prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: According to the President’s budget, the federal government plans to invest more than $96 billion for IT in fiscal year 2018—the largest amount ever budgeted  Despite such large IT expenditures, we have previously reported that investments in federal IT too often result in failed projects that incur cost overruns and schedule slippages, while contributing little to the desired mission-related outcomes  For example: The tri-agency National Polar-orbiting Operational Environmental Satellite System was disbanded in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion  The Department of Homeland Security’s (DHS) Secure Border Initiative Network program was ended in January 2011, after the department obligated more than $1 billion for the program  The Department of Veterans Affairs’ Financial and Logistics Integrated Technology Enterprise program was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011  The Department of Defense’s Expeditionary Combat Support System was canceled in December 2012 after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds  The United States Coast Guard (Coast Guard) decided to terminate its Integrated Health Information System project in 2015  As reported by the agency in August 2017, the Coast Guard spent approximately $60 million over 7 years on this project, which resulted in no equipment or software that could be used for future efforts  Our past work has found that these and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance  In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT  Such projects have also failed due to a lack of oversight and governance  Executive-level governance and oversight across the government has often been ineffective, specifically from CIOs  For example, we have reported that some CIOs’ roles were limited because they did not have the authority to review and approve the entire agency IT portfolio  In addition to failures when acquiring IT, security deficiencies can threaten systems once they become operational  As we previously reported, in order to counter security threats, 23 civilian Chief Financial Officers Act agencies spent a combined total of approximately $4 billion on IT security-related activities in fiscal year 2016  Even so, our cybersecurity work at federal agencies continues to highlight information security deficiencies  The following examples describe the types of risks we have found at federal agencies  In November 2017, we reported that the Department of Education’s Office of Federal Student Aid did not consistently analyze privacy risks for its electronic information systems, and policies and procedures for protecting information systems were not always up to date  In August 2017, we reported that, since the 2015 data breaches, the Office of Personnel Management (OPM) had taken actions to prevent, mitigate, and respond to data breaches involving sensitive personal and background investigation information  However, we noted that the agency had not fully implemented recommendations made to OPM by DHS’s United States Computer Emergency Readiness Team to help the agency improve its overall security posture and improve its ability to protect its systems and information from security breaches  In July 2017, we reported that IT security at the Internal Revenue Service had weaknesses that limited its effectiveness in protecting the confidentiality, integrity, and availability of financial and sensitive taxpayer data  An underlying reason for these weaknesses was that the Internal Revenue Service had not effectively implemented elements of its information security program  In May 2016, we reported that the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veteran Affairs did not always control access to selected high-impact systems, patch known software vulnerabilities, and plan for contingencies  An underlying reason for these weaknesses was that the agencies had not fully implemented key elements of their information security programs  In August 2016, we reported that the IT security of the Food and Drug Administration had significant weaknesses that jeopardized the confidentiality, integrity, and availability of its information systems and industry and public health data  Congress and the President have enacted various key pieces of reform legislation to address IT management issues  These include the federal IT acquisition reform legislation commonly referred to as the Federal Information Technology Acquisition Reform Act (FITARA)  This legislation was intended to improve covered agencies’ acquisitions of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings  The law includes specific requirements related to seven areas: Agency CIO authority enhancements  CIOs at covered agencies have the authority to, among other things, (1) approve the IT budget requests of their respective agencies and (2) review and approve IT contracts  Federal data center consolidation initiative (FDCCI)  Agencies covered by FITARA are required, among other things, to provide a strategy for consolidating and optimizing their data centers and issue quarterly updates on the progress made  Enhanced transparency and improved risk management  The Office of Management and Budget (OMB) and covered agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their investments by level of risk  Portfolio review  Covered agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness and identify potential waste and duplication  Expansion of training and use of IT acquisition cadres  Covered agencies are to update their acquisition human capital plans to support timely and effective IT acquisitions  In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres (i e , multi-functional groups of professionals to acquire and manage complex programs), or developing agreements with other agencies that have such cadres  Government-wide software purchasing program  The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software  In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user  Maximizing the benefit of the Federal Strategic Sourcing Initiative  Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing Initiative  In June 2015, OMB released guidance describing how agencies are to implement FITARA  This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls to meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; strengthen the relationship between agency CIOs and bureau CIOs; strengthen CIO accountability for IT costs, schedules, performance, and security  The guidance identifies a number of actions that agencies are to take to establish a basic set of roles and responsibilities (referred to as the common baseline) for CIOs and other senior agency officials; and thus, to implement the authorities described in the law  For example, agencies are to conduct a self-assessment and submit a plan describing the changes they intend to make to ensure that common baseline responsibilities are implemented  In