whitworth made key contributions to this report 

ground_truth: Federal agencies and the nation's critical infrastructures—such as energy, transportation systems, communications, and financial services—are dependent on information technology systems to carry out operations. The security of these systems and the data they use is vital to public confidence and national security, prosperity, and well-being. The risks to these systems are increasing as security threats evolve and become more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015. This report provides an update to the information security high-risk area. To do so, GAO identified the actions the federal government and other entities need to take to address cybersecurity challenges. GAO primarily reviewed prior work issued since the start of fiscal year 2016 related to privacy, critical federal functions, and cybersecurity incidents, among other areas. GAO also reviewed recent cybersecurity policy and strategy documents, as well as information security industry reports of recent cyberattacks and security breaches. GAO has identified four major cybersecurity challenges and 10 critical actions that the federal government and other entities need to take to address them. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities. GAO has made over 3,000 recommendations to agencies aimed at addressing cybersecurity shortcomings in each of these action areas, including protecting cyber critical infrastructure, managing the cybersecurity workforce, and responding to cybersecurity incidents. Although many recommendations have been addressed, about 1,000 have not yet been implemented. Until these shortcomings are addressed, federal agencies' information and systems will be increasingly susceptible to the multitude of cyber-related threats that exist. GAO has made over 3,000 recommendations to agencies since 2010 aimed at addressing cybersecurity shortcomings. As of August 2018, about 1,000 still needed to be implemented.