prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: DOJ and its components, as well as the judiciary, play important roles in requesting and collecting restitution  DOJ and select components: Prosecutors in DOJ’s Criminal Division and the Criminal Divisions of the 94 USAOs are responsible for overseeing criminal matters, including identifying and notifying victims, determining their losses as part of a case investigation, prosecuting cases and negotiating the terms of plea agreements, of which restitution may be a part  Within DOJ’s Criminal Division, the Money Laundering and Asset Recovery Section manages DOJ’s Asset Forfeiture Program  As previously stated, FLUs within each USAO undertake activities to collect restitution from offenders in their district  Additionally, all USAOs have asset forfeiture staff responsible for forfeiting property seized by law enforcement agencies because the property was used in criminal activities or purchased with the proceeds of criminal activities  According to EOUSA guidance, coordination between the FLU and Asset Forfeiture units is highly encouraged to use forfeited assets as a means to collect on unpaid restitution debts  DOJ requires each USAO to have its own policies and procedures related to debt collection efforts but allows them discretion in developing these policies and procedures to ensure that they are appropriate for local conditions  DOJ also requires USAOs to have policies and procedures to make early, effective, and coordinated asset investigations and recovery a routine part of every case involving victims but allows USAOs to specify these policies and procedures  DOJ’s EOUSA provides USAOs with management assistance, guidance, training, and administrative support  Among other activities, EOUSA provides management assistance to USAOs by administering internal evaluations for each USAO, which are intended to provide on-site management support for that office  Further, EOUSA provides guidance to enhance offices’ efforts to request and collect restitution  Judiciary: Within the judiciary, the 94 federal district courts order restitution, receipt restitution payments, and disburse restitution to victims  Within the federal district where the offender was convicted, a probation officer prepares the presentence investigation report (PSR) for the court, which includes information on the victim’s losses and an offender’s financial information  Probation officers may obtain this information from DOJ, which has the statutory responsibility for the enforcement and collection of criminal debt  The court uses the PSR, among other things, to determine whether to order restitution  If an offender is released to the community by the court and placed on supervision, probation officers are responsible for ensuring the offender abides by the terms of release, including paying any restitution owed to victims  The Clerk of each District Court is responsible for the receipt of restitution from offenders and for disbursing payments to victims  The Judicial Conference is the national policy-making body for the federal courts  The Conference operates through a network of committees created to address and advise courts on a wide variety of subjects such as information technology, personnel, probation and pretrial services, space and facilities, security, judicial salaries and benefits, budget, defender services, court administration, and rules of practice and procedure  The Judicial Conference has taken policy positions on restitution-related issues and has supported legislative proposals to improve the restitution process  AOUSC is the agency within the judiciary that provides a broad range of legislative, legal, financial, technology, management, administrative, and program support services to federal courts  AOUSC is responsible for carrying out Judicial Conference policies and a primary responsibility of AOUSC is to provide staff support and counsel to the Judicial Conference and its committees  USSC is an independent agency within the judiciary which, among other activities, establishes and promulgates detailed sentencing guidelines that judges are to consider in sentencing offenders convicted of federal crimes, including guidelines on when and how to order restitution  Additionally, each district court is required to submit to USSC a report of each offender’s sentence that includes, among other information, details on the offenses for which the offender was convicted; the sentence imposed on the offender; and if the judge departed from the sentencing guidelines, information on reasons why  USSC maintains a database containing sentencing data on federal offenders convicted of felonies or serious misdemeanors, analyzes it and publishes these data on an annual basis  USSC is also statutorily required to annually report to Congress its analysis of sentencing-related documents, including an accounting of districts USSC believes have not submitted appropriate information to the commission, among other things  During the course of a federal criminal investigation, federal prosecutors identify and notify victims, as well as determine their losses in conjunction with the federal agents investigating the case  If a defendant pleads guilty or is found guilty at trial, the prosecutor has the burden of proving the victims’ losses in court  To facilitate this, a Victim-Witness coordinator within the USAO responsible for the case provides victims the opportunity to explain their losses in detail, usually through a Victim Impact Statement  This information is then to be provided to a federal probation officer who uses it to begin a PSR  To develop the PSR, probation officers use information provided by the USAO and may contact victims and verify the loss amounts  Additionally, probation officers will investigate an offender’s economic circumstances— such as if the offender has a job, any assets or any dependents  If a judge determines that restitution is to be ordered, the judge must order restitution for the full amount of a victim’s losses for offenses without consideration of the economic circumstances of the defendant  Judges may decline to order restitution in certain instances, for example, where restitution is discretionary, or in certain cases where the number of identifiable victims makes restitution impracticable or the complexity of calculating restitution would unduly prolong the sentencing process  If the court does not order restitution, or orders only partial restitution, the judge must provide the reason, and judges usually do so in a written Statement of Reasons document  Figure 1 provides an overview of the federal restitution process  Upon imposition of a restitution debt by the court, FLU staff use two mechanisms to determine the collectability of the debt and what collection actions to take  First, FLU staff classify the debt into one of four categories to determine the extent to which the FLU will pursue enforcement actions to collect upon the debt  FLUs classify debts from a Priority Code 1 debt (indicating that FLUs will make collection of this debt the highest priority) to a Priority Code 4 debt (indicating that FLUs will make collection of this debt the lowest priority)  Second, FLUs may suspend collection action on criminal debts, regardless of their categorization, under certain circumstances if they determine the debts are uncollectible  FLU staff may also determine that debts are permanently uncollectible and categorize them as Priority Code 4 debts  If a debtor does not provide payment, FLU staff then use various enforcement actions to collect the restitution debt  These can include, among other actions, filing liens against an offender’s property, coordinating with asset forfeiture staff to use forfeited assets to pay the restitution debt, and garnishing wages an offender may earn  Victims can be compensated for losses with the proceeds of forfeited assets through DOJ’s Asset Forfeiture Program and in accordance with law and regulation  Federal regulations provide that the proceeds from forfeited assets are first used to cover program costs associated with forfeiture-related activities and next to pay valid owners, lien-holders, and federal financial regulatory agencies  Forfeited assets can then be distributed to other victims of crime as compensation for their losses if their loss is a direct result of the commission of the offense underlying forfeiture or a related offense  Any remaining funds from the forfeited asset may be placed into official use, distributed to foreign governments, state or local law enforcement agencies as part of the equitable sharing program to enhance cooperation with federal investigations  When victims are eligible for compensation using forfeited assets, DOJ employs two processes: restoration and remission  The restoration process involves the USAO staff requesting funds on behalf of a victim when there is both an order of forfeiture and an order of restitution  Under the restoration process, USAO staff request DOJ’s Money Laundering and Asset Recovery Section to use the forfeited asset to pay a restitution debt  If DOJ approves the request for restoration, the funds from the forfeited property are then transferred to the Clerk of the Court who disburses this money to the victim  The remission process requires a victim of a crime to directly petition DOJ to receive funds from the forfeited property  According to officials in DOJ’s Criminal Division, the courts may not order restitution on behalf of victims who suffered a specific actual loss as a direct result of a crime for a variety of reasons, and therefore the remission process serves as a complement to the restoration process to ensure victims are made whole  For example, these officials stated that, among other reasons, the courts may not order restitution if a defendant dies prior to sentencing or if the case is one in which a court is not required to, and does not, order restitution, but the victim has suffered eligible losses  EOUSA and USAO officials in all six of the offices with whom we spoke told us that prosecutors document requests for restitution in their case files and that their offices employ other internal controls, such as the use of templates and forms, throughout the prosecution process to ensure that prosecutors request restitution as appropriate  EOUSA officials told us that although the agency does not track this information, they believed all USAOs generally document requests for restitution in their offices’ case files  Further, USAO officials in all six offices told us that prosecutors document requests for the court to order restitution in their case files by including this information in a written memorandum  To support prosecutors in documenting this information, all six offices we selected provide prosecutors with a prosecution memorandum template  Of the six templates we reviewed, four explicitly include a section for prosecutors to indicate whether victims have been identified and the extent of any victim losses  In addition to these templates, four of six USAOs we selected had forms that prosecutors could use to identify whether cases have victims and their need for restitution when drafting criminal charging documents  Moreover, officials from two of the six USAOs told us their offices use this form as an internal control to ensure prosecutors have identified all victims and considered their need for restitution, if applicable  All six offices we selected also provided prosecutors templates for drafting plea agreements, and templates we reviewed from all six USAOs included language requesting the offender pay restitution, if applicable  However, prosecutors are not required to use plea agreement templates, nor are they required to request restitution as part of a plea agreement  USAO officials from one office stated that including this language in the plea agreement template served to remind prosecutors of their requirement to consider requesting restitution as stated in the U S  Attorney’s Manual  Select USAO officials also described various forms of management oversight to ensure prosecutors request restitution as appropriate  Specifically, four USAOs we selected require supervisory review of the form that prosecutors fill out when drafting criminal charging documents, which includes information on victims  Additionally, officials in all six USAOs told us that they require supervisory review of plea agreements for every case  For example, officials from two USAOs told us their office requires the Criminal Chief, the supervisor of all criminal cases, to approve documents in the plea agreement, which may include requests for restitution  Federal courts sent information on sentencing decisions to USSC and USSC had information on restitution decisions for 95 percent of all offenders from fiscal years 2014 through 2016  According to our analysis of USSC data, 214,578 federal offenders were sentenced from fiscal years 2014 through 2016 and restitution was ordered for 33,158 of those offenders, or 15 percent  Collectively, courts ordered these offenders to pay $33 9 billion in restitution during this period  Courts did not order restitution for the remaining 181,420 offenders, or 85 percent  Table 1 shows the number of federal offenders sentenced and ordered to pay restitution for fiscal years 2014 through 2016, as well as the total amount of restitution ordered by the courts  The majority of federal offenders were sentenced for immigration or drug- related offenses, and USAO officials in all six offices we selected told us that these types of offenses do not typically have victims with actual losses  For example, from fiscal years 2014 through 2016, USSC data showed that 131,088 offenders, 61 percent of offenders sentenced, were sentenced for immigration or drug-related offenses and courts ordered 999 (or less than 1 percent) of these offenders to pay restitution  USSC data show that courts ordered restitution more often for offenders sentenced for other offenses, such as fraud  For example, courts sentenced 21,551 offenders for fraud offenses from fiscal years 2014 through 2016, and courts ordered restitution for 15,902 of these offenders, or 74 percent  Table 2 shows the number of offenders sentenced and the number ordered to pay restitution by offenses for which restitution was most often and least often ordered by courts from fiscal years 2014 through 2016  The percentage of federal offenders ordered to pay restitution varied across federal court districts; from 2 percent of offenders in one district to 42 percent in another district  USAO officials we interviewed stated that some of this variation may be due to the types of offenses prosecuted within different districts  For example, officials from one USAO stated that their office, which had a high volume of immigration–related offenders, had few cases in which restitution was applicable  Our analysis of USSC data showed that from fiscal year 2014 through fiscal year 2016 and across all districts, districts with a higher than average rate of immigration-related offenders had lower than average rates of restitution ordered  Conversely, districts with above-average rates of offenders convicted of financial offenses such as fraud, embezzlement, money laundering, tax offenses, counterfeiting or bribery had higher than average rates of restitution ordered, as shown in table 3  Judges indicated on documents sent to USSC that restitution was not applicable and thus did not order it for most offenders sentenced from fiscal years 2014 through 2016—167,230 offenders—or 78 percent of all offenders sentenced during this time period  Our analysis of sentencing information for the remaining offenders found that courts ordered restitution at a higher rate as compared to all offenders  Specifically, after excluding offenders for whom restitution was not applicable and were not ordered to pay it, we found that courts ordered restitution for 70 percent of the remaining 47,348 offenders  EOUSA and USAO officials told us that in cases where there are identifiable victims, restitution may not be ordered for other reasons  EOUSA officials told us that restitution may not be ordered for several reasons, such as when victims provide no proof of their losses or when victims recover compensation through other means, such as through civil proceedings  Further, officials from one USAO told us that victims must provide documentation of their losses for restitution and, if victims are not able to provide this documentation, courts may decline to order restitution  Also, in certain cases, courts are not required to order restitution—such as when there is no identifiable victim or, on the other hand, when the number of identifiable victims is so large as to make restitution impractical, among other reasons  Additionally, the court might not order, or order only partial restitution for other reasons, such as when the value of property the defendant returned to the victim was deducted from the restitution award or because the victim received compensation from insurance  If a court does not order restitution, or orders partial restitution, it is required to provide the reason for its decision and to provide that reason to USSC, but our analysis showed USSC did not always have these data  Specifically, from fiscal years 2014 through 2016, we found that restitution was not ordered—and no reason was documented in USSC data for that decision—for 9,848 offenders (5 percent of the 214,578 offenders sentenced during this time period)  Information on offenders’ sentences, including restitution, assists USSC in its continuous reexamination of its guidelines and policy statements and ensures that various sentencing practices are achieving their stated purposes  Further, Standards for Internal Control in the Federal Government state that management should evaluate issues identified through monitoring activities or reported by personnel to determine whether any of the issues rise to the level of an internal control deficiency  In response to our questions about the missing information on reasons why restitution was not ordered, AOUSC and USSC officials stated that they were unaware of the missing information or why it was missing  Judiciary officials stated that because various entities within the judiciary participate in the process of collecting and recording information on reasons restitution was not ordered, they did not know which entities could take action to improve USSC data  However, as previously discussed, if the court does not order restitution, or orders only partial restitution, the judge must provide the reason, and judges usually do so in a written Statement of Reasons form  The Judicial Conference, along with USSC, has developed guidance to help judges fill out the Statement of Reasons form and AOUSC supports the Judicial Conference in carrying out its policies  Further, courts must provide USSC the written Statement of Reasons form for sentences imposed  USSC is also responsible for collecting, analyzing, and distributing information on federal sentences provided by each district court, including information related to orders for restitution  However, judicial officials, including from the entities listed above, agreed that further studying the missing data may inform the judiciary of the cause of the missing data, as well as any efforts needed to improve USSC information  Courts are required to provide reasons for not ordering restitution and to provide this information to USSC so that the agency can analyze and report on sentencing data  Determining why USSC data are incomplete could help inform the judiciary whether the issue rises to the level of an internal control deficiency and whether additional action can be taken to improve the transparency of sentencing decisions  Doing so could help the judiciary ensure reasons for not ordering restitution are provided consistently in all cases and potentially improve data provided to USSC, in turn supporting its mission to promote transparency in sentencing decisions  Our analysis of DOJ data showed that DOJ collected $2 95 billion in restitution debt from fiscal years 2014 through 2016, half of which was collected on debts imposed during this period  The extent of collections across the 94 USAOs ranged from a high of $848 million in one USAO to a low of $1 2 million in another USAO  The median amount collected for USAOs was $10 7 million  DOJ was more successful at collecting restitution on newer debts—debts imposed from fiscal years 2014 through 2016  Of the $2 95 billion in restitution debt collected, about half was collected from new debts imposed by courts during this time period  Specifically, DOJ collected $1 5 billion (4 percent), of the $34 billion ordered from fiscal years 2014 through 2016  The remaining half of the debt collected during this time frame was collected from debts imposed between fiscal year 1988 and fiscal year 2014  New debts—imposed in fiscal years 2014 through 2016—were also more likely to be fully paid during this time period compared to all debts  Specifically, from fiscal years 2014 through 2016, DOJ collected the full amount of restitution on 4,003 of the 24,950 debts imposed during this time, 16 percent  However, across all debts, including debts imposed prior to fiscal year 2014, DOJ collected the full amount of restitution ordered on only 5 percent of debts  Across all restitution debts, DOJ collected at least some of the debt for one-third of debts and did not collect any restitution on the remaining two-thirds  More than 60 percent of the restitution DOJ collected in fiscal years 2014 through 2016 was owed to non-federal victims ($1 8 billion), including individuals, corporations and state and local governments  An additional 37 percent of restitution was collected on behalf of federal agencies that were victims of crimes  One percent of restitution collected was community restitution, which is restitution collected for drug offenses that otherwise have no victims and which is disbursed to state victim assistance agencies and state agencies dedicated to the reduction of substance abuse, as shown in table 4  AOUSC officials noted that some collected restitution is not disbursed to non-federal victims due to a lack of accurate contact information for these victims  Specifically, according to AOUSC, as of June 2017, courts had more than $132 million in restitution due to 113,260 victims that could not be disbursed because of a lack of accurate contact information for these victims  DOJ is required to provide courts with victim contact information, and victims are to notify DOJ if their contact information changes  However, AOUSC and USAO officials told us that this notification by victims may not always occur  For example, officials in one USAO told us that due to the length of court proceedings, victims may move without notifying the court prior to the disbursement of restitution and, as a result, the court is unable to disburse restitution to those victims  According to our analysis of DOJ data, at the end of fiscal year 2016, $110 billion in restitution was outstanding and USAOs had identified $100 billion of that debt as uncollectible, as shown in figure 2  USAOs may identify debts as uncollectible and suspend collection actions on a debt for a variety of reasons, including that the offender has no, or only a nominal, ability to pay the debt  Probation officials, EOUSA officials, and officials from five of six USAOs