addition, in August 2016, OMB released guidance intended to, among other things, define a framework for achieving the data center consolidation and optimization requirements of FITARA  The guidance directs agencies to develop a data center consolidation and optimization strategic plan that defines the agency’s data center strategy for fiscal years 2016, 2017, and 2018  This strategy is to include, among other things, a statement from the agency CIO indicating whether the agency has complied with all data center reporting requirements in FITARA  Further, the guidance indicates that OMB is to maintain a public dashboard to display consolidation-related costs savings and optimization performance information for the agencies  Congress has recognized the importance of agencies’ continued implementation of FITARA provisions, and has taken legislative action to extend selected provisions beyond their original dates of expiration  Specifically, Congress and the President enacted laws to: remove the expiration date for enhanced transparency and improved risk management provisions, which were set to expire in 2019; remove the expiration date for portfolio review, which was set to expire in 2019; and extend the expiration date for FDCCI from 2018 to 2020  In addition, Congress and the President enacted a law to authorize the availability of funding mechanisms to help further agencies’ efforts to modernize IT  The law, known as the Modernizing Government Technology (MGT) Act, authorizes agencies to establish working capital funds for use in transitioning from legacy IT systems, as well as for addressing evolving threats to information security  The law also creates the Technology Modernization Fund, within the Department of the Treasury, from which agencies can “borrow” money to retire and replace legacy systems, as well as acquire or develop systems  Further, in February 2018, OMB issued guidance for agencies to implement the MGT Act  The guidance was intended to provide agencies additional information regarding the Technology Modernization Fund, and the administration and funding of the related IT working capital funds  Specifically, the guidance allowed agencies to begin submitting initial project proposals for modernization on February 27, 2018  In addition, in accordance with the MGT Act, the guidance provides details regarding a Technology Modernization Board, which is to consist of (1) the Federal CIO; (2) a senior official from the General Services Administration; (3) a member of DHS’s National Protection and Program Directorate; and (4) four federal employees with technical expertise in IT development, financial management, cybersecurity and privacy, and acquisition, appointed by the Director of OMB  Congress and the President enacted the Federal Information Security Modernization Act of 2014 (FISMA) to improve federal cybersecurity and clarify government-wide responsibilities  The act addresses the increasing sophistication of cybersecurity attacks, promotes the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provides for improved oversight of federal agencies’ information security programs  Specifically, the act clarifies and assigns additional responsibilities to entities such as OMB, DHS, and the federal agencies  Table 1 describes a selection of OMB, DHS, and agency responsibilities  Beyond the implementation of FITARA, FISMA, and related actions, the current administration has also initiated other efforts intended to improve federal IT  Specifically, in March 2017, the administration established the Office of American Innovation, which has a mission to, among other things, make recommendations to the President on policies and plans aimed at improving federal government operations and services  In doing so, the office is to consult with both OMB and the Office of Science and Technology Policy on policies and plans intended to improve government operations and services, improve the quality of life for Americans, and spur job creation  In May 2017, the Administration also established the American Technology Council, which has a goal of helping to transform and modernize federal agency IT and how the federal government uses and delivers digital services  The President is the chairman of this council, and the Federal CIO and the United States Digital Service Administrator are among the members  In addition, on May 11, 2017, the President signed Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure  This executive order outlined actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cyber security threats  Among other things, the order tasked the Director of the American Technology Council to coordinate a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration, in consultation with the Secretary of Commerce, regarding the modernization of federal IT  As a result, the Report to the President on Federal IT Modernization was issued on December 13, 2017, and outlined the current and envisioned state of federal IT  The report focused on modernization efforts to improve the security posture of federal IT and recognized that agencies have attempted to modernize systems but have been stymied by a variety of factors, including resource prioritization, ability to procure services quickly, and technical issues  The report provided multiple recommendations intended to address these issues through the modernization and consolidation of networks and the use of shared services to enable future network architectures  Further, in March 2018, the Administration issued the President’s Management Agenda, which lays out a long-term vision for modernizing the federal government  The agenda identifies three related drivers of transformation—IT modernization; data, accountability, and transparency; and the workforce of the future—that are intended to push change across the federal government  The Administration also established 14 related Cross-Agency Priority goals, many of which have elements that involve IT  In particular, the Cross-Agency Priority goal on IT modernization states that modern IT must function as the backbone of how government serves the public in the digital age and provides three priorities that are to guide the Administration’s efforts to modernize federal IT: (1) enhancing mission effectiveness by improving the quality and efficiency of critical services, including the increased utilization of cloud-based solutions; (2) reducing cybersecurity risks to the federal mission by leveraging current commercial capabilities and implementing cutting edge cybersecurity capabilities; and (3) building a modern IT workforce by recruiting, reskilling, and retaining professionals able to help drive modernization with up-to-date technology  Most recently, on May 15, 2018, the President signed Executive Order 13833, Enhancing the Effectiveness of Agency Chief Information Officers  Among other things, this executive order is intended to better position agencies to modernize their IT systems, execute IT programs more efficiently, and reduce cybersecurity risks  The order pertains to 22 of the 24 Chief Financial Officer Act agencies: the Department of Defense and the Nuclear Regulatory Commission are exempt  For the covered agencies, the executive order strengthens the role of agency CIOs by, among other things, requiring to report directly to their agency head; to serve as their agency head’s primary IT strategic advisor; and to have a significant role in all management, governance, and oversight processes related to IT  In addition, one of the cybersecurity requirements directs agencies to ensure that the CIO works closely with an integrated team of senior executives, including those with expertise in IT, security, and privacy, to implement appropriate risk management measures  In the February 2017 update to our high-risk series, we reported that agencies still needed to complete significant work related to the management of IT acquisitions and operations We stressed that OMB and federal agencies should continue to expeditiously implement FITARA and OMB’s related guidance, which include enhancing CIO authority, consolidating data centers, and acquiring and managing software licenses  Our update to this high-risk area also stressed that OMB and agencies needed to continue to implement our prior recommendations in order to improve their ability to effectively and efficiently invest in IT  Specifically, from fiscal years 2010 through 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations  In addition, in fiscal year 2016, we made 202 new recommendations, thus, further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations  As stated in the update, OMB and agencies should demonstrate government-wide progress in the management of IT investments by, among other things, implementing at least 80 percent of our recommendations related to managing IT acquisitions and operations within 4 years  As of May 2018, OMB and agencies had fully implemented 489 (or about 61 percent) of the 803 recommendations  Figure 1 summarizes the progress that OMB and agencies have made in addressing our recommendations as compared to the 80 percent target  Overall, federal agencies would be better positioned to realize billions in cost savings and additional management improvements if they address these recommendations, including those aimed at implementing CIO responsibilities, review of IT acquisitions; improving data center consolidation; and managing software licenses  In all, the various laws, such as FITARA, and related guidance assign 35 IT management responsibilities to CIOs in six key areas  These areas are: leadership and accountability, budgeting, information security, investment management, workforce, and strategic planning  In a draft report on CIO responsibilities that we have provided to the agencies for comment and plan to issue in June 2018, our preliminary results suggest that none of the 24 agencies we reviewed had policies that fully addressed the role of their CIO, as called for by federal laws and guidance  In this regard, a majority of the agencies fully or substantially addressed the role of their CIOs for the area of leadership and accountability  In addition, a majority of the agencies substantially or partially addressed the role of their CIOs for two areas: information security and IT budgeting  However, most agencies partially or minimally addressed the role of their CIOs for two areas: investment management and strategic planning  These preliminary results are shown in figure 2  Despite these shortfalls, most agency officials stated that their CIOs are implementing the responsibilities even if the agencies do not have policies requiring implementation  Nevertheless, the CIOs of the 24 selected agencies acknowledged in responses to a survey that we administered for our draft report that they were not always very effective in implementing the six IT management areas  Specifically, our preliminary results show that at least 10 of the CIOs indicated that they were less than very effective for each of the six areas of responsibility  We believe that until agencies fully address the role of CIOs in their policies, agencies will be limited in addressing longstanding IT management challenges  Figure 3 depicts that extent to which the CIOs reported their effectiveness in implementing the six areas of responsibility  Beyond the actions of the agencies, however, our preliminary results indicate that shortcomings in agencies’ policies also are partially attributable to two weaknesses in OMB’s FITARA implementation guidance  First, the guidance does not comprehensively address all CIO responsibilities, such as those related to assessing the extent to which personnel meet IT management knowledge and skill requirements, and ensuring that personnel are held accountable for complying with the information security program  Correspondingly, the majority of the agencies’ policies did not fully address nearly all of the responsibilities that were not included in OMB’s guidance  Second, OMB’s guidance does not ensure that CIOs have a significant role in (1) IT planning, programming, and budgeting decisions and (2) execution decisions and the management, governance, and oversight processes related to IT, as required by federal law and guidance  In the absence of comprehensive guidance, CIOs will not be positioned to effectively acquire, maintain, and secure their IT systems  Based on our preliminary results, 24 agency CIOs also identified a number of factors that enabled and challenged their ability to effectively manage IT  As shown in figure 4, five factors were identified by at least half of the 24 CIOs as major enablers and three factors were identified by at least half of the CIOs as major challenges  Specifically, most agency CIOs cited five factors as being enablers to effectively carry out their responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition Officer (CAO), and (5) legal authority  Further, three factors were cited by CIOs as major factors that have challenged their ability to effectively carry out responsibilities: (1) processes for hiring, recruiting, and retaining IT personnel; (2) financial resources; and (3) the availability of personnel/staff resources  As our draft report states, although OMB has issued guidance aimed at addressing the three factors that were identified by at least half of the CIOs as major challenges, the guidance does not fully address those challenges  Further, regarding the financial resources challenge, OMB recently required agencies to provide data on CIO authority over IT spending; however, its guidance does not provide a complete definition of the authority  We believe that in the absence of such guidance, agencies have created varying definitions of CIO authority  Further, until OMB updates its guidance to include a complete definition of the authority that CIOs are to have over IT spending, it will be difficult for OMB to identify any deficiencies in this area and to help agencies make