we interviewed stated that most outstanding restitution debt is identified as uncollectible and collection action is suspended because many offenders have little ability to pay the debt—a conclusion supported by USSC data  For example, according to USSC data, 95 percent of offenders ordered to pay restitution from fiscal years 2014 through 2016 received a waiver from paying a court-ordered fine, indicating their inability to pay  While courts are allowed to take an offender’s economic circumstances into consideration when issuing fines, they generally may not do so when ordering restitution  As a result, EOUSA and federal probation officials with whom we spoke stated that offenders ordered to pay restitution often do not have an ability to do so and therefore a large amount of restitution orders is uncollectible  Through various guidance documents, DOJ has identified and recommended numerous practices for DOJ prosecutors and FLU staff to use throughout the restitution process to help ensure full and timely restitution for victims  USAO officials in all six offices with whom we spoke stated that, based on their experience, these practices were generally effective  Specifically, DOJ and EOUSA officials identified practices for prosecutors and FLU staff to use when requesting restitution, facilitating court orders for restitution, and collecting restitution and documented these practices in several guidance manuals  Officials we interviewed from all six USAOs stated they were generally satisfied with the guidance from EOUSA and that they thought most of DOJ’s recommended practices were effective when requesting restitution, facilitating court orders for restitution, and collecting restitution  Requesting restitution  Officials we interviewed from three USAOs identified coordination between prosecutors and case investigators prior to sentencing to identify victims and their losses as an important practice for requesting restitution  USAO officials from three of the six offices stated that gathering detailed information on an offender’s financial resources, which include assets that could be forfeited and used to pay a restitution debt, was a very effective practice related to requesting restitution  Facilitating court orders of restitution  Although the courts, and not prosecutors, are responsible for ordering restitution, DOJ guidance identifies several practices that prosecutors can use to facilitate orders of restitution that may increase the likelihood of full and timely restitution for victims  Officials from three of six USAOs stated that the most effective practice related to ordering restitution was ensuring courts ordered restitution as due and payable immediately  Specifically, when offenders cannot pay restitution in an immediate lump-sum payment, the courts must specify a payment schedule through which the offender will pay restitution based on the offender’s ability to pay  In these cases, USAO officials stated that it is effective for prosecutors to ensure the restitution order specifies that restitution is due and payable immediately  According to an EOUSA official, this permits the agency to immediately pursue all collection remedies allowed by law whenever the debtor has or subsequently obtains the ability to pay  Collecting restitution  Officials from all six USAOs stated that using the Treasury Offset Program (TOP), a program that allows for the reduction or withholding of a debtor’s federal benefits, such as a tax refund, was one of the most effective practices for collecting restitution  Specifically, officials in one USAO told us that TOP requires minimal effort for FLU staff and can result in a high amount of collections  As an example, officials from two USAOs told us their respective offices each recovered more than $500,000 dollars in restitution debt in fiscal year 2016 through TOP  Officials from three of the six offices also identified using wage garnishment as an effective practice for collecting restitution  Across all parts of the restitution process, USAO officials we spoke with also consistently identified DOJ recommended practices related to internal and external communication and collaboration as effective for improving the restitution process  Specifically, the officials identified collaboration between various units in the USAO as an effective practice to ensuring restitution for victims  For example, USAO officials in two of the six offices highlighted coordination between Victim-Witness coordinators and prosecutors to help identify victims and quantify their losses as effective to assisting in the request for restitution  Additionally, USAO officials in all six offices stated that strong coordination between FLU personnel and criminal prosecutors to identify an offender’s financial resources and available assets was an effective practice to help ensure FLU staff could collect restitution using those resources or assets  USAO officials from five of six offices identified external communication between FLU and the federal probation office as an effective practice  Specifically, officials from these USAOs stated that FLUs coordinating with probation officers during the offender’s supervision period to enforce restitution terms was an effective practice for collecting restitution  Additionally, according to EOUSA guidance, FLU staff can use outreach and training with other partners such as the probation office to facilitate information sharing on restitution collection issues and officials from five of six USAOs told us that FLUs conducting training and outreach is a very effective practice  In addition, probation officials we interviewed in each of the six federal judicial districts we selected stated that ongoing communication between USAO staff and probation officers is effective to ensuring victims are identified and receive full and timely restitution  Probation officials from one court district emphasized the importance of a good working relationship with the USAO, stating that the probation office and USAO are better able to ensure victims and their losses are accurately identified and defendants’ ability to pay is adequately addressed when working collaboratively  A probation official from another office said that probation officers regularly coordinated with the USAO’s FLU, and this coordination was particularly important on cases involving complex financial crimes, where the offender has a complicated financial portfolio  Further, probation officials from five of six probation offices also stated that attending training conducted by the FLU is a very effective practice  EOUSA and selected USAO officials told us that while these practices may be useful in some circumstances, they may not be effective or applicable in all cases or in all districts  Specifically, practices DOJ recommends may be effective when offenders have the ability to pay restitution but are simply unwilling to do so; however, USAO officials in five of six offices stated that these practices cannot mitigate the fact that many offenders lack the ability to pay restitution because they lack assets and income  Additionally, while EOUSA guidance recommends that FLU staff contact co-defendants or victims for information on the whereabouts or assets of offenders who owe restitution, officials from three USAOs told us this was not effective  According to one official, although co- defendants are sometimes eager to share information, the information is usually unreliable  USAO officials also identified some recommended practices as not applicable to their district  For example, EOUSA recommends that FLU units request Asset Investigation assistance from EOUSA for complex cases involving large amounts of valuable assets  However, USAO officials in a small, rural district with whom we spoke stated that the types of cases their office prosecutes tend not to be the type of financial cases that warranted use of this resource  DOJ has identified improving debt collection—including court-ordered restitution—as a major management initiative in its 2014-2018 Strategic Plan  However, it does not have any measures or goals in place to assess its performance in meeting this initiative or meet requirements that it evaluate its performance in seeking and recovering restitution as required by statute  In 2001, we recommended that DOJ adequately measure its criminal debt collection performance against established goals to help improve collections and stem the growth in uncollected criminal debt  DOJ concurred with this recommendation, and as of fiscal year 2003, annually assessed each district based on established collection goals for that district  However, as of September 2017, DOJ no longer evaluates each district based on established goals  EOUSA officials stated that DOJ no longer uses these performance goals and that the agency did not maintain records for when or why it stopped  EOUSA officials stated that while the agency does not have any measures or goals to assess USAOs’ performance in improving debt collection, including the collection of federal restitution, they are working with DOJ’s Justice Management Division to develop a suite of analytical tools to monitor the collection of debt across all offices  According to DOJ, some of these analytical tools have been implemented and additional tools will be implemented by March 2018  EOUSA officials stated that these tools will help the agency determine which cases are most likely to result in significant collections and the types and timing of enforcement actions that generate maximum debt recovery results  EOUSA officials further stated the analytical tools will allow the agency to compare districts’ efforts based on a variety of factors (e g , caseload, staff size, and enforcement actions)  These analytical tools may provide EOUSA with valuable insight into the present condition of the collection of restitution across USAOs, but they will not provide DOJ with a baseline performance standard that could be used to indicate if USAOs’ efforts to collect restitution debts are having a measurable impact in meeting DOJ’s objective of improving debt collection  Additionally, EOUSA conducts evaluations of each USAO every 4 years, which include a review of FLU operations, but EOUSA officials stated that these reviews do not include oversight of the collection of restitution  Among other aspects of USAO operations, these internal evaluations review the extent to which each FLU is complying with statutory and DOJ requirements related to debt collection, has sufficient program resources, and adequately manages its caseload  However, DOJ and EOUSA officials told us that it did not plan to use these internal evaluations to meet the Justice for All Reauthorization Act of 2016 requirement to evaluate each USAO on its performance in seeking and recovering restitution for victims  Specifically, the officials stated that these internal evaluations are not an appropriate mechanism to meet the law’s requirements because the internal evaluations do not specifically review the seeking and recovery of restitution for victims  According to DOJ officials responsible for the internal evaluation program, these evaluations are largely intended to provide onsite management assistance and analysis of how the USAO allocates its administrative and legal personnel resources rather than the office’s efficacy in collecting restitution  Consistent with requirements outlined in the Government Performance and Results Act Modernization Act of 2010 (GPRAMA), performance measurement is the ongoing monitoring and reporting of program accomplishments—particularly towards pre-established, objective and quantifiable goals—and agencies are to establish performance measures to assess progress towards those goals  While GPRAMA is applicable to the department or agency level, performance measures and goals are important management tools at all levels of an agency, including the program, project, or activity level  Agencies can use performance measurement to make various types of management decisions to improve programs and results, such as developing strategies and allocating resources, including identifying problems and taking corrective action when appropriate  Further, the Justice for All Reauthorization Act of 2016 requires DOJ to evaluate each USAO in its performance in recovering restitution for victims  DOJ and EOUSA officials told us that DOJ does not require USAOs to establish performance measures or goals to assess their progress in improving the collection of restitution  DOJ and EOUSA officials also told us that each USAO could develop performance goals but that they were unaware of the extent to which USAOs did so, and further, they do not track the extent to which USAOs met performance goals  Additionally, these officials stated that because each USAO faces different constraints in its ability to collect restitution, establishing a uniform and consistent performance measure and goal would be challenging  EOUSA officials noted that some USAOs may have more resources, such as more FLU staff or specialized asset investigators, available to pursue collections as compared to other offices and therefore offices with fewer resources could have difficulty meeting a performance goal  Further, EOUSA and USAO officials stated that the extent to which DOJ can collect on a debt is heavily influenced by factors outside of the agency’s control, such as an offender’s ability to pay  USAOs could use information provided by performance measures and goals—such as an office’s ability to meet a performance goal—to make managerial decisions to help address these constraints, such as by increasing the allocation of staff resources  Further, to avoid comparing USAOs to a nationally set performance goal that does not account for specific constraints faced by each office, DOJ could—as it did in fiscal year 2003—require each USAO to establish its own objective, quantitative collection goals based on historical, district-specific collection statistics  Finally, as previously discussed, each USAO already accounts for external factors that affect the collectability of a debt, such as an offender’s ability to pay, by suspending collection action on debts it identifies as uncollectible  Therefore, any performance measures and goals developed could be based solely on debts that the USAO already has determined to be collectible  Stakeholders we interviewed—including officials from one USAO, probation officials in two districts, and officials with DOJ’s Office of Crime Victims—noted that receiving restitution is both emotionally and financially important to victims  Specifically, officials from one USAO and one probation office noted that while many victims may never receive the full amount of restitution ordered, receiving even a minimal amount of restitution is a symbolic victory and that it is important for victims to know the government is making efforts to collect restitution on their behalf  The legislative history of the MVRA echoes these sentiments, providing that even nominal restitution payments have benefits for the victim of crime, and that orders of restitution are largely worthless without enforcement  Yet, according to our analysis, $10 billion of restitution debt DOJ identified as collectible remained outstanding at the end of fiscal year 2016  Further, the extent to which USAOs collected restitution varied widely— from a high of one USAO district collecting nearly 350 percent of all collectible debt in fiscal years 2014 through 2016 to a low of one district collecting less than one percent of collectible debt in the same period  Without performance measures, including the establishment of goals, DOJ cannot assess if this variation is due to factors outside the control of USAOs or due to management deficiencies that require corrective action  Developing performance measures and goals for each USAO related to the collection of restitution would allow DOJ to assess its progress in achieving its major management initiative in improving debt collection— including debts owed to victims as court-ordered restitution  Doing so would also better position DOJ to meet the requirements of the Justice for All Reauthorization Act of 2016 to evaluate offices in their performance in recovering restitution on behalf of victims and to use performance information to improve the practices of offices as needed  Although asset forfeiture and restitution are separate parts of a criminal sentence, DOJ guidance states that using forfeited assets to benefit victims is a way that DOJ can help ensure eligible victims of crime are compensated for their losses  Further, DOJ regulations and policy require that eligible victims receive compensation from forfeited assets before certain other uses, such as official use or equitable sharing  However, while DOJ tracks the amount of compensation provided to victims through forfeited assets, it does not have assurances that forfeited assets are being used to compensate victims to the greatest extent possible  According to DOJ information, the agency made payments of about $595 million to eligible victims other than owners of the property from the Assets Forfeiture Fund from fiscal years 2014 through 2016, or 15 percent of $3 9 billion in paid expenditures during this period, as shown in table 5  As table 5 shows, DOJ can account for cases in which forfeited assets were used to compensate eligible victims who were not owners or lienholders  However, DOJ does not have information on the overall universe of victims who could have been eligible to receive compensation from forfeited assets  Further, it does not have insight into any reasons why funds from forfeited assets were not used for these victims  Specifically, DOJ officials stated that the department collects information on whether victims have been identified in cases associated with forfeited assets, and if restitution is anticipated in these cases, but it does not track the extent to which these victims were ultimately compensated using forfeited assets  Further, DOJ also does not collect information on reasons why victims were not compensated using funds from forfeited assets  While DOJ is required to use forfeited assets to compensate victims before using those assets for certain other purposes, the agency is unable to provide assurances that it is always doing so because it does not have information on the overall universe of victims or reasons why victims were not compensated using forfeited assets  As a result, DOJ does not have a basis to know whether the $595 million provided to victims from fiscal years 2014 through 2016 is the maximum amount of compensation the agency could have provided to victims using forfeited assets  Full use of forfeited assets for victim compensation has long been, and continues to be, a goal of DOJ  In 2005, an interagency task force—led by DOJ and including the Department of Treasury, Office of Management and Budget and AOUSC—developed a strategic plan to improve the collection of criminal debt  Among other goals included in its strategic plan, the task force stated a goal of examining how asset seizure and forfeiture procedures can be used to maximize recoveries for victims  More recently, DOJ reported in its 2014-2018 Strategic Plan that it would make every effort to recover full and fair restitution for victims using the federal forfeiture statutes to preserve and recover criminal proceeds  Specifically, DOJ stated that using federal forfeiture statutes to recover full and fair restitution for victims is one part of its strategy to protect the rights of the American people and enforce the rule of law  Finally, DOJ officials told us they considered providing compensation to victims as one goal of the Asset Forfeiture Program and EOUSA stated in guidance that asset forfeiture is the most widely available and effective tool to seize assets for restitution purposes  Standards for Internal Control in the Federal Government call on federal managers to design control activities to achieve the agency’s objectives  These controls can include using quality information to make informed decisions, evaluate the entity’s performance in achieving key objectives, and address risks  DOJ officials told us that they do not track the extent to which victims were not compensated using forfeited assets because USAO staff are not required to request that these assets be used for victim compensation  DOJ officials explained that staff are required to indicate in the agency’s forfeited asset database, the Consolidated Asset Tracking System, if victims exist in cases associated with forfeited assets and if restitution is anticipated in these cases  However, these officials stated that staff are not required to then compensate these victims using the forfeited assets or to indicate why these assets were not used for this purpose  DOJ officials told us that decisions to compensate victims using forfeited assets are best left to the judgment of the USAO staff familiar with the case, such as the prosecuting attorney or asset forfeiture staff  DOJ officials pointed to informal communication and coordination among prosecutors, the FLU, and the Asset Forfeiture unit in each USAO as a means to provide compensation to victims as appropriate  However, communication and coordination among these groups has been a challenge for USAOs, as the DOJ Inspector General found in a June 2015 review of DOJ’s debt collection program  Similarly, during our current review, EOUSA and USAO officials we spoke with identified communication and coordination as an area for improvement  EOUSA officials told us that while they thought that FLU staff and Asset Forfeiture unit staff were collaborating more frequently to use forfeited assets to collect restitution debts since the issuance of the DOJ Inspector General’s report, the extent of collaboration between these two units still varied across USAOs  Further, officials we talked to in two USAOs and one probation office noted that USAO staff could improve their use of forfeited assets for restitution payments  For example, officials in one probation office noted that it was their practice to identify forfeited assets that could be used for compensation in the PSR because they had observed that USAO staff were frequently not applying such assets to victim compensation  While DOJ may allow USAO staff to use discretion when requesting restoration or alerting victims to assets available for compensation, increasing the agency’s understanding of the extent to which assets could have been—but were not—used for victim compensation, and the reasons for those decisions, does not affect that discretion  There are legitimate reasons why victims might not be compensated using forfeited assets; for example, the assets may have other owners or lienholders that must be compensated prior to victims, or offenders may have other means by which to pay victims restitution  However, there are also instances where victims may have not received compensation through forfeited assets as a result of unintentional circumstances  For example, according to DOJ’s Asset Forfeiture Manual, forfeiture actions can proceed faster than the parallel criminal case  Consequently, assets might be equitably shared, placed into official use, or remitted to victims who file petitions long before restitution is ordered, and therefore would not be available for other victims who wait for restitution to be ordered after an offender is sentenced  To avoid this outcome, DOJ recommends that USAOs coordinate to ensure the retention of property for victim compensation  However, although DOJ officials responsible for leading DOJ’s asset forfeiture efforts highlighted the need for expedient coordination when USAO staff are considering using forfeited assets to compensate victims, they stated this may not always occur  As a result, otherwise eligible victims may not always be compensated through forfeited assets  By gathering information about the extent to which assets were used for victim compensation—including when they were not used and reasons why not—DOJ could have a better understanding of potential instances where victims could be, but are not, receiving compensation through forfeited funds and could take steps to address them accordingly  Options for gathering such information could include doing a one-time retrospective study of forfeited assets with victims or anticipated restitution to determine the extent that assets were used for victim compensation, or creating a tracking mechanism through its forfeited assets database, or another system  Gathering information on the extent to which forfeited assets were used for victim compensation, including when not used and reasons why not, could position DOJ to take action to increase the use of these assets for victim compensation if warranted  These actions could include providing funds for increased asset forfeiture staff in USAOs, providing additional training or changing policies or procedures for using forfeited assets to compensate victims  Fully and systematically understanding the extent to which issues, such as a lack of coordination within USAOs, result in victims not being compensated using forfeited assets would give DOJ a basis upon which to develop improvements to the Asset Forfeiture Program  Such information would also provide DOJ and staff at all USAOs with information to evaluate its performance in achieving one of the goals of the Asset Forfeiture Program and taking action to meet the agency goal of protecting the rights of the American people—including the right to full and fair restitution for victims  Restitution serves the criminal justice goal of holding offenders accountable and, to the extent possible, restoring victims of federal crimes to their prior position had the crime not occurred  Many victims are unlikely to receive any meaningful portion of court-ordered restitution owed to them because of offenders’ inability to pay these debts  However, the fact that restitution is difficult to collect does not negate the important responsibilities of the judiciary and DOJ to properly manage and oversee all aspects of the restitution process  By law, courts are to state why they did not order restitution and provide that information to USSC  While this information was collected and recorded in USSC data for most offenders, we found that this information was missing for thousands of offenders  It is important for the judiciary to ensure that this information is consistently collected and recorded to assist USSC in its continuous re-examination of its guidelines and policy statements and ensure that various sentencing practices are achieving their stated purposes  The judiciary could support USSC in this endeavor by determining why this information is missing  Results from this study could help inform the judiciary whether this issue rises to the level of an internal control deficiency and whether additional action can be taken to improve the transparency of sentencing decisions  While DOJ has delegated collection activities for restitution to USAOs, it could provide better oversight to ensure it is making reasonable efforts to collect restitution and meeting its responsibility to victims  USAOs have identified a significant portion of outstanding restitution debt as uncollectible, but they have also identified $10 billion of outstanding restitution debt that could be collected  Developing and implementing performance measures and goals for each USAO would allow DOJ to gauge USAOs’ success in collecting this restitution and, by extension, the department’s success in achieving its major management initiative to increase the collection of debt  Further, DOJ could use performance information to improve the practices of offices in seeking and recovering restitution, consistent with a requirement in the Justice for All Reauthorization Act of 2016  Finally, DOJ could gain greater visibility into the use of forfeited assets to compensate victims by gathering information on cases in which victims have been identified and restitution is anticipated but forfeited assets are not used, and any reasons why  Doing so would better position DOJ to take action to increase the use of forfeited assets to compensate eligible victims if warranted and to provide assurance that it is maximizing the use of asset forfeiture in satisfying restitution debts, one of the agency’s most effective mechanisms for satisfying restitution  We are making three recommendations, including one to the judiciary and two to DOJ  Specifically: Judiciary officials, including AOUSC, USSC, and the Judicial Conference, should determine why USSC data on the reasons restitution was not ordered are incomplete  Additionally, if warranted based on this information, judiciary officials should take action to ensure USSC data records include all required information for orders of restitution  (Recommendation 1) To improve oversight of the collection of restitution we recommend that the Attorney General: Develop and implement performance measures and goals for each USAO related to the collection of restitution, and measure progress towards meeting those goals  (Recommendation 2) In cases where forfeited assets were not used to compensate victims, gather information on reasons why forfeited assets were not used for victims  If warranted based on this information, take action to increase the use of forfeited assets to compensate eligible victims  (Recommendation 3) We provided a draft of this report for review and comment to DOJ, the Judicial Conference of the United States, AOUSC, USSC, and the Federal Judicial Center  DOJ concurred with our recommendations and provided technical comments, which we incorporated as appropriate  AOUSC provided written comments, which are reproduced in appendix III  In its written comments, AOUSC noted that it would work with the USSC to address our recommendation  We are sending copies of this report to the appropriate congressional committees and the Attorney General, the Judicial Conference of the United States, the Directors of AOUSC, the Staff Director of USSC, the Federal Judicial Center and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you and your staff have any questions about this report, please contact me at (202) 512-8777 or goodwing@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions are listed in appendix IV  According to our analysis of data from the U S  Sentencing Commission (USSC), 214,578 federal offenders were sentenced from fiscal years 2014 through 2016  Table 6 shows the number of offenders sentenced and the number and percentage of offenders ordered to pay restitution for each primary offense of conviction in fiscal years 2014 through 2016  The Department of Justice (DOJ) has identified and recommended numerous practices for federal prosecutors and Financial Litigation Unit (FLU) staff to use throughout the restitution process through various guidance documents  We conducted semi-structured interviews with officials from six U S  Attorneys’ Offices (USAO) to obtain their views on the restitution process and the extent to which they believed DOJ- recommended restitution practices related to the restitution process were effective  In particular, we spoke with USAO officials from the District of Connecticut; the Southern District of California; the District of New Jersey; the Southern District of Ohio; the District of South Dakota; and the District of Wyoming  Tables 7 through 9 show the results of our semi-structured interviews  In particular, table 7 shows practices related to requesting restitution and the extent to which USAO officials found these practices effective  Table 8 shows practices related to facilitating orders of restitution and the extent to which USAO officials found these practices effective  Table 9 shows practices related to collecting restitution and the extent to which USAO officials found these practices effective  Each table also indicates practices that officials we interviewed considered as most important or effective for helping ensure victims receive full and timely restitution  In addition to the contact named above, Chris Ferencik (Assistant Director); Kathleen Donovan (Analyst-in-Charge); Enyinnaya David Aja; David Alexander; Lacinda Ayers; Carla Brown; Emily Hutz; Janet Temko- Blinder; and Adam Vogt, made key contributions to this report 
Report 2:  Program offices responsible for 7 of the 8 selected mission-essential systems did not conduct such a review  According to OCIO officials, the offices were not aware of the need for a review  However, without reviewing physical access logs, CDC has reduced assurance that the agency would detect suspicious physical access activities  Further, CDC had not routinely monitored the configuration settings of its systems to ensure that the configurations were securely set  For example, for at least 41 of 94 technical control deficiencies we identified, OCIO officials cited quality control gaps where the change management process or system administrators had not discovered deficiencies resulting from insecure configuration settings  Without an effective monitoring process in place for system configurations, the agency was not aware of insecure system configurations  FISMA requires each agency to periodically test and evaluate the effectiveness of its information security policies, procedures, and practices  The law also requires agencies to test the management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems at a frequency depending on risk, but no less than annually  In addition, NIST SP 800- 53A identifies three assessment methods—interview, examine, and test— and describes the potential depth and coverage for each  Assessing a control’s effectiveness based on an interview is likely less rigorous than examining a control; similarly, examining a control is likely less rigorous than testing the control’s functionality  CDC had not sufficiently tested or assessed the effectiveness of the security controls for the 8 mission-essential systems that we reviewed  Although CDC annually assessed security controls of selected systems, the agency had only examined control descriptions in security plans to ensure accuracy  At least once every 3 years, the agency selected controls for a more in-depth assessment of the 8 mission-essential systems we reviewed  However, CDC had assessed only 191 (about 7 percent) of 2,818 controls described in the security plans for the selected systems  In addition, the agency used methods for assessing controls that were often not rigorous enough to identify the control deficiencies that we identified  For example, as depicted in figure 1, CDC relied exclusively on interviews—a less rigorous method—to assess 20 percent of the 191 controls it assessed for the selected systems  The security control tests and assessments were insufficient in part because CDC had not developed comprehensive security assessment plans or had not consistently implemented the plans for the 8 selected mission-essential systems we reviewed  For example, one system’s assessment plan indicated that five controls should be assessed using a testing methodology; instead, however, the assessor conducted interviews to determine whether controls were effective or not  OCIO officials stated that the security control test and assessment process is manual and staffing is limited  They stated that the agency intends to rely increasingly on automated tools—such as the tools implemented by the Continuous Diagnostics and Mitigation program—for performing the assessments  Nevertheless, by not assessing controls in an in-depth and comprehensive manner, CDC has limited assurance that the security controls are in place and operating as intended  Further, without developing and implementing comprehensive assessment plans, assessments may not be performed with sufficient rigor to identify control deficiencies  The respond core security function is intended to support the ability to contain the impact of a potential cybersecurity event  Controls associated with this function include implementing an incident response capability and remediating newly-identified deficiencies  Although CDC had implemented controls for incident response to detect cybersecurity events, we reported in June 2018 that the agency had not maintained adequate information to support its incident response capability or taken timely corrective actions to remediate identified control deficiencies  NIST SP 800-53 and SP 800-61 state that agencies should develop and document an incident response policy with corresponding implementation procedures and an incident response plan, and keep them updated according to agency requirements  NIST also states that agencies should implement an incident handling capability, including an incident response team that consists of forensic/malicious code analysts  In addition, agencies are to provide incident response training for the team and test the incident response capability to determine the effectiveness of the response  Further, NIST states that agencies are to monitor incidents by tracking and documenting them and maintain records about each incident, including forensic analysis  Finally, National Archives and Records Administration guidance states that records and data relevant to security incident investigations should be retained for 3 years  CDC had implemented an incident response capability  The agency had developed policy, procedures, and a plan that addressed incident response, and updated them annually  CDC had an incident response team that managed all of the incident handling and response efforts for the agency, and conducted forensic analyses for reported security incidents  Team members had undergone training, such as an advanced network forensic and analysis course offered by a private firm  In addition, the agency had periodically tested its incident handling capability by conducting penetration testing exercises  These exercises allowed the team to test its real-time response capabilities  CDC’s incident response procedures state that incident tickets should include a description of actions taken, response time, and whether actions have been completed or not  The agency’s procedures also require that computers affected by an incident be removed from the network immediately  Nevertheless, CDC had shortcomings in implementing its incident response capability and monitoring procedures  For the 11 security incidents CDC considered most significant over a 19-month period ending in March 2017, the agency had not consistently described the actions taken, the response times, or whether remedial actions had been completed  The agency also had not maintained audit log records for its security incidents  For example, the agency described recommended actions for 10 of the 11 incidents, but did not describe the actions that had been taken  In addition, although incident response team officials told us that all incident ticket records had been saved, CDC had not retained system log data that supported incident resolution for at least five of the incidents  The agency’s policy did not address record retention in accordance with National Archives and Records Administration guidance  Further, for two of the security incidents, the security incident tickets did not clearly indicate when two compromised workstations had been removed from the network  According to OCIO officials, shortcomings in fully documenting incidents resulted from the organization being understaffed, primarily due to budget limitations and the inability to hire qualified personnel  Without effectively tracking and documenting information system security incidents, CDC’s systems are at increased risk that the impact of security incidents would not be fully addressed  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in information security policies, procedures, or practices  NIST SP 800-53 states that agencies are to develop a plan of action and milestones (POA&M) for an information system to document the agency’s planned remedial actions to correct identified deficiencies  CDC policy was consistent with the NIST guidelines  CDC had developed POA&Ms for deficiencies identified by its security control assessments, but had not remediated the deficiencies in a timely manner  For each of the 8 selected mission-essential systems, the agency had created plans for correcting control deficiencies  However, the agency did not implement several remedial actions by their due date  For example, expected completion dates had passed for correcting deficiencies associated with 4 of the 8 selected mission-essential systems  For these 4 systems, the completion dates were 1 to 8 months beyond the due dates at the time of our review in September 2017  According to Office of the Chief Information Security Officer officials, program offices that own the systems did not always communicate updates on the status of remedial actions for their respective systems, noting that deficiencies may have been corrected  Without effective communication to update its POA&Ms, CDC was not in a position to effectively manage its remedial actions and correct known deficiencies in a timely manner  The recover core security function is intended to support timely recovery of normal operations to reduce the impact from a cybersecurity event  Controls associated with this function include developing and testing contingency plans to ensure that, when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected  Losing the capability to process, retrieve, and protect electronically maintained information can significantly affect an agency’s ability to accomplish its mission  If contingency planning is inadequate, even relatively minor interruptions can result in lost or incorrectly processed data, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete information  NIST SP 800-53 states that agency systems should have a contingency plan that includes the identification of key personnel and the systems’ essential mission functions and addresses full information system restoration  For high-impact systems, NIST specifies that agencies test contingency plans at an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats  In addition, NIST states that organizations should initiate corrective actions based on testing if they are needed  As we reported in June 2018, CDC had developed and fully tested contingency plans for each of the 8 selected mission-essential systems that we reviewed  Each plan identified key personnel and their contact information, essential mission functions of the systems, and instructions on how to fully restore the systems in the event of a disruption  Additionally, between January 2015 and May 2017, CDC had tested whether the 8 systems could be recovered at their respective alternate sites, and had initiated corrective actions based on the results of the tests  However, the alternate site for 6 of the 8 selected mission-essential systems was located in relatively close proximity to the main processing site  Although 2 systems had alternate sites located in another state, the alternate site for the other 6 systems was within the same metropolitan area  As a result, an event such as a natural disaster or substantial power outage could affect both the main and alternate sites for these systems, potentially rendering CDC unable to complete functions associated with its mission  Prompt restoration of service is necessary because the required recovery time for these systems ranged from 4 to 24 hours  Security plans for 3 of the systems recognized the hazards of having the sites within the same geographical region, but stated that CDC had accepted this risk  According to OCIO officials, having a site further away was cost prohibitive; however, the officials had not documented this analysis or the associated risk of having the agency’s processing sites located within the same geographical area  Without documenting the analysis and associated risk, CDC had less assurance that senior leadership was aware of the risk of agency systems being unavailable  As a consequence, senior leadership may not agree whether acceptance of the risk was warranted  An underlying reason for the information security deficiencies in selected systems was that, although the agency had developed and documented an agency-wide information security program, it had not consistently or effectively implemented elements of the program  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for information systems  As discussed previously in this report, CDC had implemented aspects of each of these elements  For example, the agency had conducted risk assessments, developed security plans, assessed security controls, developed remedial action plans, and developed and tested contingency plans for each of the 8 selected mission-essential systems  In addition, the agency had documented numerous policies and procedures and ensured that staff had completed annual security awareness training  However, CDC’s program had shortcomings  For example, as discussed earlier in this report, CDC had not consistently or effectively: addressed threats, technical constraints, and the changing threat environment in its system risk assessments, or assessed the risk of having alternate processing sites within close proximity to each other; documented detailed technical requirements in policies and procedures, or facility controls in facility security plans; tracked and trained staff with significant security responsibilities; monitored configuration settings and comprehensively assessed remediated deficiencies in a timely manner; or documented its cost analysis and associated risk of having an alternate processing site within the same geographical region as its primary processing site  Until CDC addresses these shortcomings and consistently and effectively implements all elements of its information security program, the agency will lack reasonable assurance that its computing resources are protected from inadvertent or deliberate misuse  In our June 2018 report, we made 195 recommendations to CDC to strengthen its technical security controls and bolster its agency-wide information security program  Specifically, we recommended that the agency take 184 actions to resolve technical control deficiencies by implementing stronger access controls, encrypting sensitive data, configuring devices securely, applying patches in a timely manner, strengthening firewall rules, and implementing logging and monitoring controls more effectively, among other actions  We also made 11 recommendations for CDC to improve its information security program by, among other things, assessing risks as needed, documenting more detailed technical requirements, monitoring and assessing controls more comprehensively, and remediating deficiencies in a timely manner  Since the issuance of our June 2018 report, CDC has made significant progress in implementing the recommendations