any needed improvements  In order to address challenges in implementing CIO responsibilities, we intend to include in our draft report recommendations to OMB and each of the selected 24 federal agencies to improve the effectiveness of CIOs’ implementation of their responsibilities for each of the six IT management areas  FITARA includes a provision to enhance covered agency CIOs’ authority through, among other things, requiring agency heads to ensure that CIOs review and approve IT contracts  OMB’s FITARA implementation guidance expanded upon this aspect of the legislation in a number of ways  Specifically, according to the guidance: CIOs may review and approve IT acquisition strategies and plans, rather than individual IT contracts; CIOs can designate other agency officials to act as their representatives, but the CIOs must retain accountability; CAOs are responsible for ensuring that all IT contract actions are consistent with CIO-approved acquisition strategies and plans; and CAOs are to indicate to the CIOs when planned acquisition strategies and acquisition plans include IT  In January 2018, we reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions  For instance, most of the 22 agencies did not identify all of their IT contracts  In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14 7 billion in fiscal year 2016  However, we identified 31,493 additional contracts with $4 5 billion obligated, raising the total amount obligated by these agencies to IT contracts in fiscal year 2016 to at least $19 2 billion  Figure 5 reflects the obligations that the 22 selected agencies reported to us relative to the obligations we identified  The percentage of additional IT contract obligations we identified varied among the selected agencies  For example, the Department of State did not identify 1 percent of its IT contract obligations  Conversely, 8 agencies did not identify over 40 percent of their IT contract obligations  Many of the selected agencies that did not identify these IT contract obligations did not follow OMB guidance  Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for CIO review, as required by OMB  In addition, 7 agencies did not establish guidance to aid officials in recognizing IT  We concluded that until these agencies involve the acquisitions office in their IT acquisition identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions  Without proper identification of IT acquisitions, these agencies and CIOs cannot effectively provide oversight of these acquisitions  In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB’s requirement that the CIO review and approve IT acquisition plans or strategies  Further, only 11 of 96 randomly selected IT contracts at 10 agencies that we evaluated were CIO-reviewed and approved as required by OMB’s guidance  The 85 IT contracts not reviewed had a total possible value of approximately $23 8 billion  We believe that until agencies ensure that CIOs are able to review and approve all IT acquisitions, CIOs will continue to have limited visibility and input into their agencies’ planned IT expenditures and will not be able to use the increased authority that FITARA’s contract approval provision is intended to provide  Further, agencies will likely miss an opportunity to strengthen CIOs’ authority and the oversight of IT acquisitions  As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived  As a result of these findings, we made 39 recommendations in our January 2018 report  The recommendations included that agencies ensure that their acquisition offices are involved in identifying IT acquisitions and issuing related guidance, and that IT acquisitions are reviewed in accordance with OMB guidance  OMB and the majority of the agencies generally agreed with or did not comment on the recommendations  In our February 2017 high-risk update, we stated that OMB and agencies needed to demonstrate additional progress on achieving data center consolidation savings in order to improve the management of IT acquisitions and operations  Further, data center consolidation efforts are key to implementing FITARA  Specifically, OMB established the FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities  The enactment of FITARA in 2014 codified and expanded the initiative  In a series of reports that we issued from July 2011 through August 2017, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings  In these reports, we made a total of 160 recommendations to OMB and 24 agencies to improve the execution and oversight of the initiative  Most agencies and OMB agreed with our recommendations or had no comments  As of May 2018, 80 of these 160 recommendations remained unimplemented  Further, we recently reported in May 2018 that the 24 agencies participating in OMB’s Data Center Optimization Initiative (DCOI) had communicated mixed progress toward achieving OMB’s goals for closing data centers by September 2018  Over half of the agencies reported that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline  This would result in the closure of 7,221 of the 12,062 centers that agencies reported in August 2017  However, 4 agencies reported that they do not have plans to meet all of their assigned goals and 2 agencies are working with OMB to establish revised targets  With regard to agencies’ progress in achieving cost savings, 24 agencies reported $3 9 billion in cost savings through 2018  The 24 agencies also reported limited progress against OMB’s five data center optimization targets for server utilization and automated monitoring, energy metering, power usage effectiveness, facility utilization, and virtualization  As of August 2017, 1 agency reported that it had met four targets, 1 agency reported that it had met three targets, 6 agencies reported having met either one or two targets, and 14 agencies reported meeting none of the targets  Further, as of August 2017, most agencies were not planning to meet OMB’s fiscal year 2018 optimization targets  Specifically, 4 agencies reported plans to meet all of their applicable targets by the end of fiscal year 2018; 14 agencies reported plans to meet some of the targets; and 4 reported that they did not plan to meet any targets  Figure 6 summarizes agency-reported plans to meet or exceed the OMB’s data center optimization targets, as of August 2017  In 2016 and 2017, we made 81 recommendations to OMB and the 24 DCOI agencies to help improve the reporting of data center-related cost savings and to achieve optimization targets  As of May 2018, 71 of these 81 recommendations have not been fully addressed  In our 2015 high-risk report’s discussion of IT acquisitions and operations, we identified the management of software licenses as an area of concern, in part because of the potential for cost savings  Federal agencies engage in thousands of software licensing agreements annually  The objective of software license management is to manage, control, and protect an organization’s software assets  Effective management of