we made to resolve the technical security control deficiencies in the information systems we reviewed and to improve its information security program  In this regard, the agency has implemented many of the recommendations for improving technical security controls for the systems we reviewed and has developed plans to implement recommendations for enhancing its information security program  Specifically, as of August 3, 2018, CDC had fully implemented 102 (55 percent) of the 184 recommendations we made to fortify the technical security controls over the systems we reviewed  In addition, the agency had partially implemented 20 (11 percent) of the 184 recommendations  In these instances, CDC had made progress toward implementing the recommendations, but had not completed all of the necessary corrective actions for us to close the recommendations  Therefore, these recommendations remain open  Further, CDC did not provide any evidence that it had implemented the remaining 62 technical control- related recommendations  Table 3 summarizes the status of CDC’s efforts to implement the 184 recommendations that we made to resolve the technical control deficiencies, as of August 3, 2018  By implementing 102 recommendations, CDC (as of August 3, 2018) reduced some of the risks associated with certain key activities  Specifically, these efforts included protecting network boundaries and logging and monitoring security events for indications of inappropriate or unusual activity on systems—that we highlighted in our June 2018 report as being particularly vulnerable and requiring the agency’s greater priority and attention  In addition, the agency had implemented several of our recommendations to rectify a number of the security control deficiencies  These efforts included strengthening firewall rules, implementing stronger access controls, configuring devices securely, and expanding its audit monitoring capabilities  In addition, CDC had developed a plan of action and milestones (POA&M) for each of the identified technical control deficiencies and related recommendations that remained open as of August 3, 2018  The POA&Ms assigned organization responsibilities, identified estimated costs, identified points of contact, and established time frames for resolving the deficiencies and closing the related recommendations  The agency’s plans called for it to implement the majority of the remaining open technical control-related recommendations by September 2019, and all recommendations by September 2020, as shown in figure 2  Our June 2018 report also included 11 recommendations to CDC to improve its information security program  In particular, we recommended that the agency, among other things, evaluate system impact level categorizations to ensure they reflect the current operating environment; update risk assessments to identify threats and the likelihood of impact of the threat on the environment; and update the facility risk assessments  In addition, we recommended that the agency take the necessary steps to make sure staff with significant security roles and responsibilities are appropriately identified and receive role-based training; monitor the configuration settings of agency systems to ensure the settings are set as intended; update security control assessments to include an assessment of controls using an appropriate level of rigor; and remediate POA&Ms in a timely manner  Further, we recommended that the agency document the cost-benefit analysis with associated risk of having an alternate site within the same geographical region as the main site  As of August 3, 2018, the agency had partially implemented 1 of the 11 information security program-related recommendations, but had not provided any evidence that it had implemented the remaining 10 recommendations  Regarding the partially implemented recommendation, CDC had provided role-based training to all personnel performing significant security responsibilities  However, the agency still needed to establish and automate the identification process and the tracking of training records for individuals needing specialized security role-based training  CDC had developed plans to fully implement this recommendation and each of the remaining 10 information security program-related recommendations by July 2019  Fully implementing the open recommendations is essential to ensuring that the agency’s systems and sensitive information are not at increased and unnecessary risk of unauthorized use, disclosure, modification, or disruption  We received written comments on a draft of this report from CDC  In its comments, which are reprinted in appendix III, the agency stated that it recognizes the risks associated with operating a large, global information technology enterprise and has implemented processes, procedures, and tools to better ensure the prevention, detection, and correction of potential incidents  CDC also said cybersecurity remains a high priority and that it takes the responsibilities for protecting public health information and data entrusted to it seriously  To strengthen its cybersecurity program, the agency stated that it is restructuring and streamlining the cyber program and IT infrastructure of its Office of the Chief Information Officer  Further, CDC stated that it has leveraged GAO’s limited official use only report, issued in June 2018, to accelerate its implementation, infrastructure, and software deployments to complete phrases one and two of DHS’s Continuous Diagnostics and Mitigation program  The agency also said it concurred with, and highlighted a number of actions that it had planned or begun taking to remediate, the 11 security program recommendations that we made to CDC in our June 2018 report  We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and the department’s Office of the Inspector General, the Director of CDC, and interested congressional parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov, or Dr  Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao gov  GAO staff who made key contributions to this report are listed in appendix IV  Our objective was to assess the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems  In June 2018, we issued a report which detailed the findings from our work in response to this objective  In the report, we made 184 recommendations to CDC to resolve the technical security control deficiencies in the information systems we reviewed and 11 additional recommendations to improve its information security program  We designated that report as “limited official use only” (LOUO) and did not release it to the general public because of the sensitive information it contained  This report publishes the findings discussed in our June 2018 report, but we have removed all references to the sensitive information  Specifically, we deleted the names of the information systems and computer networks that we examined, disassociated identified control deficiencies from named systems, deleted certain details about information security controls and control deficiencies, and omitted an appendix that was contained in the LOUO report  The appendix contained sensitive details about the technical security control deficiencies in the CDC’s information systems and computer networks that we reviewed, and the 184 recommendations we made to mitigate those deficiencies  We also provided a draft of this report to CDC officials to review and comment on the sensitivity of the information contained herein and to affirm that the report can be made available to the public without jeopardizing the security of CDC’s information systems and networks  In addition, this report addresses a second objective that was not included in the June 2018 report  Specifically, this objective was to determine the extent to which CDC had taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement that we identified in the earlier report  As noted in our June 2018 report, we determined the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems  To do this, we initially gained an understanding of the overall network environment, identified interconnectivity and control points, and examined controls for the agency’s networks and facilities  We conducted site visits at two CDC facilities in Atlanta, Georgia  To evaluate CDC’s controls over its information systems, we used our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information  We based our assessment of controls on requirements identified by the Federal Information Security Modernization Act of 2014 (FISMA), which establishes key elements for an effective agency-wide information security program; NIST guidelines and standards; Department of Health and Human Services and CDC policies, procedures, and standards; and standards and guidelines from relevant security organizations, such as the National Security Agency, the Center for Internet Security, and the Interagency Security Committee  We had reviewed a non-generalizable sample of the agency’s information systems, focusing on those systems that (1) collect, process, and maintain private or potentially-sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; and (3) were assigned a Federal Information Processing Standard rating of moderate or high impact  Based on these criteria, we had selected eight mission-essential systems for our review  Of these systems, the agency had categorized 7 as high-impact systems and 1 as a moderate-impact system  For these 8 selected mission- essential systems, we had reviewed information security program-related controls associated with risk assessments, security plans, security control assessments, remedial action plans, and contingency plans  To assess the safeguards CDC implemented for its systems, we had examined technical security controls for 24 CDC systems, including systems the agency designated as high-value assets  These included 10 key systems, 8 of which were high- and moderate-impact mission- essential systems just described, 1 additional high-impact system, 1 additional moderate-impact system, and 14 general support systems  We selected the additional high-impact system because the agency re- categorized it as a high-impact system during our review  We selected the additional moderate-impact system because the agency used it to control physical access to highly sensitive CDC biologic lab facilities, including facilities that handle dangerous and exotic substances that cause incurable and deadly diseases  We selected 10 key systems, 8 of which were mission-essential systems, for review that (1) collect, process, and maintain private or potentially sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; (3) could have a catastrophic or severe impact on operations if compromised; or (4) could be of particular interest to potential adversaries  We also selected 14 general support systems that were part of the agency’s network infrastructure supporting the 10 key systems  To review controls over the 10 key systems and 14 general support systems, we had examined the agency’s network infrastructure and assessed the controls associated with system access, encryption, configuration management, and logging and monitoring  For reporting purposes, we had categorized the security controls that we assessed into the five core security functions described in the National Institute of Standards and Technology’s (NIST) cybersecurity framework  The five core security functions are: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities  Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services  Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event  Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event  Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event  These core security functions are described in more detail in appendix II  For the identify core security function, we had examined CDC’s reporting for its hardware and software assets; analyzed risk assessments for the eight selected mission-essential systems to determine whether threats and vulnerabilities were being identified; reviewed risk assessments for two facilities; analyzed CDC policies, procedures, and practices to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; and analyzed security plans for the eight selected systems to determine if those plans had been documented and updated according to federal guidance  We also evaluated the risk assessments for two facilities that housed the 8 mission-essential selected systems  For the protect core security function, we had examined access controls for the 24 systems  These controls included the complexity and expiration of password settings to determine if password management was being enforced; administrative users’ system access permissions to determine whether their authorizations exceeded the access necessary to perform their assigned duties; firewall configurations, among other things, to determine whether system boundaries had been adequately protected; and physical security controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft  We also had examined configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted  In addition, we had examined configuration settings for routers, network management servers, switches, firewalls, and workstations to determine if settings adhered to configuration standards, and inspected key servers and workstations to determine if critical patches had been installed and/or were up-to-date  Further, we had examined training records to determine if employees and contractors had received security awareness training according to federal requirements, and whether personnel who have significant security responsibilities had received training commensurate with those responsibilities  For the detect core security function, we had analyzed centralized logging and network traffic monitoring capabilities for key assets connected to the network; analyzed CDC’s procedures and results for assessing security controls to determine whether controls for the eight selected mission- essential systems had been sufficiently tested at least annually and based on risk  We also had reviewed the agency’s implementation of continuous monitoring practices to determine whether the agency had developed and implemented a continuous monitoring strategy to manage its information technology assets and monitor the security configurations and vulnerabilities for those assets  For the respond core security function, we had reviewed CDC’s implementation of incident response practices, including an examination of incident tickets for 11 incidents; and had examined the agency’s process for correcting identified deficiencies for the eight selected mission-essential systems  For the recover core security function, we had examined contingency plans for eight selected mission-essential systems to determine whether those plans had been developed and tested  In assessing CDC’s controls associated with this function, as well as the other four core functions, we had interviewed Office of the Chief Information Officer officials, as needed  Within the core security functions, as appropriate, we had evaluated the elements of CDC’s information security program based on elements required by FISMA  For example, we analyzed risk assessments, security plans, security control assessments, and remedial action plans for each of the 8 selected mission-essential systems  In addition, we had assessed whether the agency had ensured staff had completed security awareness training and whether those with significant security responsibilities received commensurate training  We also had evaluated CDC’s security policies and procedures  To determine the reliability of CDC’s computer-processed data for training and incident response records, we had evaluated the materiality of the data to our audit objective and assessed the data by various means, including reviewing related documents, interviewing knowledgeable agency officials, and reviewing internal controls  Through a combination of methods, we concluded that the data were sufficiently reliable for the purposes of our work  To accomplish our second objective—on CDC’s actions to address the previously identified security program and technical control deficiencies and related recommendations—we requested that the agency provide a status report of its actions to implement each of the recommendations  For each recommendation that CDC indicated it had implemented as of August 3, 2018, we examined supporting documents, observed or tested the associated security control or procedure, and/or interviewed the responsible agency officials to assess the effectiveness of the actions taken to implement the recommendation or otherwise resolve the underlying control deficiency  Based on this assessment and CDC status reports, we defined the status of each recommendation into the following 3 categories: closed-implemented—CDC had implemented the recommendation; open-partially implemented—CDC had made progress toward, but had not completed, implementing the recommendation; and open-not implemented—CDC had not provided evidence that it had acted to implement the recommendation  We conducted this performance audit from December 2016 to December 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The National Institute of Standards and Technology’s cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover  Within the five functions are 23 categories and 108 subcategories, as described in the table  In addition to the individuals named above, Gary Austin, Jennifer R  Franks, Jeffrey Knott, and Chris Warweg (assistant directors); Chibuikem Ajulu-Okeke, Angela Bell, Sa’ar Dagani, Nancy Glover, Chaz Hubbard, George Kovachick, Sean Mays, Kevin Metcalf, Brandon Sanders, Michael Stevens, Daniel Swartz, and Angela Watson made key contributions to this report  Edward Alexander, Jr  and Duc Ngo (assistant directors); David Blanding, and Christopher Businsky also provided assistance 

ground_truth: There are five major sources of airport capital development funding: the federal Airport Improvement Program (AIP); local passenger facility charges (PFCs) imposed pursuant to federal law; tax-exempt bonds; state and local grants; and airport operating revenue from tenant lease and other revenue-generating activities such as landing fees. Federal involvement is most consequential in AIP, PFCs, and tax-exempt financing. The AIP has been providing federal grants for airport development and planning since the passage of the Airport and Airway Improvement Act of 1982 (P.L. 97-248). AIP funding is usually spent on projects that support aircraft operations such as runways, taxiways, aprons, noise abatement, land purchase, and safety or emergency equipment. The funds obligated for AIP are drawn from the airport and airway trust fund, which is supported by a variety of user fees and fuel taxes. Different airports use different combinations of these sources depending on the individual airport's financial situation and the type of project being considered. Although smaller airports' individual grants are of much smaller dollar amounts than the grants going to large and medium hub airports, the smaller airports are much more dependent on AIP to meet their capital needs. This is particularly the case for noncommercial airports, which received over 25% of AIP grants distributed in FY2018. Larger airports are much more likely to issue tax-exempt bonds or finance capital projects with the proceeds of PFCs. The FAA Reauthorization Act of 2018 (P.L. 115-254) provided annual AIP funding of $3.35 billion from the airport and airway trust fund for five years from FY2019 to FY2023. The act left the basic structure of AIP unchanged, but authorized supplemental annual funding of over $1 billion from the general fund to the AIP discretionary funds, starting with $1.02 billion in FY2019, and required at least 50% of the additional discretionary funds to be available to nonhub and small hub airports. The act included a provision permitting eligible projects at small airports (including those in the State Block Grant Program) to receive a 95% federal share of project costs (otherwise capped at 90%), if such projects are determined to be successive phases of a multiphase construction project that received a grant in FY2011. The 2018 reauthorization expanded the number of states that could participate in the State Block Grant Program from 10 to 20 and also expanded the existing airport privatization pilot program (now renamed the Airport Investment Partnership Program) to include more than 10 airports. The law included a provision that forbids states or local governments from levying or collecting taxes on a business at an airport that "is not generally imposed on sales or services by that State, political subdivision, or authority unless wholly utilized for airport or aeronautical purposes." The airport improvement issues Congress generally faces in the context of FAA reauthorization include the following: Should airport development funding be increased or decreased? Should the $4.50 ceiling on PFCs be eliminated, raised, or kept as it is? Could AIP be restructured to address congestion at the busiest U.S. airports, or should a large share of AIP resources continue to go to noncommercial airports that lack other sources of funding? Should Congress set tighter limits on the purposes for which AIP and PFC funds may be spent? This report provides an overview of airport improvement financing, with emphasis on AIP and the related passenger facility charges. It also discusses some ongoing airport issues that are likely to be included in a future FAA reauthorization debate.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: The federal government supports the development of airport infrastructure in three different ways  First, the Airport Improvement Program (AIP) provides federal grants to airports for planning and development, mainly of capital projects related to aircraft operations such as runways and taxiways  Second, Congress has authorized airports to assess a local passenger facility charge (PFC) on each boarding passenger, subject to specific federal approval  PFC revenues can be used for a broader range of projects than AIP funds, including "landside" projects such as passenger terminals and ground access improvements  Third, federal law grants investors preferential income tax treatment on interest income from bonds issued by state and local governments for airport improvements (subject to compliance with federal rules)  Airports may also draw on state and local funds and on operating revenues, such as lease payments and landing fees  A federal role in airport infrastructure first developed during World War II  Prior to the war, airports were a local or private responsibility, with federal support limited to the tax exclusion of municipal bond interest  National defense needs led to the first major federal support for airport construction  After the war, the Federal Airport Act of 1946 (P L  79-377) continued federal a id, although at lower levels than during the war years  Initially, much of this spending supported conversion of military airports to civilian use  In the 1960s, substantial funding also was used to upgrade and extend runways for use by commercial jets  In 1970, Congress responded to increasing congestion, both in the air and on the ground at U S  airports, by passing two laws  The first, the Airport and Airway Development Act, established the forerunner programs of AIP: the Airport Development Aid Program and the Planning Grant Program  The second, the Airport and Airway Revenue Act of 1970, dealt with the revenue side of airport development, establishing the Airport and Airway Trust Fund (AATF, also referred to as the Aviation Trust Fund, and in this report, the trust fund)  The Airport and Airway Improvement Act of 1982 ( P L  97-248 ; the 1982 Act) created the current AIP and reactivated the trust fund  For a more detailed legislative history of AIP, see Appendix A of this report  Eight years later, amid concerns that the existing sources of funds for airport development would be insufficient to meet national airport needs, the Aviation Safety and Capacity Expansion Act of 1990 (Title IX of the Omnibus Budget Reconciliation Act of 1990, P L  101-508 ) allowed the Secretary of Transportation to authorize public agencies that control commercial airports to impose a passenger facility charge on each paying passenger boarding an aircraft at their airports  Different airports use different combinations of AIP funding, PFCs, tax-exempt bonds, state and local grants, and airport revenues to finance particular projects  Small airports are more likely to be dependent on AIP grants than large or medium-sized airports  Larger airports are much more likely to issue tax-exempt bonds or finance capital projects with the proceeds of PFCs  Each of these funding sources places various legislative, regulatory, or contractual constraints on airports that use it  The availability and conditions of one source of funding may also influence the availability and terms of other funding sources  In a 2015 study, the U S  Government Accountability Office (GAO) found that airport-generated net income financed about 38% of airports' capital spending, AIP 33%, PFCs 18%, capital contributions by airport sponsor (often a state or municipality) or by other sources such as an airline or tenant 6%, and state grants nearly 5%  AIP provides federal grants to airports for airport development and planning  Participants range from very large publicly owned commercial airports to small general aviation airports that may be privately owned but are available for public use  AIP funding is usually limited to construction of improvements related to aircraft operations, such as runways and taxiways  Commercial revenue-producing facilities are generally not eligible for AIP funding, nor are operating costs  The structure of AIP funds distribution reflects congressional priorities and the objectives of assuring airport safety and security, increasing airport capacity, reducing congestion, helping fund noise and environmental mitigation costs, and financing small state and community airports  The main financial advantage of AIP to airports is that, as a grant program, it can provide funds for capital projects without the financial burden of debt financing, although airports are required to provide a modest local match to the federal funds  Limitations on the use of AIP grants include the range of projects that AIP can fund and the requirement that recipients adhere to all program regulations and grant assurances  Federal law requires the Secretary of Transportation to publish a national plan for the development of public-use airports in the United States  This appears as a biannual Federal Aviation Administration (FAA) publication called the National Plan of Integrated Airport System s (NPIAS)   For an airport to receive AIP funds, it must be listed in the NPIAS  AIP program structure and authorizations are set in FAA authorization acts  Modifications have been made to AIP through the years, but the basic program structure remains the same  The most recent act, the FAA Reauthorization Act of 2018 ( P L  115-254 ), authorized AIP funding through FY2023  The trust fund was designed to assure an adequate and consistent source of funds for federal airport and airway programs  It is the primary funding source for most FAA activities in addition to federal grants to airports  These include facilities and equipment (F&E); research, engineering, and development (R, E&D); and FAA operations and maintenance (O&M)  Congress determines how much the trust fund will be allowed to expend for various purposes, including the AIP  The money flowing into the Airport and Airway Trust Fund comes from a variety of aviation-related taxes  These taxes were authorized by the Taxpayer Relief Act of 1997 ( P L  105-34 ) and reauthorized by the 2018 FAA reauthorization act  Revenue sources include the following: 7 5% ticket tax, $4 20 flight segment tax, 6 25% tax on cargo waybills, 4 4 cents per gallon on commercial aviation fuel, 19 4 cents per gallon on general aviation gasoline, 21 9 cents per gallon on general aviation jet fuel, 14 1 cents per gallon fractional ownership surtax on general aviation jet fuel, $18 60 international arrival tax, $18 60 international departure tax, and 7 5% "frequent flyer" award tax  In most years since the trust fund was established, the revenues plus interest on the unexpended balances brought in more money than was being paid out  This led to the growth in the end-of-year unexpended balances in the trust fund  At times these unexpended balances are inaccurately referred to as a surplus  In practice, FAA may have committed unexpended balances to fund particular airport projects, so those balances may not be available for other purposes  Most air carriers have altered their pricing structures in ways that have implications for the trust fund  Ancillary fees are now commonly charged for services such as checked baggage that in the past were included in the ticket price  Such fees are not subject to the 7 5% ticket tax  Had the $4 57 billion in baggage fees collected in 2017 been subject to the ticket tax, the trust fund might have received more than $343 million in additional revenue  AIP spending authorized and the amounts actually made available for grants from the aviation trust fund since FY2000 are illustrated in Table 1   After trending upward from FY1982 to FY1992, grant funding approved in annual appropriations declined through the mid-1990s as part of federal deficit reduction efforts, leaving large gaps between authorized AIP spending levels and the amounts the program was actually allowed to expend  This occurred despite provisions in place since 1976 designed to ensure that federal capital spending for airports is fully funded at the authorized level (see Text B ox )  The Wendell H  Ford Aviation Investment and Reform Act for the 21 st Century (AIR21; P L  106-181 ), enacted in 2000, provided major increases in AIP's authorization, starting in FY2001  During FY2001-FY2006 AIP was funded near its fully authorized levels  The amount available for grants peaked at $3 47 billion in FY2008  From FY2008 through FY2011, when AIP was authorized by a series of authorization extension acts, appropriators set the program's annual obligation limitation at $3 515 billion  The 2012 FAA Modernization and Reform Act authorized funding through FY2015 at an annual level of $3 35 billion  In July 2016, the FAA Extension, Safety, and Security Act of 2016 ( P L  114-190 ) was passed to further extend the authorization of AIP at the annual level of $3 35 billion through September 30, 2017  The 115 th Congress passed a six-month extension ( P L  115-63 ) of aviation funding and programs through the end of March 2018  Subsequently, the Consolidated Appropriations Act, 2018 ( P L  115-141 ), provided a further extension through the end of FY2018  In addition to the annual funding of $3 35 billion, the 2018 appropriations act provided a $1 0 billion appropriation from the general fund to the AIP discretionary grants program  The Secretary of Transportation was directed to keep this supplemental funding available through September 30, 2020, and to give priority to nonprimary, nonhub, and small hub airports  These supplemental funds are not included in the AIP funding summary or discussion in this report, as FAA is in the process of evaluating applications and distributing funds  The FAA Reauthorization Act of 2018 ( P L  115-254 ) funded AIP from FY2019 through FY2023 at an annual level of $3 35 billion  It also authorized supplemental annual funding from the general fund to the AIP discretionary grants program ($1 02 billion in FY2019, $1 04 billion in FY2020, $1 06 billion in FY2021, $1 09 billion in FY2022, and $1 11 billion in FY2023), and required at least 50% of these additional funds to be available to nonhub and small hub airports  In February 2019, Congress passed the Consolidated Appropriations Act, 2019 ( P L  116-6 )  The act provided a $500 million supplemental appropriation from the general fund to the AIP discretionary grants program and required that this money remain available through September 30, 2021  The distribution system for AIP grants is complex  It is based on a combination of formula grants (also referred to as apportionments or entitlements) and discretionary funds  Each year the entitlements are first apportioned by formula to specific airports or types of airports  Once the entitlements are satisfied, the remaining funds are defined as discretionary funds  Airports apply for discretionary funds for projects in their airport master plans  Formula grants and discretionary funds are not mutually exclusive, in the sense that airports receiving formula funds may also apply for and receive discretionary funds  Grants are generally awarded directly to airports  Legislation sets forth definitions of airports that are relevant both in discussions of the airport system in general and of AIP funding distribution in particular (see Appendix B )  The statutory provisions for the allocation of both formula and discretionary funds are based on these definitions  Entitlements are funds that are apportioned by formula to airports and may generally be used for any eligible airport improvement or planning project  These funds are divided into four categories: primary airports, cargo service airports, general aviation airports, and Alaska supplemental funds (see Appendix B for a full list of airport definitions)  Each category distributes AIP funds by a different formula (49 U S C  §47114)  Most airports have up to three years to use their apportionments  Nonhub commercial service airports have up to four years  The formula distributions are contingent on an annual AIP obligation limitation of $3 2 billion or more  If this threshold is not met in a particular fiscal year, most formulas revert to prior authorized funding formulas  Primary Airports  The apportionment for airports that board more than 10,000 passengers each year is based on the number of boardings (also referred to as enplanements) during the prior calendar year  The amount apportioned for each fiscal year is equal to double the amount that would be received according to the following formulas: $7 80 for each of the first 50,000 passenger boardings; $5 20 for each of the next 50,000 passenger boardings; $2 60 for each of the next 400,000 passenger boardings; $0 65 for each of the next 500,000 passenger boardings; and $0 50 for each passenger boarding in excess of 1 million  The minimum allocation to any primary airport is $1 million  The maximum is $26 million  Cargo Service Airports  Some 3 5% of AIP funds subject to apportionment are apportioned to airports served by all-cargo aircraft with a total annual landed weight of more than 100 million pounds  The allocation formula is the proportion of the individual airport's landed weight to the total landed weight at all cargo service airports  General Aviation Airports  General aviation, reliever, and nonprimary commercial service airports are apportioned 20% of AIP funds subject to apportionment  From this share, all airports, excluding all nonreliever primary airports, receive the lesser of the following: $150,000; or one-fifth of the estimated five-year costs for airport development for each of these airports as listed in the most recent NPIAS  Any remaining funds are distributed according to a state-based population and area formula  FAA makes the project decisions on the use of these funds in consultation with the states  Although FAA has ultimate control, some states view these funds as an opportunity to address general aviation needs from a statewide, rather than a local or national, perspective  Alaska Supplemental Funds  Funds are apportioned to airports in Alaska to assure that Alaskan airports receive at least twice as much funding as they did under the Airport Development Aid Program in 1980  Foregone Apportionments  Large and medium hub airports that collect a passenger facility charge of $3 or less have their AIP formula entitlements reduced by an amount equal to 50% of their projected PFC revenue for the fiscal year until they forgo or give back 50% of their AIP formula grants  In the case of PFC above the $3 level the percentage forgone is 75%  A special small airport fund, which provides grants on a discretionary basis to airports smaller than medium hub, gets 87 5% of these foregone funds  The discretionary fund gets the remaining 12 5%  The discretionary funds (49 U S C  §§47115-47116) include the money not distributed under the apportioned entitlements, as well as the forgone PFC revenues that were not deposited into the small airport fund  AIP discretionary funding for FY2018 was about 9 4% of the total AIP funding  Discretionary grants are approved by FAA based on project priority and other selection criteria  Figure 1 illustrates the composition of both apportioned and discretionary grants, based on FY2018 data  Despite its name, the discretionary fund is not allocated solely at FAA's discretion  Allocations are subject to the following three set-asides and certain other spending criteria: Airport Noise Set-Asides   At least 35% of discretionary funds are set aside for noise compatibility planning and for carrying out noise abatement and compatibility programs  Military Airport Program   At least 4% of discretionary funds are set aside for conversion and dual use of up to 15 current and former military airports  The program allows funding of some projects not normally eligible under AIP  Grants for Reliever Airports   There is a set-aside of two-thirds of 1% of discretionary funds for reliever airports in metropolitan areas suffering from flight delays  The Secretary of Transportation is also directed to see that 75% of the grants made from the discretionary fund are used to preserve and enhance capacity, safety, and security at primary and reliever airports, and also to carry out airport noise compatibility planning and programs at these airports  From the remaining 25%, FAA is required to set aside $5 million for the testing and evaluation of innovative aviation security systems  Subject to these limitations and the three set-asides, the Secretary of Transportation, through FAA, has discretion in distribution of grants from the remainder of the discretionary fund  Under this program, FAA provides funds directly to participating states for projects at airports classified as other than primary airports  Each participating state receives a block grant made up of the state's apportionment (formula) funds and available discretionary funds  A block grant program state is responsible for selecting and funding AIP projects at the small airports in the state  In making the selections, the participating states are required to comply with federal priorities  Each block grant state is responsible for project administration as well as most of the inspection and oversight roles normally assumed by FAA  The states that currently participate in the state block grant program are Georgia, Illinois, Michigan, Missouri, New Hampshire, North Carolina, Pennsylvania, Tennessee, Texas, and Wisconsin  For AIP projects, the federal government share differs depending on the type of airport  The federal share, whether funded by formula or discretionary grants, is as follows: 75% for large and medium hub airports (80% for noise compatibility projects); 90% for other airports; "not more than" 90% for airport projects in states participating in the state block grant program; 70% for projects funded from the discretionary fund at airports receiving exemptions under 49 U S C  §47134, the pilot program for private ownership of airports; airports reclassified as medium hubs due to increased passenger volumes may retain eligibility for up to a 90% federal share for a two-year transition period; certain economically distressed communities receiving subsidized air service may be eligible for up to a 95% federal share of project costs  This cost-share structure means that smaller airports pay a lower share of AIP-funded project costs than larger airports  The airports themselves must raise the remaining share from other sources  Although smaller airports' individual grants are of much smaller dollar amounts than the grants going to large and medium hub airports, the smaller airports are much more dependent on AIP to meet their capital needs  This is particularly the case for noncommercial airports, such as general aviation and reliever airports, which received over 25% of AIP grants distributed in FY2018  Air carriers have objected to this allocation, pointing out that their passengers and freight shippers pay the vast majority of revenue flowing into the trust fund  General aviation interests, however, defend AIP grants to noncommercial airports  Figure 2 shows the share of AIP grants awarded in FY2018, by value, broken out by airport type  Figure 3 displays AIP grants awarded by type of project for FY2018  For the most part, AIP development grants support "airside" development projects such as runways, taxiways, aprons, navigation aids, lighting, and airside safety projects  Substantial AIP funds also go for state block grants and noise planning and abatement  AIP spending on roads is generally restricted to roads on or entering airport property  In cases in which a primary or reliever airport may want to begin an AIP-eligible project without waiting for the funds to become available, FAA is authorized to issue a letter of intent (LOI)  If it does so, the LOI states that eligible project costs, up to the allowable federal share, will be reimbursed according to a schedule set forth in the letter  Although the LOI technically does not obligate the federal government, it is an indication of FAA's approval of the scope and timing of the project, as well as the federal intent to fund the project in future years  Because most primary airports fund their major development projects with tax-exempt revenue bonds, the evidence of federal support that the LOI provides is likely to lead to favorable bond interest rates  The airport may proceed with the project with assurance that all AIP-allowable costs specified in the LOI will remain eligible for reimbursement over the life of the LOI  Both entitlement and discretionary funds are used to fulfill LOIs  FAA limits the total of discretionary funds in all LOIs subject to future obligation to roughly 50% of forecast available discretionary funds  LOIs have certain eligibility restrictions  They can only be issued to cover projects at primary and reliever airports  The proposed airport development project or action must "enhance airfield capacity in terms of increased aircraft operations, increased aircraft seating or cargo capacity, or reduced airfield operational delays " For large and medium hub airports, the project must enhance "system-wide airport capacity significantly " Airports' grant applications are conditioned on assurances regarding future airport operations  Examples of such assurances include making the airport available for public use on reasonable conditions and without unjust economic discrimination (against all types, kinds, and classes of aeronautical activities); charging air carriers making similar use of the airport substantially comparable amounts; maintaining a current airport layout plan; making financial reports to FAA; and expending airport revenue only on capital or operating costs at the airport  Within the AIP context, assurances are a means of guaranteeing the implementation of federal policy  Obligations derived from airports' assurances extend beyond the formal closure of AIP grant-supported projects  Obligations related to the use, operation, and maintenance of an airport remain in effect for the expected life of the improvement, up to 20 years  In the case of the purchase of land with AIP funds, the federal obligations do not expire  Airports may request that FAA release them from their AIP contractual obligations  Typically, as a condition of the release, the airport sponsor must either reimburse the federal government for the AIP grants (in the case of land grants, the federal share of the fair market value of the land) or reinvest the amount in an approved AIP project (see Text B ox )  When airport managers or interest groups express concerns about the "strings attached" to AIP funding, they are usually referring to AIP grant assurances  In 1990, federal deficits and expected tight budgets led to concerns that the Airport and Airway Trust Fund and other existing sources of funds for airport development would be insufficient to meet national airport needs  This led to authorization of a new user charge, the Passenger Facility Charge (PFC)  The PFC was seen as a complementary funding source to AIP  The Aviation Safety and Capacity Expansion Act of 1990 allowed the Secretary of Transportation to authorize public agencies that control commercial airports to impose a fee on each paying passenger boarding an aircraft at their airports  Initially, there was a $3 cap on each airport's PFC and a $12 limit on the total PFCs that a passenger could be charged per round trip  The PFC is a state, local, or port authority fee, not a federally imposed tax deposited into the Treasury  Because of the complementary relationship between AIP and PFCs, PFC provisions are generally folded into the sections of FAA reauthorization legislation dealing with AIP  The money raised from PFCs must be used to finance eligible airport-related projects  Unlike AIP funds, PFC funds may be used to service debt incurred to carry out projects  Legislation in 2000 raised the PFC ceiling to $4 50, with an $18 limit on the total PFCs that a passenger can be charged per round trip  To impose a PFC above $3 an airport has to show that the funded projects will make significant improvements in air safety, increase competition, or reduce congestion or noise impacts on communities, and that these projects could not be fully funded by using the airport's AIP formula funds or AIP discretionary grants  Large and medium hub airports imposing PFCs above the $3 level forgo 75% of their AIP formula funds  PFCs at large and medium hub airports may not be approved unless the airport has submitted a written competition plan to FAA, which includes information about the availability of gates, leasing arrangements, gate-use requirements, controls over airside and ground-side capacity, and intentions to build gates that could be used as common facilities  The FAA Modernization and Reform Act of 2012 included minor changes to the PFC program  The act made permanent the trial program that authorized nonhub small airports to impose PFCs  The act also required GAO to study alternative means of collecting PFCs without including the PFC in the ticket price  The FAA Reauthorization Act of 2018 did not include