these licenses can help avoid purchasing too many licenses, which can result in unused software, as well as too few licenses, which can result in noncompliance with license terms and cause the imposition of additional fees  As part of its PortfolioStat initiative, OMB has developed policy that addresses software licenses  This policy requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending  Such areas of spending could include software licenses  In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide  Of the 24 selected agencies we reviewed, only 2 had comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things  Of the remaining 22 agencies, 18 had policies that were not comprehensive, and 4 had not developed any policies  Further, we found that only 2 of the 24 selected agencies had established comprehensive software license inventories, a leading practice that would help them to adequately manage their software licenses  The inadequate implementation of this and other leading practices in software license management was partially due to weaknesses in agencies’ policies  As a result, we concluded that agencies’ oversight of software license spending was limited or lacking, thus potentially leading to missed savings  However, the potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even when its oversight process was ad hoc  Accordingly, we recommended that OMB issue a directive to help guide agencies in managing software licenses  We also made 135 recommendations to the 24 agencies to improve their policies and practices for managing licenses  Among other things, we recommended that the agencies regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making  Most agencies generally agreed with the recommendations or had no comments  As of May 2018, 78 of the 135 recommendations had not been implemented  Table 2 reflects the extent to which the 24 agencies implemented the recommendations in these two areas  Since information security was added to the high-risk list in 1997, we have consistently identified shortcomings in the federal government’s approach to cybersecurity  We have previously testified that, even though agencies have acted to improve the protections over federal and critical infrastructure information and information systems, the federal government needs to take the following actions to strengthen U S  cybersecurity: Effectively implement risk-based entity-wide information security programs consistently over time  Among other things, agencies need to (1) implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices; (2) patch vulnerable systems and replace unsupported software; (3) develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis; and (4) strengthen oversight of contractors providing IT services  Improve its cyber incident detection, response, and mitigation capabilities  DHS needs to expand the capabilities and support wider adoption of its government-wide intrusion detection and prevention system  In addition, the federal government needs to improve cyber incident response practices, update guidance on reporting data breaches, and develop consistent responses to breaches of personally identifiable information  Expand its cyber workforce planning and training efforts  The federal government needs to (1) enhance efforts for recruiting and retaining a qualified cybersecurity workforce and (2) improve cybersecurity workforce planning activities  Expand efforts to strengthen cybersecurity of the nation’s critical infrastructures  The federal government needs to develop metrics to (1) assess the effectiveness of efforts promoting the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity and (2) measure and report on the effectiveness of cyber risk mitigation activities and the cybersecurity posture of critical infrastructure sectors  Better oversee protection of personally identifiable information  The federal government needs to (1) protect the security and privacy of electronic health information, (2) ensure privacy when face recognition systems are used, and (3) protect the privacy of users’ data on state-based health insurance marketplaces  As we have previously noted, in order to take the preceding actions and strengthen the federal government’s cybersecurity posture, agencies should implement the information security programs required by FISMA  In this regard, FISMA provides a framework for ensuring the effectiveness of information security controls for federal information resources  The law requires each agency to develop, document, and implement an agency- wide information security program  Such a program includes risk assessments; the development and implementation of policies and procedures to cost-effectively reduce risks; plans for providing adequate information security for networks, facilities, and systems; security awareness and specialized training; the testing and evaluation of the effectiveness of controls; the planning, implementation, evaluation, and documentation of remedial actions to address information security deficiencies; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations  Since 2010, we have made 2,733 recommendations to agencies aimed at improving the security of federal systems and information  These recommendations have identified actions for agencies to take to strengthen technical security controls over their computer networks and systems  They also have included recommendations for agencies to fully implement aspects of their information security programs, as mandated by FISMA  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  As of May 2018, 793 of information security-related recommendations we have made have not been implemented  In order to determine the effectiveness of the agencies’ information security programs and practices, FISMA requires that federal agencies’ inspectors general conduct annual independent evaluations  The agencies are to report the results of these evaluations to OMB, and OMB is to summarize the results in annual reports to Congress  In these evaluations, the inspectors general frame the scope of their analysis, identify key findings, and detail recommendations to address the findings  The evaluations also are to capture maturity model ratings for their respective agencies  Toward this end, in fiscal year 2017, the inspector general community, in partnership with OMB and DHS, finalized a 3-year effort to create a maturity model for FISMA metrics that align to the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover  This alignment is intended to help promote consistent and comparable metrics and criteria and provides agencies with a meaningful independent assessment of their information security programs  This maturity model is designed to summarize the status of agencies’ information security programs on a five-level capability maturity scale  The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner  Level 2 Defined: Policies, procedures, and strategy are formalized and documented but not