significant changes to the PFC program and maintained the $4 50 PFC cap, with a maximum charge of $18 per round-trip flight  It did include a provision, however, that required a qualified organization to conduct a study assessing the infrastructure needs of airports and existing financial resources for commercial service airports and to make recommendations on the actions needed to upgrade the national aviation infrastructure system  Unlike AIP grants, of which over 67% in FY2018 went to airside projects (runways, taxiways, aprons, and safety-related projects), PFC revenues are heavily used for landside projects, such as terminals and transit systems on airport property, and for interest payments  Table 2 shows the AIP grant awards and PFC approvals by project type in FY2018  Annual system-wide PFC collections grew from $85 4 million in 1992 to over $3 4 billion in 2018  The PFC statutory language lends itself to a broader interpretation of "capacity enhancing" projects, and the implementing regulations are less constraining than those for AIP funds  Air carriers, which historically have preferred funding to be dedicated to airside projects, must be notified and provided with an opportunity for consultation about airports' proposals to fund projects with PFC revenues  They are generally less involved in the PFC project planning and decisionmaking process than is the case with AIP projects  The difference in the pattern of project types may also be influenced by the fact that larger airports, which collect most of the PFC revenue, tend to have substantial landside infrastructure, whereas smaller airports that are much more dependent on AIP funding have comparatively limited landside facilities  Bonds have long been a major source of funding for capital projects at primary airports  According to Bond Buyer, a trade publication, airports raised approximately $17 4 billion in 84 bond issues in 2018, a substantial increase over the $14 7 billion raised in 116 issues in 2017  Most airport-related bonds are classified as tax-exempt private activity bonds (PABs)  These bonds, issued by a local government or public authority, allow the use of landing fees, charges on airport users, and property taxes on privately controlled on-airport buildings, such as cargo facilities, to service debt without obligating tax revenue  Their tax-exempt status enables airports to raise funds more cheaply than would otherwise be the case because investors enjoy a federal income tax exclusion on interest paid on the bonds  In some cases, revenue from PFCs may be used to service the bonds  PABs may be used to build facilities that are directly related and essential to servicing aircraft, enabling aircraft to take off and land, and transferring passengers or cargo to or from aircraft  Normally, airport bonds might be classified as taxable PABs because they are used to finance facilities where more than 90% of the activity is private and more than 90% of the repayment is from revenue generated by the facility  Issuers of taxable PABs must pay higher interest rates than required on tax-exempt bonds, to compensate investors for the taxes due on interest income  Congress therefore created an exception allowing airports that are owned by governmental entities to issue "qualified" PABs that are tax-exempt   The majority of airport bonds are considered by the Internal Revenue Service to be "qualified" PABs  Some recent proposals would allow privately owned airports to receive the same tax-preferred treatment of their bonds as airports owned by public authorities  A possible precedent for this is the Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users ( P L  109-59 , §1143; SAFETEA-LU), which allowed for up to $15 billion in tax-exempt bond financing for highways or freight transfer facilities that would otherwise not qualify for tax-exempt financing  Many of the supporters of the SAFETEA-LU provisions envisioned expanded eligibility for PABs as a means of facilitating public-private partnerships between a public authority and an outside investor  In the airport context, this would be analogous to an airport authority agreeing to a long-term lease with a private investor who would have the ability to enter the market for tax-exempt bonds to finance improvements at the airport and, perhaps, also to finance the purchasing costs of the lease itself  By statute, the safe operation of airports is the highest aviation priority  Other priorities established by Congress include increasing capacity to the maximum feasible extent, minimizing noise impacts, and encouraging efficient service to state and local communities (i e , support for general aviation airports)  But there are significant disagreements about the appropriate degree of federal participation in airport development and finance and about the specific types of expenditure that should be given priority within AIP  Airline and airport operators tend to view the fully authorized funding of the program as a good thing  An alternative view, however, is that too much has been spent on AIP, particularly at smaller airports that do not play a significant role in commercial aviation  The assessment of airport capital needs is fundamental to determining the appropriate federal support needed to foster a safe and efficient national airport system  The federal government's interest goes beyond capacity issues to include implementation of federal safety and noise policies  Both FAA and the Airports Council International-North America (ACI-NA) have issued projections of airports' long-term financial needs  In its most recent NPIAS report, FAA estimated that the national system's capital needs for FY2019-FY2023 will total $35 1 billion (an annual average of approximately $7 billion)  The ACI-NA infrastructure needs survey resulted in an estimate of $128 1 billion over the same years (an annual average of approximately $25 6 billion)  The main reason for the widely differing estimates was disparate views on what kinds of airport projects to include  The NPIAS report was based on information taken from airport master plans and state system plans, but FAA planners screened out planned projects not justified by aviation activity forecasts or not eligible for AIP grants  Only designated NPIAS airports were included in the FAA study  Implicit in this methodology is that the planning has been carried through to the point where financing is identified  Not all projects used to develop the NPIAS estimates are actually completed, or in some cases even begun, within the range of years covered in the NPIAS estimates  ACI-NA argues that the NPIAS underestimates AIP eligible needs because not all such needs will be in the current airport plans  The ACI-NA study reflects the broader business view of major airport operators and casts a substantially wider net  It includes projects funded by PFCs, bonds, or state or local funding; airport-funded air traffic control facilities; airport- or TSA-funded security projects; "necessary" AIP-ineligible projects such as parking facilities, hangars, revenue portions of terminals, and off-airport roads/transit facilities; and AIP-eligible projects not reported to FAA in the belief that there would be a low probability of receiving additional AIP funding  Its 2019-2023 infrastructure needs survey, for example, included major airport terminal projects that are ineligible for AIP grants  The ACI-NA study also includes projects without identified funding sources  The ACI-NA estimate is higher than the FAA estimate because of the wider net it casts and because it is adjusted for projected inflation  The estimates are important because the primary AIP reauthorization issue is the program's appropriate level of funding  Because the ACI-NA airport needs projection includes much that is not eligible for AIP grants, its accuracy may not be as critical in evaluating appropriate AIP funding levels as that of the NPIAS projections  On the other hand, the broader ACI-NA estimate may be more significant for policy choices related to bond issuance and PFCs, since these sources fund a broader range of projects than AIP  In 2004, then-FAA Administrator Marion C  Blakey stated that the agency's goal was to increase total capacity at the top 35 U S  airports by 30% over a 10-year period  FAA's Operational Evolution Plan (OEP) is intended to increase the capacity and efficiency of the National Airspace System (NAS) over a 10-year period to keep up with the expected growth in demand for air travel and air cargo  In support of that goal, FAA released a study focused on the 35 busiest airports, Capacity Needs in the National Airspace System: An Analysis of Airport and Metropolitan Area Demand and Operational Capacity in the Future (also referred to as FACT1)  The study projected 18 airports would need additional capacity by 2020  In 2007, FACT1 was updated by a second study, FACT2  FACT2 expanded the study to include 21 non-OEP airports that were identified as having the potential to be capacity constrained or were in capacity-constrained metropolitan areas  The study examined airports that would need capacity increases and also projected which airports would need capacity increases in 2015 and 2025  It identified four airports plus the New York metropolitan area that needed additional capacity in 2007  It further identified 14 hub airports as likely to be capacity-constrained in 2025  FACT2 found that, in comparison to FACT1, many non-OEP airports "    have higher capacities than originally presumed and thus less need for additional capacity " A further update, FACT3, was released in January 2015  FACT3 forecasted that the 2007-2009 recession, volatile fuel costs, airline consolidation, and replacement of many 50-seat regional jets with larger aircraft would result in 32% fewer operations and about 23% fewer enplanements in 2025 at the 30 core airports than forecast in FACT2  It projected that airport delays would remain concentrated at a few major hub airports, notably the three New York City-area airports, Philadelphia International Airport, and Hartsfield-Jackson Atlanta International Airport  This study may have implications for the reauthorization of AIP  The large runway projects that are the focus of the OEP can require long lead times—10 or more years from concept to initial construction is not unusual  At large and medium hub airports, runway projects are usually paid for, in part, by AIP funds  Therefore, some projects needed by 2025 may require AIP funding in earlier years  Because large and medium airports that levy PFCs must forgo either 50% or 75% of their AIP formula entitlement funds, most federal funding for their runway projects would probably need to take the form of AIP discretionary funds  The pool of discretionary funds is primarily the remainder of annual funding after the entitlement formula requirements are satisfied  Of the forgone PFC funds, 87 5% are reserved for the small airport fund and are also not available for OEP airports  If the AIP budget is constrained in the future, either under a reauthorization bill or during the annual appropriations process, and the entitlement formulas remain as they are, the discretionary portion of the AIP budget may be squeezed, limiting large airports' ability to draw on AIP funds for major capacity expansion projects  Many of the attributes of AIP's programmatic structure are similar to those of the 1982 act that created the program  Over the years these attributes have been modified based on perceived needs and on the practical politics of passing the periodic FAA reauthorization bills that contain the AIP provisions  These considerations make a major overhaul of the AIP structure unlikely, but may leave room for programmatic adjustments in the distribution of apportionments  One such adjustment might shift AIP funds to enhancing capacity at large and medium hub airports  There are several ways Congress might accomplish this  One would be to eliminate the requirement that large and medium hub airports that impose the maximum PFCs forgo 75% of their entitlements  This change would give larger airports a greater share of entitlement funding, but at the cost of reducing AIP grants to small airports  Alternatively, changes in the statutory set-asides of discretionary funds could give FAA more flexibility to use that money for capacity enhancement, but might reduce funding for noise mitigation and other purposes  Changes in the last several FAA authorization acts increased entitlements and broadened the range of landside projects eligible for AIP grants  These changes generally benefitted airports smaller than medium hub size  In particular, the increased amount of apportioned funds has limited the availability of funds for discretionary grants at major airports  Further changes giving airports increased flexibility in the use of their entitlements might benefit smaller airports not served by commercial aviation, in line with the national goal of having an "extensive" national airport system, but this use of funds might conflict with the goal of reducing congestion at major commercial airports  The current apportionment system relies on a $3 2 billion funding level trigger mechanism to lift most of the apportionments to twice their formula level  This has been in place for two reauthorization cycles  Should that trigger be breached, entitlements for all airports would be reduced drastically  The entitlement formulas may not be sustainable, without depleting discretionary funds, in the absence of additional funding for AIP  One way to reduce the amount of trust fund revenue needed for AIP would be to allow large and medium hub airports to opt out of AIP and rely exclusively on PFCs to finance capital projects  This would require raising or eliminating the federal cap on PFCs  These "defederalized" airports could then be released from some or all of the AIP grant assurances under which they now operate, such as land use requirements and airport revenue use restrictions  If airports exit the program, AIP spending could be reduced or could be redirected to other NPIAS airports  Airport privatization denotes a change in ownership from a public entity (such as a local government or an airport authority established by a state government) to a private one  In a number of countries, such as Great Britain, government-owned airports have been privatized by sale to private owners  In the United States, some airports have allowed private ownership of certain on-airport facilities or management functions, but the ownership of all major airports remains in the hands of government entities  The Airport Privatization Pilot Program (49 U S C  §47134; Section 149 of the Federal Aviation Reauthorization Act of 1996, P L  104-264 , as amended) authorizes FAA to exempt up to 10 airports from certain federal restrictions on the use of airport revenue off-airport  Participating airports may be also exempted from certain requirements on the repayment of federal grants  Privatized airports may still participate in the AIP, but at a lower federal share (70%)  The pilot program was renamed the Airport Investment Partnership Program (AIPP) in the 2018 FAA reauthorization act and expanded to admit more than 10 airports  The AIPP provides that at primary airports, the airport sponsor may only recover from the sale or lease an amount approved by at least 65% of the scheduled air carriers serving the airport, as well as by both scheduled and unscheduled air carriers that together account for 65% of the total landed weight at the airport for the year  The requirement that air carriers approve the use of airport revenue for nonairport purposes, such as profit distribution, may have served to limit interest in the program  To date, only two airports have completed the privatization process established under the provisions of the AIPP  One of those, Stewart International Airport in New York State, subsequently reverted to public ownership when it was purchased by the Port Authority of New York and New Jersey  Luis Muñoz Marín International Airport in San Juan, PR, is now the only commercial service airport operating under private management after privatization under the APPP  As of 2018, there are three applicants under active FAA consideration: Hendry County Airglades Airport in Clewiston, FL; Westchester Airport in White Plains, NY; and St  Louis Lambert International Airport in St  Louis, MO  There is no certainty that any AIP cost savings from privatization would be retained for use by the other AIP-eligible airports  AIP spending is determined by the authorization and appropriations process, and Congress could choose to use any savings to reduce the program size, to marginally assist in deficit reduction, to reduce general fund portions of FAA operations funding, or to make money available for spending elsewhere  Debate over FAA reauthorization generally brings forth proposals to alter the AIP grant assurances, such as ensuring that workers on airport construction projects receive prevailing wages set under the Davis-Bacon Act and pledging to use airport revenue solely for spending on airport operations and capital costs  If AIP spending remains constrained, critics are likely to argue that the grant assurances raise the cost of projects to increase airport capacity and complicate the closure and reuse of underutilized airports or airports that are locally unpopular due to noise or safety concerns  Historically, a basic funding issue is whether to change the existing discretionary fund set-aside for noise mitigation and abatement  The noise set-aside, however, has been increased in previous reauthorization acts and is now 35% of discretionary funding  Demand to use AIP funds for noise mitigation could increase if Congress grants FAA the flexibility to fund noise mitigation projects that are outside the DNL 65 decibel (dB) noise impact area, but this could divert resources from capacity and safety projects  A related issue is whether to make the planning for noise-mitigating air traffic control procedures at individual airports eligible for AIP funding  The central issue related to PFCs is whether to raise the $4 50 per enplaned passenger ceiling or to eliminate the ceiling altogether  In general, airports argue for increasing or eliminating the ceiling, whereas most air carriers and some passenger advocates oppose higher limits on the PFCs  A 2015 GAO study analyzed the effects by raising the PFC cap under three scenarios: setting the cap at $6 47, $8 00, or $8 50  The study found raising PFC would significantly increase airport funding, but could also marginally slow passenger growth and therefore the growth in revenues to the trust fund  PFC supporters feel that the PFC is more reliable than AIP funding, which is subject to the authorization and appropriations process  They also argue that PFCs are procompetitive, helping airports build gates and facilities that both encourage new entrant carriers and allow incumbent carriers to expand  Advocates of an increase in the cap also argue that over time, the value of the PFC has been eroded by inflation and an adjustment is therefore necessary  The permissible uses of revenues are an ongoing point of contention  Airport operators, in particular, would like more freedom to use PFC funds for off-airport projects, such as transportation access projects, and want the process of obtaining FAA approval to be streamlined  Carriers, on the other hand, often complain that airports use PFC funds to finance proposals of dubious value, especially outside airport boundaries, instead of high-priority projects that offer meaningful safety or capacity enhancements  The major air carriers are also unhappy with their limited influence over project decisions, as airports are required only to consult with resident air carriers instead of having to get their agreement on PFC-funded projects  Unlike interest income from governmental bonds, which is not subject to the alternative minimum tax (AMT), interest from private activity bonds is still subject to the AMT  ACI-NA has proposed broadening the definition of governmental airport bonds to, in effect, include either all airport bonds or at least those bonds issued for public-use projects that meet AIP or PFC eligibility requirements  Opponents of such changes express concerns that these changes would reduce U S  Treasury revenues  Some also argue it would make more sense to change the AMT as part of a tax bill rather than including a specific exemption for income on airport bonds in an FAA reauthorization bill  In either case, such a change would not be under the jurisdiction of the congressional committees that will have jurisdiction over most reauthorization provisions  Changes to the AMT would be under the jurisdiction of the congressional tax-writing committees, the House Committee on Ways and Means and the Senate Committee on Finance  Appendix A  Legislative History of Federal Grants-in-Aid to Airports Prior to World War II the federal government viewed airports as a local responsibility  During the 1930s, it spent about $150 million a year on airports through work relief agencies such as the Works Progress Administration (WPA)  The first federal support for airport construction was granted during World War II  After the war, the Federal Airport Act of 1946 (P L  79-377) created the Federal Aid to Airports Program, using funds appropriated annually from the general fund  Initially much of this spending supported conversion of military airports to civilian use  In the 1960s substantial funding went to upgrade and extend runways for use by commercial jets  By the end of the 1960s, congestion, both in the air and on the ground at U S  airports, was seen as evidence that airport capacity was inadequate  Airport and Airway Development and Revenue Acts of 1970 (P L  91-258) In 1970, Congress responded to the capacity concerns by passing two acts  The first, the Airport and Airway Development Act (Title I of P L  91-258), established the Airport Development Aid Program (ADAP) and the Planning Grant Program (PGP), and set forth the programs' grant criteria, distribution guidelines, and authorization of grant-in-aid funding for the first five years of the program  The second, the Airport and Airway Revenue Act of 1970 (Title II of P L  91-258), established the Airport and Airway Trust Fund  Revenues from levies on aviation users and fuel were dedicated to the fund  Under the 1970 acts the trust fund could pay capital costs and, when excess funds existed, could also help cover FAA's administrative and operations costs  Airport and Airway Development and Revenue Acts Amendments of 1971 (P L  92-174) The Nixon Administration's FAA budget requests for FY1971 and FY1972 under the new trust fund system brought it into immediate conflict with Congress over the budgetary treatment of trust fund revenues  The Administration treated the new financing system as a user-pay system, whereas many Members of Congress viewed the trust fund as primarily a capital fund  The 1971 Amendments Act made the trust fund a capital-only account (although only through FY1976), disallowing the use of trust fund revenues for FAA operations  Airport and Airway Development Amendments Act of 1976 ( P L  94-353 ) The 1976 act made a number of adjustments to the ADAP and reauthorized the Airport and Airway Trust Fund through FY1980  The act again allowed the use of trust fund resources for the costs of air navigation services (a