consistently implemented  Level 3 Consistently Implemented: Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking  Level 4 Managed and Measurable: Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes  Level 5 Optimized: Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs  In March 2018, OMB issued its annual FISMA report to Congress, which showed the combined results of the inspectors general’s fiscal year 2017 evaluations  Based on data from 76 agency inspector general and independent auditor assessments, OMB determined that the government-wide median maturity model ratings across the five NIST Cybersecurity Framework areas did not exceed a level 3 (consistently implemented)  Table 3 shows the inspectors general’s median ratings for each of the NIST Cybersecurity Framework areas  In its efforts toward strengthening the federal government’s cybersecurity, OMB also requires agencies to submit related cybersecurity metrics as part of its Cross-Agency Priority goals  In particular, OMB developed the IT modernization goal so that federal agencies will be able to build and maintain more modern, secure, and resilient IT  A key part of this goal is to reduce cybersecurity risks to the federal mission through three strategies: manage asset security, protect networks and data, and limit personnel access  The key targets supporting each of these strategies correspond to areas within the FISMA metrics  Table 4 outlines the strategies and their associated targets  In conclusion, FITARA and FISMA present opportunities for the federal government to address the high-risk areas on improving the management of IT acquisitions and operations, and ensuring the security of federal IT, thereby saving billions of dollars  Most agencies have taken steps to execute key IT management and cybersecurity initiatives, including implementing CIO responsibilities, requiring CIO review of IT acquisitions, realizing data center consolidation cost savings, managing software assets, and complying with FISMA requirements  The agencies have also continued to address the recommendations that we have made over the past several years  However, further efforts by OMB and federal agencies to implement our previous recommendations would better position them to improve the management and security of federal IT  To help ensure that these efforts succeed, we will continue to monitor agencies’ efforts toward implementing these recommendations  Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement  I would be pleased to respond to any questions that you may have at this time  If you or your staff have any questions about this testimony, please contact David A  Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  GAO staff who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Meredith Raymond, and Jessica Waselkow (Analyst in Charge)  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 


Report 2: U S  agencies perform a wide variety of activities that contribute to export promotion, and responsibility for these activities is widely dispersed  Some of the services these agencies provide are intended, at least in part, to assist U S  companies in entering foreign markets or expanding their presence abroad  For example, the U S  government distributes trade-related information to exporters, conducts foreign country market research, and provides counseling to U S  companies throughout the export process  U S  agencies may also use diplomatic tools to advocate on behalf of U S  companies to help ensure they can compete on a level playing field in export markets  Three of these agencies—State, Commerce, and USDA—receive appropriations that are restricted from being used to promote the sale or export of U S  tobacco or tobacco products  These agencies promote the growth of other U S  exports through various activities, as discussed in table 1  Congress has restricted the use of funds that are generally appropriated for State, Commerce, and USDA from being used to promote the sale or export of U S  tobacco and tobacco products since the 1990s  In 1990, we reported that U S  policy and programs for assisting the export of tobacco and tobacco products worked at cross purposes to U S  health policy and initiatives, both domestically and internationally  Congress later restricted the use of funds that are generally appropriated to State, Commerce, and USDA from being used to promote the sale or export of U S  tobacco and tobacco products  During fiscal years 1994 through 2003, Congress prohibited funds generally appropriated for USDA through annual appropriations acts from being used to promote the sale or export of tobacco or tobacco products  In fiscal year 2004, Congress permanently prohibited funds appropriated for USDA from being used to promote the sale or export of tobacco or tobacco products  According to USDA officials, USDA stopped its efforts to gather and disseminate tobacco-related production and consumption information overseas in the early 2000s  Congress restricted the use of certain appropriated funds, including appropriations for Commerce and State, from being used to promote the sale or export of U S  tobacco and tobacco products from fiscal years 1998 through 2017  Congress passed the Departments of Commerce, Justice, State, the Judiciary and Related Agencies Appropriations Act, 1998, which prohibited the funds provided by the act from being used to promote the sale or export of tobacco or tobacco products  This act also prohibited the funds provided by the act from being used to seek the reduction or removal of foreign country restrictions on the marketing of tobacco or tobacco products  The act provided an exception for the funds to be used to address foreign-country restrictions on tobacco marketing that are not applied equally to all tobacco or tobacco products of the same type  These restrictions have been enacted through annual appropriations acts through fiscal year 2018  In fiscal year 2018, Congress altered the restriction language on tobacco promotion in the act making appropriations for State, which, according to State, makes promotion activities permissive with respect to the use of State appropriations  Congress used the term “should” in the Department of State, Foreign Operations, and Related Programs Appropriations Act, 2018 (2018 State Appropriations Act) instead of the term “shall” as in prior acts making appropriations for State  Specifically, the 2018 State Appropriations Act states that “None of the funds made available by this Act should be available to promote the sale or export of tobacco or tobacco products       ” In contrast, prior acts making appropriations for State stated “None of the funds made available by this Act shall be available to promote the sale or export of tobacco or tobacco products       ” According to State officials, they interpreted the term “shall” in prior appropriations acts as a mandatory action, whereas the use of the term “should” gives the agency more discretion in how it addresses the restrictions  However, State has not changed how it addresses the restrictions and does not plan to promote the sale or export of U S  tobacco, according to State officials  The legislation restricting fiscal year 2018 appropriations provided to Commerce and USDA from being used to promote tobacco retains the mandatory “shall” language  According to Commerce and USDA officials, the change to State’s restriction language does not affect the agencies’ activities because Commerce and USDA are still subject to the mandatory restrictions outlined in their agencies’ appropriations language  State collaborates with Commerce, USDA, and other agencies to develop and periodically issue an interagency guidance cable to implement funding restrictions on promoting tobacco  According to officials, this cable serves as the primary source of guidance for implementing the restrictions on promoting tobacco for their officials at all posts overseas  State collaborates with Commerce, USDA, and other agencies to develop and periodically issue an interagency guidance cable to all posts overseas to facilitate their implementation of funding restrictions on promoting tobacco  State officials draft the updated cable and Commerce, USDA, and other agency officials have the opportunity to review and comment on it before State issues it through its cable system  This cable serves as the primary source of guidance for implementing the restrictions, according to officials at these agencies (see table 2)  State has updated and issued the interagency guidance cable four times since 2013 to address changes in tobacco technology and other emerging issues, according to State officials  We identified two significant changes to the cable over the past 5 years  Addition of information concerning attendance at corporate social responsibility events: In May 2013, State added a provision that post officials should consult with headquarters before attending corporate social responsibility events involving U S  tobacco companies  State officials in headquarters acknowledged that post officials may not link some activities, such as participating in corporate social responsibility events, to the promotion of or selling of products  They noted that this is why it is important to make post officials aware of the actions they should or should not take through the interagency guidance cable  Changes to the scope of tobacco products: In recent updates to the cable, State expanded the description of “tobacco and tobacco products” to address the emergence of new delivery systems for tobacco  Specifically, in 2014 State added the language “tobacco delivering products, such as electronic cigarettes” to provide an example of a tobacco product  In 2016, State changed the description to “electronic nicotine delivery systems such as e-cigarettes ” Then in 2018, State added “non-combustible products such as smokeless tobacco” to the description of tobacco products  In response to the revised funding restriction language in the 2018 State Appropriations Act, State modified the 2018 cable stating that the changes make promotion activities permissive with respect to the use of State appropriations  However, State decided not to change the portion of the cable describing specific actions officials should or should not take in the version it issued in April 2018, because according to State officials, they do not plan to promote tobacco  In addition, Commerce and USDA officials said that the change to State’s restriction language has not changed how they interpret the guidance  Commerce relies on both the interagency guidance cable as well as its client eligibility policy to implement restrictions on promoting tobacco  Commerce’s client eligibility policy applies to all export promotion services that Commerce provides and educates officials on how to effectively manage U S  company requests for commercial assistance  The policy’s section on exceptions and other bases for declining services to companies states that Commerce is prohibited by law from promoting the export of tobacco or tobacco-related products  Commerce issued its updated client eligibility policy in October 2018  USDA relies on the interagency guidance cable to provide direction to its officials overseas, and does not have agency-specific guidance for implementing its permanent funding restrictions on promoting tobacco  USDA officials said that the cable sufficiently addresses the funding restrictions on the agency’s promotion activities and helps to ensure that all officials serving at posts overseas conduct activities in a consistent manner  Most State, Commerce, and USDA officials overseas we interviewed were aware of the restrictions on promoting tobacco  Most officials we interviewed had received some guidance concerning the restrictions, but several officials did not recall receiving the interagency guidance cable  Moreover, two of the agencies’ current training courses do not address the restrictions  Officials in 21 of the 24 offices overseas we interviewed were aware of the restrictions  The three offices that were not aware of the restrictions were from State  Although these officials were not aware of the restrictions, they said they had never provided services to U S  tobacco companies  Commerce and USDA headquarters officials said that it is widely known within their agencies that staff should not promote tobacco  Commerce and USDA officials said the guidance concerning these restrictions has been consistent for many years and that staff in the field and in headquarters are very aware of the restrictions  Most officials overseas had received some guidance concerning the restrictions on promoting tobacco  Officials in 21 of the 24 offices overseas we interviewed had received written or verbal guidance concerning the restrictions on promoting tobacco at some point in their career  For example, officials in 15 offices mentioned receiving the State-issued interagency guidance cable when we asked them what type of tobacco-related guidance they had received  In addition, officials in four of the eight Commerce offices recalled receiving agency-specific guidance  Some officials said that their supervisors had informed them they are not allowed to promote tobacco exports  Some officials did not recall receiving the interagency guidance cable, which agency officials said serves as the primary source of guidance for implementing the restrictions, and some were not aware that State periodically issues the cable  For example, one USDA official stated that he could not recall the last time he received guidance and noted that cables can easily be overlooked  He recommended that USDA improve its efforts to distribute the cable and have supervisors maintain an annual checklist to ensure staff have read and understand it or incorporate it into annual training  A State official told us that he was in Washington, D C  when State issued the prior cable and he did not learn about it until he had been