part of operations and maintenance)  However, in an attempt to assure adequate funding of airport grants, the act included "cap and penalty" provisions which placed an annual cap on spending for costs of air navigation systems and a penalty that reduced these caps if airport grants were not funded each year at the airport program's authorized levels  This cap was altered multiple times in reauthorization acts in the following decades  ADAP grants totaled about $4 1 billion from 1971 through 1980  Congress did not pass authorizing legislation for ADAP during FY1981 and FY1982, during which the aviation trust fund lapsed, although spending for airport grants continued  Airport and Airway Improvement Act of 1982 ( P L  97-248 ) The 1982 act created the current AIP and reactivated the Airport and Airway Trust Fund  It altered the funding distribution among the newly defined categories of airports, extending aid eligibility to privately owned general aviation airports, increasing the federal share of eligible project costs, and earmarking 8% of total funding for noise abatement and compatibility planning  The act also required the Secretary of Transportation to publish a national plan for the development of public-use airports in the United States  This biannual publication, the National Plan of Integrated Airport Systems (NPIAS) , identifies airports that are considered important to the national aviation system  For an airport to receive AIP funds it must be listed in the NPIAS  Although the 1982 act was amended often in the 1980s and early 1990s, the general structure of AIP remained the same  The Airport and Airway Safety and Capacity Expansion Act of 1987 ( P L  100-223 ; 1987 act) authorized significant spending increases for AIP and added a cargo service apportionment  It also included provisions to encourage full funding of AIP at the authorized level  Title IX of P L  101-508 , the Omnibus Budget Reconciliation Act of 1990 (OBRA1990), included the Aviation and Airway Safety and Capacity Act of 1990, which allowed airports, under certain conditions, to levy a Passenger Facility Charge (PFC) to raise revenue and also established the Military Airport Program (MAP), which provided AIP funding for capacity and/or conversion-related projects at joint-use or former military airports  The Airport Noise and Capacity Act of 1990 (OBRA 1990, Title IX, Subtitle D) set a national aviation noise policy  OBRA1990 included the Revenue Reconciliation Act of 1990, which reauthorized the Aviation Trust Fund and adjusted some of the aviation taxes  The Federal Aviation Reauthorization Act of 1994 ( P L  103-305 ) reauthorized AIP for two more years and again made modifications in the cap and penalty provisions  Federal Aviation Reauthorization Act of 1996 ( P L  104-264 ) The 1996 reauthorization of the AIP made a number of adjustments to entitlement funding and discretionary set-aside provisions  It also included directives concerning intermodal planning, cost reimbursement rules, letters of intent, and the small airport fund  A demonstration airport privatization program and a demonstration program for innovative financing techniques were established  The demonstration status of the state block grant program was removed  The act did not reauthorize the taxes that supported the Airport and Airway Trust Fund  This was done by the Taxpayer Relief Act of 1997 ( P L  105-34 ), which extended, subject to a number of modifications, the existing aviation trust fund taxes through September 30, 2007  The Wendell H  Ford Aviation Investment and Reform Act for the 21 st Century of 2000 (AIR21; P L  106-181 ) The enactment of AIR21 was the culmination of two years of legislative effort to pass a multiyear FAA reauthorization bill  The initial debate focused on provisions to take the aviation trust fund off-budget or erect budgetary "firewalls" to assure that all trust fund revenues and interest would be spent each year for aviation purposes  These proposals, however, never emerged from the conference committee  Instead, the enacted legislation included a so-called "guarantee" that all of each year's receipts and interest credited to the trust fund would be made available annually for aviation purposes  AIR21 did not make major changes in the structure or functioning of AIP  It did, however, greatly increase the amount available for airport development projects  The AIP funding authorization rose from $1 9 billion in FY2000 to $3 4 billion in FY2003  The formula funding and minimums for primary airports were doubled starting in FY2001  The state apportionment for general aviation airports was increased from 18 5% to 20%  The noise set-aside was increased from 31% to 34% of discretionary funding and a reliever airport discretionary set-aside of 0 66% was established  AIR21 also increased the PFC maximum to $4 50 per boarding passenger  In return for imposing a PFC above the $3 level, large and medium hub airports would forgo 75% of their AIP formula funds  This had the effect of making a greater share of AIP funding available to smaller airports  Vision 100: Century of Aviation Reauthorization Act of 2003 ( P L  108-176 ; H Rept  108-334 ) Vision 100, signed by President George W  Bush on December 12, 2003, included significant changes to AIP  The law codified the AIR21 spending "guarantees" through FY2007  It increased the discretionary set-aside for noise compatibility projects from 34% to 35%  It increased the amount that an airport participating in the Military Airport Program (MAP) could receive to $10 million for FY2004 and FY2005, but in FY2006 and FY2007 it returned the maximum funding level to $7 million  The act allowed nonprimary airports to use their entitlements for revenue-generating aeronautical support facilities, including fuel farms and hangars, if the Secretary of Transportation determines that the sponsor has made adequate provisions for the airside needs of the airport  The law permitted AIP grants at small airports to be used to pay interest on bonds issued to finance airport projects  The act included a trial program to test procedures for authorizing small airports to impose PFCs  Vision 100 repealed the authority to use AIP or PFC funds for most airport security purposes  FAA Modernization and Reform Act of 2012 ( P L  112-95 ) The 2012 FAA reauthorization act funded AIP for four years from FY2012 to FY2015 at an annual level of $3 35 billion  A new provision, Section 138, permitted small airports reclassified as medium hubs due to increased passenger volumes to retain eligibility for up to a 90% federal share for a two-year transition period  This provision also allows certain economically distressed communities receiving subsidized air service to be eligible for up to a 95% federal share of project costs  The 2012 act maintained the $4 50 PFC cap, with a maximum charge of $18 per round-trip flight  It included a provision that instructed GAO to study alternative means for collecting PFCs  The act also expanded the number of airports that could participate in the airport privatization pilot program from 5 to 10  This law was extended through July 15, 2016  The FAA Extension, Safety, and Security Act of 2016 ( P L  114-190 ) The 2016 FAA extension act funded AIP through FY2017 at an annual level of $3 35 billion  A new provision, Section 2303, provided temporary relief to small airports that had 10,000 or more passenger boardings in 2012 but had fewer than 10,000 during the calendar year used to calculate the AIP apportionment for FY2017  This provision allowed such airports to receive apportionment for FY2017 an amount based on the number of passenger boardings at the airport during calendar year 2012  The FAA Reauthorization Act of 2018 ( P L  115-254 ) The 2018 FAA reauthorization act funded AIP for five years from FY2019 through FY2023 at an annual level of $3 35 billion  It also authorized supplemental annual funding from the general fund to the AIP discretionary funds—$1 02 billion in FY2019, $1 04 billion in FY2020, $1 06 billion in FY2021, $1 09 billion in FY2022, and $1 11 billion in FY2023—and required at least 50% of the additional discretionary funds to be available to nonhub and small hub airports  The act included a provision permitting eligible projects at small airports (including those in the State Block Grant Program) to receive 95% federal share of project costs (otherwise capped at 90%), if such projects are determined to be successive phases of a multiphase construction project that received a grant in FY2011  The 2018 reauthorization expanded the number of states that could participate in the State Block Grant Program from 10 to 20 and also expanded the existing airport privatization pilot program (now renamed the Airport Investment Partnership Program) to include more than 10 airports  The law included a provision that forbids states or local governments from levying or collecting taxes on a business on an airport that "is not generally imposed on sales or services by that State, political subdivision, or authority unless wholly utilized for airport or aeronautical purposes " Appendix B  Definitions of Airports Included in the NPIAS Commercial Service Airports Publicly owned airports that receive scheduled passenger service and board at least 2,500 passengers each year (506 airports)  Primary Airports   Airports that board more than 10,000 passengers each year  There are four subcategories: Large Hub Airports   Board 1% or more of system -wide boardings ( 30 airports, 72 % of all enplanements)Medium Hub Airports   Board 0 25% but less than 1% (31 airports, 16% of all enplanements) Small Hub Airports   Board 0 05% but less than 0 25% (72 airports, 8% of all enplanements) Non hub Primary Airports   Board more than 10,000 but less than 0 05% (247 airports, 3% of all enplanements) Non primary Commercial Service Airports   Board at least 2,500 but no more than 10,000 passengers each year (126 airports, 0 1% of all enplanements)  Other Airports General Aviation Airports   General aviation airports do not receive scheduled commercial or military service but typically do support business, personal, and instructional flying; agricultural spraying; air ambulances; on-demand air-taxies; and/or charter aircraft service (2,554 airports)  Reliever Airports   Airports designated by FAA to relieve congestion at commercial airports and provide improved general aviation access (261 airports)  Cargo Service Airports   Airports served by aircraft that transport cargo only and have a total annual landed weight of over 100 million pounds  An airport may be both a commercial service and a cargo service airport  New Airports Seven airports are anticipated to be built between 2019 and 2023  They include two primary airports, two nonprimary commercial service airports, and three general aviation airports 


Report 2:  Program offices responsible for 7 of the 8 selected mission-essential systems did not conduct such a review  According to OCIO officials, the offices were not aware of the need for a review  However, without reviewing physical access logs, CDC has reduced assurance that the agency would detect suspicious physical access activities  Further, CDC had not routinely monitored the configuration settings of its systems to ensure that the configurations were securely set  For example, for at least 41 of 94 technical control deficiencies we identified, OCIO officials cited quality control gaps where the change management process or system administrators had not discovered deficiencies resulting from insecure configuration settings  Without an effective monitoring process in place for system configurations, the agency was not aware of insecure system configurations  FISMA requires each agency to periodically test and evaluate the effectiveness of its information security policies, procedures, and practices  The law also requires agencies to test the management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems at a frequency depending on risk, but no less than annually  In addition, NIST SP 800- 53A identifies three assessment methods—interview, examine, and test— and describes the potential depth and coverage for each  Assessing a control’s effectiveness based on an interview is likely less rigorous than examining a control; similarly, examining a control is likely less rigorous than testing the control’s functionality  CDC had not sufficiently tested or assessed the effectiveness of the security controls for the 8 mission-essential systems that we reviewed  Although CDC annually assessed security controls of selected systems, the agency had only examined control descriptions in security plans to ensure accuracy  At least once every 3 years, the agency selected controls for a more in-depth assessment of the 8 mission-essential systems we reviewed  However, CDC had assessed only 191 (about 7 percent) of 2,818 controls described in the security plans for the selected systems  In addition, the agency used methods for assessing controls that were often not rigorous enough to identify the control deficiencies that we identified  For example, as depicted in figure 1, CDC relied exclusively on interviews—a less rigorous method—to assess 20 percent of the 191 controls it assessed for the selected systems  The security control tests and assessments were insufficient in part because CDC had not developed comprehensive security assessment plans or had not consistently implemented the plans for the 8 selected mission-essential systems we reviewed  For example, one system’s assessment plan indicated that five controls should be assessed using a testing methodology; instead, however, the assessor conducted interviews to determine whether controls were effective or not  OCIO officials stated that the security control test and assessment process is manual and staffing is limited  They stated that the agency intends to rely increasingly on automated tools—such as the tools implemented by the Continuous Diagnostics and Mitigation program—for performing the assessments  Nevertheless, by not assessing controls in an in-depth and comprehensive manner, CDC has limited assurance that the security controls are in place and operating as intended  Further, without developing and implementing comprehensive assessment plans, assessments may not be performed with sufficient rigor to identify control deficiencies  The respond core security function is intended to support the ability to contain the impact of a potential cybersecurity event  Controls associated with this function include implementing an incident response capability and remediating newly-identified deficiencies  Although CDC had implemented controls for incident response to detect cybersecurity events, we reported in June 2018 that the agency had not maintained adequate information to support its incident response capability or taken timely corrective actions to remediate identified control deficiencies  NIST SP 800-53 and SP 800-61 state that agencies should develop and document an incident response policy with corresponding implementation procedures and an incident response plan, and keep them updated according to agency requirements  NIST also states that agencies should implement an incident handling capability, including an incident response team that consists of forensic/malicious code analysts  In addition, agencies are to provide incident response training for the team and test the incident response capability to determine the effectiveness of the response  Further, NIST states that agencies are to monitor incidents by tracking and documenting them and maintain records about each incident, including forensic analysis  Finally, National Archives and Records Administration guidance states that records and data relevant to security incident investigations should be retained for 3 years  CDC had implemented an incident response capability  The agency had developed policy, procedures, and a plan that addressed incident response, and updated them annually  CDC had an incident response team that managed all of the incident handling and response efforts for the agency, and conducted forensic analyses for reported security incidents  Team members had undergone training, such as an advanced network forensic and analysis course offered by a private firm  In addition, the agency had periodically tested its incident handling capability by conducting penetration testing exercises  These exercises allowed the team to test its real-time response capabilities  CDC’s incident response procedures state that incident tickets should include a description of actions taken, response time, and whether actions have been completed or not  The agency’s procedures also require that computers affected by an incident be removed from the network immediately  Nevertheless, CDC had shortcomings in implementing its incident response capability and monitoring procedures  For the 11 security incidents CDC considered most significant over a 19-month period ending in March 2017, the agency had not consistently described the actions taken, the response times, or whether remedial actions had been completed  The agency also had not maintained audit log records for its security incidents  For example, the agency described recommended actions for 10 of the 11 incidents, but did not describe the actions that had been taken  In addition, although incident response team officials told us that all incident ticket records had been saved, CDC had not retained system log data that supported incident resolution for at least five of the incidents  The agency’s policy did not address record retention in accordance with National Archives and Records Administration guidance  Further, for two of the security incidents, the security incident tickets did not clearly indicate when two compromised workstations had been removed from the network  According to OCIO officials, shortcomings in fully documenting incidents resulted from the organization being understaffed, primarily due to budget limitations and the inability to hire qualified personnel  Without effectively tracking and documenting information system security incidents, CDC’s systems are at increased risk that the impact of security incidents would not be fully addressed  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in information security policies, procedures, or practices  NIST SP 800-53 states that agencies are to develop a plan of action and milestones (POA&M) for an information system to document the agency’s planned remedial actions to correct identified deficiencies  CDC policy was consistent with the NIST guidelines  CDC had developed POA&Ms for deficiencies identified by its security control assessments, but had not remediated the deficiencies in a timely manner  For each of the 8 selected mission-essential systems, the agency had created plans for correcting control deficiencies  However, the agency did not implement several remedial actions by their due date  For example, expected completion dates had passed for correcting deficiencies associated with 4 of the 8 selected mission-essential systems  For these 4 systems, the completion dates were 1 to 8 months beyond the due dates at the time of our review in September 2017  According to Office of the Chief Information Security Officer officials, program offices that own the systems did not always communicate updates on the status of remedial actions for their respective systems, noting that deficiencies may have been corrected  Without effective communication to update its POA&Ms, CDC was not in a position to effectively manage its remedial actions and correct known deficiencies in a timely manner  The recover core security function is intended to support timely recovery of normal operations to reduce the impact from a cybersecurity event  Controls associated with this function include developing and testing contingency plans to ensure that, when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected  Losing the capability to process, retrieve, and protect electronically maintained information can significantly affect an agency’s ability to accomplish its mission  If contingency planning is inadequate, even relatively minor interruptions can result in lost or incorrectly processed data, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete information  NIST SP 800-53 states that agency systems should have a contingency plan that includes the identification of key personnel and the systems’ essential mission functions and addresses full information system restoration  For high-impact systems, NIST specifies that agencies test contingency plans at an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats  In addition, NIST states that organizations should initiate corrective actions based on testing if they are needed  As we reported in June 2018, CDC had developed and fully tested contingency plans for each of the 8 selected mission-essential systems that we reviewed  Each plan identified key personnel and their contact information, essential mission functions of the systems, and instructions on how to fully restore the systems in the event of a disruption  Additionally, between January 2015 and May 2017, CDC had tested whether the 8 systems could be recovered at their respective alternate sites, and had initiated corrective actions based on the results of the tests  However, the alternate site for 6 of the 8 selected mission-essential systems was located in relatively close proximity to the main processing site  Although 2 systems had alternate sites located in another state, the alternate site for the other 6 systems was within the same metropolitan area  As a result, an event such as a natural disaster or substantial power outage could affect both the main and alternate sites for these systems, potentially rendering CDC unable to complete functions associated with its mission  Prompt restoration of service is necessary because the required recovery time for these systems ranged from 4 to 24 hours  Security plans for 3 of the systems recognized the hazards of having the sites within the same geographical region, but stated that CDC had accepted this risk  According to OCIO officials, having a site further away was cost prohibitive; however, the officials had not documented this analysis or the associated risk of having the agency’s processing sites located within the same geographical area  Without documenting the analysis and associated risk, CDC had less assurance that senior leadership was aware of the risk of agency systems being unavailable  As a consequence, senior leadership may not agree whether acceptance of the risk was warranted  An underlying reason for the information security deficiencies in selected systems was that, although the agency had developed and documented an agency-wide information security program, it had not consistently or effectively implemented elements of the program  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for information systems  As discussed previously in this report, CDC had implemented aspects of each of these elements  For example, the agency had conducted risk assessments, developed security plans, assessed security controls, developed remedial action plans, and developed and tested contingency plans for each of the 8 selected mission-essential systems  In addition, the agency had documented numerous policies and procedures and ensured that staff had completed annual security awareness training  However, CDC’s program had shortcomings  For example, as discussed earlier in this report, CDC had not consistently or effectively: addressed threats, technical constraints, and the changing threat environment in its system risk assessments, or assessed the risk of having alternate processing sites within close proximity to each other; documented detailed technical requirements in policies and procedures, or facility controls in facility security plans; tracked and trained staff with significant security responsibilities; monitored configuration settings and comprehensively assessed remediated deficiencies in a timely manner; or documented its cost analysis and associated risk of having an alternate processing site within the same geographical region as its primary processing site  Until CDC addresses these shortcomings and consistently and effectively implements all elements of its information security program, the agency will lack reasonable assurance that its computing resources are protected from inadvertent or deliberate misuse  In our June 2018 report, we made 195 recommendations to CDC to strengthen its technical security controls and bolster its agency-wide information security program  Specifically, we recommended that the agency take 184 actions to resolve technical control deficiencies by implementing stronger access controls, encrypting sensitive data, configuring devices securely, applying patches in a timely manner, strengthening firewall rules, and implementing logging and monitoring controls more effectively, among other actions  We also made 11 recommendations for CDC to improve its information security program by, among other things, assessing risks as needed, documenting more detailed technical requirements, monitoring and assessing controls more comprehensively, and remediating deficiencies in a timely manner  Since the issuance of our June 2018 report, CDC has made significant progress in implementing the recommendations we made to resolve the technical security control deficiencies in the information systems we reviewed and to improve its information security program  In this regard, the agency has implemented many of the recommendations for improving technical security controls for the systems we reviewed and has developed plans to implement recommendations for enhancing its information security program  Specifically, as of August 3, 2018, CDC had fully implemented 102 (55 percent) of the 184 recommendations we made to fortify the technical security controls over the systems we reviewed  In addition, the agency had partially implemented 20 (11 percent) of the 184 recommendations  In these instances, CDC had made progress toward implementing the recommendations, but had not completed all of the necessary corrective actions for us to close the recommendations  Therefore, these recommendations remain open  Further, CDC did not provide any evidence that it had implemented the remaining 62 technical control- related recommendations  Table 3 summarizes the status of CDC’s efforts to implement the 184 recommendations that we made to resolve the technical control deficiencies, as of August 3, 2018  By implementing 102 recommendations, CDC (as of August 3, 2018) reduced some of the risks associated with certain key activities  Specifically, these efforts included protecting network boundaries and logging and monitoring security events for indications of inappropriate or unusual activity on systems—that we highlighted in our June 2018 report as being particularly vulnerable and requiring the agency’s greater priority and attention  In addition, the agency had implemented several of our recommendations to rectify a number of the security control deficiencies  These efforts included strengthening firewall rules, implementing stronger access controls, configuring devices securely, and expanding its audit monitoring capabilities  In addition, CDC had developed a plan of action and milestones (POA&M) for each of the identified technical control deficiencies and related recommendations that remained open as of August 3, 2018  The POA&Ms assigned organization responsibilities, identified estimated costs, identified points of contact, and established time frames for resolving the deficiencies and closing the related recommendations  The agency’s plans called for it to implement the majority of the remaining open technical control-related recommendations by September 2019, and all recommendations by September 2020, as shown in figure 2  Our June 2018 report also included 11 recommendations to CDC to improve its information security program  In particular, we recommended that the agency, among other things, evaluate system impact level categorizations to ensure they reflect the current operating environment; update risk assessments to identify threats and the likelihood of impact of the threat on the environment; and update the facility risk assessments  In addition, we recommended that the agency take the necessary steps to make sure staff with significant security roles and responsibilities are appropriately identified and receive role-based training; monitor the configuration settings of agency systems to ensure the settings are set as intended; update security control assessments to include an assessment of controls using an appropriate level of rigor; and remediate POA&Ms in a timely manner  Further, we recommended that the agency document the cost-benefit analysis with associated risk of having an alternate site within the same geographical region as the main site  As of August 3, 2018, the agency had partially implemented 1 of the 11 information security program-related recommendations, but had not provided any evidence that it had implemented the remaining 10 recommendations  Regarding the partially implemented recommendation, CDC had provided role-based training to all personnel performing significant security responsibilities  However, the agency still needed to establish and automate the identification process and the tracking of training records for individuals needing specialized security role-based training  CDC had developed plans to fully implement this recommendation and each of the remaining 10 information security program-related recommendations by July 2019  Fully implementing the open recommendations is essential to ensuring that the agency’s systems and sensitive information are not at increased and unnecessary risk of unauthorized use, disclosure, modification, or disruption  We received written comments on a draft of this report from CDC  In its comments, which are reprinted in appendix III, the agency stated that it recognizes the risks associated with operating a large, global information technology enterprise and has implemented processes, procedures, and tools to better ensure the prevention, detection, and correction of potential incidents  CDC also said cybersecurity remains a high priority and that it takes the responsibilities for protecting public health information and data entrusted to it seriously  To strengthen its cybersecurity program, the agency stated that it is restructuring and streamlining the cyber program and IT infrastructure of its Office of the Chief Information Officer  Further, CDC stated that it has leveraged GAO’s limited official use only report, issued in June 2018, to accelerate its implementation, infrastructure, and software deployments to complete phrases one and two of DHS’s Continuous Diagnostics and Mitigation program  The agency also said it concurred with, and highlighted a number of actions that it had planned or begun taking to remediate, the 11 security program recommendations that we made to CDC in our June 2018 report  We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and the department’s Office of the Inspector General, the Director of CDC, and interested congressional parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov, or Dr  Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao gov  GAO staff who made key contributions to this report are listed in appendix IV  Our objective was to assess the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems  In June 2018, we issued a report which detailed the findings from our work in response to this objective  In the report, we made 184 recommendations to CDC to resolve the technical security control deficiencies in the information systems we reviewed and 11 additional recommendations to improve its information security program  We designated that report as “limited official use only” (LOUO) and did not release it to the general public because of the sensitive information it contained  This report publishes the findings discussed in our June 2018 report, but we have removed all references to the sensitive information  Specifically, we deleted the names of the information systems and computer networks that we examined, disassociated identified control deficiencies from named systems, deleted certain details about information security controls and control deficiencies, and omitted an appendix that was contained in the LOUO report  The appendix contained sensitive details about the technical security control deficiencies in the CDC’s information systems and computer networks that we reviewed, and the 184 recommendations we made to mitigate those deficiencies  We also provided a draft of this report to CDC officials to review and comment on the sensitivity of the information contained herein and to affirm that the report can be made available to the public without jeopardizing the security of CDC’s information systems and networks  In addition, this report addresses a second objective that was not included in the June 2018 report  Specifically, this objective was to determine the extent to which CDC had taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement that we identified in the earlier report  As noted in our June 2018 report, we determined the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems  To do this, we initially gained an understanding of the overall network environment, identified interconnectivity and control points, and examined controls for the agency’s networks and facilities  We conducted site visits at two CDC facilities in Atlanta, Georgia  To evaluate CDC’s controls over its information systems, we used our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information  We based our assessment of controls on requirements identified by the Federal Information Security Modernization Act of 2014 (FISMA), which establishes key elements for an effective agency-wide information security program; NIST guidelines and standards; Department of Health and Human Services and CDC policies, procedures, and standards; and standards and guidelines from relevant security organizations, such as the National Security Agency, the Center for Internet Security, and the Interagency Security Committee  We had reviewed a non-generalizable sample of the agency’s information systems, focusing on those systems that (1) collect, process, and maintain private or potentially-sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; and (3) were assigned a Federal Information Processing Standard rating of moderate or high impact  Based on these criteria, we had selected eight mission-essential systems for our review  Of these systems, the agency had categorized 7 as high-impact systems and 1 as a moderate-impact system  For these 8 selected mission- essential systems, we had reviewed information security program-related controls associated with risk assessments, security plans, security control assessments, remedial action plans, and contingency plans  To assess the safeguards CDC implemented for its systems, we had examined technical security controls for 24 CDC systems, including systems the agency designated as high-value assets  These included 10 key systems, 8 of which were high- and moderate-impact mission- essential systems just described, 1 additional high-impact system, 1 additional moderate-impact system, and 14 general support systems  We selected the additional high-impact system because the agency re- categorized it as a high-impact system during our review  We selected the additional moderate-impact system because the agency used it to control physical access to highly sensitive CDC biologic lab facilities, including facilities that handle dangerous and exotic substances that cause incurable and deadly diseases  We selected 10 key systems, 8 of which were mission-essential systems, for review that (1) collect, process, and maintain private or potentially sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; (3) could have a catastrophic or severe impact on operations if compromised; or (4) could be of particular interest to potential adversaries  We also selected 14 general support systems that were part of the agency’s network infrastructure supporting the 10 key systems  To review controls over the 10 key systems and 14 general support systems, we had examined the agency’s network infrastructure and assessed the controls associated with system access, encryption, configuration management, and logging and monitoring  For reporting purposes, we had categorized the security controls that we assessed into the five core security functions described in the National Institute of Standards and Technology’s (NIST) cybersecurity framework  The five core security functions are: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities  Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services  Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event  Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event  Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event  These core security functions are described in more detail in appendix II  For the identify core security function, we had examined CDC’s reporting for its hardware and software assets; analyzed risk assessments for the eight selected mission-essential systems to determine whether threats and vulnerabilities were being identified; reviewed risk assessments for two facilities; analyzed CDC policies, procedures, and practices to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; and analyzed security plans for the eight selected systems to determine if those plans had been documented and updated according to federal guidance  We also evaluated the risk assessments for two facilities that housed the 8 mission-essential selected systems  For the protect core security function, we had examined access controls for the 24 systems  These controls included the complexity and expiration of password settings to determine if password management was being enforced; administrative users’ system access permissions to determine whether their authorizations exceeded the access necessary to perform their assigned duties; firewall configurations, among other things, to determine whether system boundaries had been adequately protected; and physical security controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft  We also had examined configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted  In addition, we had examined configuration settings for routers, network management servers, switches, firewalls, and workstations to determine if settings adhered to configuration standards, and inspected key servers and workstations to determine if critical patches had been installed and/or were up-to-date  Further, we had examined training records to determine if employees and contractors had received security awareness training according to federal requirements, and whether personnel who have significant security responsibilities had received training commensurate with those responsibilities  For the detect core security function, we had analyzed centralized logging and network traffic monitoring capabilities for key assets connected to the network; analyzed CDC’s procedures and results for assessing security controls to determine whether controls for the eight selected mission- essential systems had been sufficiently tested at least annually and based on risk  We also had reviewed the agency’s implementation of continuous monitoring practices to determine whether the agency had developed and implemented a continuous monitoring strategy to manage its information technology assets and monitor the security configurations and vulnerabilities for those assets  For the respond core security function, we had reviewed CDC’s implementation of incident response practices, including an examination of incident tickets for 11 incidents; and had examined the agency’s process for correcting identified deficiencies for the eight selected mission-essential systems  For the recover core security function, we had examined contingency plans for eight selected mission-essential systems to determine whether those plans had been developed and tested  In assessing CDC’s controls associated with this function, as well as the other four core functions, we had interviewed Office of the Chief Information Officer officials, as needed  Within the core security functions, as appropriate, we had evaluated the elements of CDC’s information security program based on elements required by FISMA  For example, we analyzed risk assessments, security plans, security control assessments, and remedial action plans for each of the 8 selected mission-essential systems  In addition, we had assessed whether the agency had ensured staff had completed security awareness training and whether those with significant security responsibilities received commensurate training  We also had evaluated CDC’s security policies and procedures  To determine the reliability of CDC’s computer-processed data for training and incident response records, we had evaluated the materiality of the data to our audit objective and assessed the data by various means, including reviewing related documents, interviewing knowledgeable agency officials, and reviewing internal controls  Through a combination of methods, we concluded that the data were sufficiently reliable for the purposes of our work  To accomplish our second objective—on CDC’s actions to address the previously identified security program and technical control deficiencies and related recommendations—we requested that the agency provide a status report of its actions to implement each of the recommendations  For each recommendation that CDC indicated it had implemented as of August 3, 2018, we examined supporting documents, observed or tested the associated security control or procedure, and/or interviewed the responsible agency officials to assess the effectiveness of the actions taken to implement the recommendation or otherwise resolve the underlying control deficiency  Based on this assessment and CDC status reports, we defined the status of each recommendation into the following 3 categories: closed-implemented—CDC had implemented the recommendation; open-partially implemented—CDC had made progress toward, but had not completed, implementing the recommendation; and open-not implemented—CDC had not provided evidence that it had acted to implement the recommendation  We conducted this performance audit from December 2016 to December 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The National Institute of Standards and Technology’s cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover  Within the five functions are 23 categories and 108 subcategories, as described in the table  In addition to the individuals named above, Gary Austin, Jennifer R  Franks, Jeffrey Knott, and Chris Warweg (assistant directors); Chibuikem Ajulu-Okeke, Angela Bell, Sa’ar Dagani, Nancy Glover, Chaz Hubbard, George Kovachick, Sean Mays, Kevin Metcalf, Brandon Sanders, Michael Stevens, Daniel Swartz, and Angela Watson made key contributions to this report  Edward Alexander, Jr  and Duc Ngo (assistant directors); David Blanding, and Christopher Businsky also provided assistance 

ground_truth: One of the goals of federal criminal restitution is to restore victims of federal crimes to the position they occupied before the crime was committed by providing compensation. Various entities within the federal government are involved in the process of requesting, ordering, and collecting restitution for crime victims, including DOJ and the judiciary. The Justice for All Reauthorization Act of 2016 includes a provision for GAO to review the federal criminal restitution process for fiscal years 2014 through 2016. This report addresses, among other things: (1) the extent to which information is available on restitution requested by DOJ and ordered by courts; (2) the amount of restitution debt DOJ collected and the amount that remains outstanding; and, (3) the extent to which DOJ has conducted oversight on the collection of restitution. GAO analyzed laws, policies and procedures as well as USSC data on restitution orders and DOJ data on restitution collected from fiscal years 2014 through 2016. GAO also selected a non-generalizable sample of six federal judicial districts based on restitution collections and spoke with USAO officials and federal probation officers. Officials from selected U.S. Attorney's Offices (USAO) stated that they document requests for restitution in case files and employ other internal controls, such as the use of templates and forms, throughout the prosecution process to ensure that prosecutors request restitution as appropriate. GAO's analysis of U.S. Sentencing Commission (USSC) data—an agency within the judiciary—showed that information on restitution orders was available for 95 percent of all offenders sentenced from fiscal years 2014 through 2016. Specifically, 214,578 federal offenders were sentenced during this time period and restitution was ordered for 33,158, or 15 percent, of those offenders. Collectively, courts ordered these offenders to pay $33.9 billion in restitution. Most federal offenders sentenced during these years were sentenced for immigration or drug-related offenses. In interviews, USAO officials stated that these offenses do not typically have victims requiring restitution. GAO found that data on reasons why restitution was not ordered were incomplete for 5 percent of all offenders sentenced from fiscal years 2014 through 2016. Determining why data on restitution orders are incomplete may inform the judiciary of the cause of the incomplete data and any efforts needed to improve USSC data. GAO's analysis of Department of Justice (DOJ) data showed that USAOs collected $2.95 billion in restitution debt in fiscal years 2014 through 2016, see figure below. However, at the end of fiscal year 2016, $110 billion in previously ordered restitution remained outstanding, and USAOs identified $100 billion of that outstanding debt as uncollectible due to offenders' inability to pay. DOJ identified improving debt collection—including restitution—as a major management initiative in its 2014-2018 Strategic Plan. While DOJ is developing analytical tools to monitor the collection of restitution, it has not established performance measures or goals. Performance measures and goals would allow DOJ to gauge USAOs' success in collecting restitution and, by extension, the department's success in achieving a major management initiative. GAO is making three recommendations. GAO is making one to the judiciary to determine why data on restitution orders are incomplete. GAO is making two recommendations to DOJ, including one to implement performance measures and goals for the collection of restitution. The judiciary and DOJ concurred with the recommendations.