stationed at his next overseas post for several months  A Commerce official noted that some officials new to post may not receive the interagency guidance cable for several months  All officials working overseas can access the interagency guidance cable through the State cable database or access other resources if a tobacco- related issue arises  For example, the Commerce client eligibility policy and the interagency guidance cable are available on an internal Commerce website  USDA officials in headquarters stated that they do not remind officials overseas about the restrictions or available guidance, but that, in response to our audit work, they plan to send an annual reminder  Finally, many post officials we interviewed said that they are aware of the activities their colleagues are undertaking and would have the opportunity to educate their colleagues before they provided any services to a tobacco company  Officials in 15 of the 24 offices overseas we interviewed said they did not receive any training concerning restrictions on promoting tobacco  In the past, State, Commerce, and USDA did not include information about the funding restrictions or related guidance in training materials  State and USDA officials in headquarters confirmed that training materials for officials conducting export promotion activities overseas do not address funding restrictions on promoting tobacco  According to an official at State’s Foreign Service Institute, tobacco products may be discussed in a trade-related course when describing those products officials should not advocate for, or in the 6-month economic studies course when examining the nexus between trade issues and public policy  However, State could not provide documentation of where this is specifically addressed in its curriculum  A USDA official stated that none of the Foreign Agricultural Service training courses explicitly discuss restrictions on promoting tobacco  According to Commerce officials, the training for new trade specialists did not include information about the restrictions on promoting tobacco when Commerce last provided the training in 2014  However, in response to our audit work, Commerce added this information into its training materials for new trade specialists in September 2018  Officials who do not receive training on the restrictions early in their careers may not be aware that they are prohibited from promoting tobacco  For example, one Commerce official told us he did not know about the restrictions while serving at his first post when he attended a meeting that involved representatives from the tobacco industry  He noted that he now questions whether he would have attended the meeting if he had known about the restrictions  Federal internal control standards state that appropriate training, aimed at developing employee knowledge, skills, and abilities, is essential to an organization’s operational success  If agencies do not explicitly include information about the restrictions and related guidance in training materials for officials conducting export promotion activities overseas, officials may work at a post for several months, or longer, before learning about the restrictions  The State, Commerce, and USDA officials we interviewed said they have implemented the funding restrictions on tobacco as outlined in the interagency guidance cable issued by State  For example, post officials said they have not promoted the sale or export of tobacco or tobacco products or attended events solely sponsored by tobacco companies, though many officials said they attended events at which officials from tobacco companies were present  Post officials identified three areas of the guidance that may benefit from additional clarification, according to interviews with agency officials and our review of agency emails  Our interviews with State, Commerce, and USDA officials in 24 offices in nine countries and our review of agency documents, showed that posts have implemented the interagency guidance outlining actions they should not take (see table 3 ) Post officials identified three areas of the guidance that may benefit from additional clarification, according to our interviews with agency officials and our review of agency emails: attendance at events, the types of permitted services, and the description of tobacco products  Officials from all three agencies raised questions about whether and when it is permissible to attend events at which tobacco company representatives are present  The guidance does not specifically address attendance at events also attended by representatives of tobacco companies  State headquarters officials said the vast majority of questions received from posts concern whether personnel at a post may participate in an event when representatives from a company engaged in the tobacco industry are also expected to participate in that event  We also reviewed emails in which Commerce officials asked for additional guidance about attending events or meetings with tobacco companies  For example, one post official asked whether the embassy could invite a tobacco company to participate in an embassy-organized trade mission that would include meetings with the local governor and mayor  In this case, Commerce headquarters officials advised that the tobacco company’s participation could be construed as U S  government support for the company’s commercial activities and recommended against including the tobacco company  A USDA official in headquarters also noted that attending events could, in some cases, be construed as supporting tobacco companies, and noted that this is an area where staff could use more guidance  Representatives from several tobacco control organizations expressed concern that interactions between U S  government officials and representatives from tobacco companies at events organized by business associations created a perception that the U S  government supported tobacco company sales in the country  For example, in 2017 a business association hosted a trade mission to one Southeast Asian country that included representatives from 30 U S  companies, including a U S  tobacco company  In response, two tobacco control organizations wrote to the U S  ambassador in that country voicing their concern that U S  government officials’ attendance at meetings that included the tobacco company representatives violated the spirit of the interagency guidance cable and gave the appearance that the U S  government supports the tobacco company

ground_truth: The federal government plans to invest almost $96 billion in IT in fiscal year 2018. Historically, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. As a result, GAO added two areas to its high-risk list: IT security in 1997 and the management of IT acquisitions and operations in 2015. This statement summarizes agencies' progress in improving IT management and ensuring the security of federal IT. It is primarily based on GAO's prior reports issued between February 1997 and May 2018 (and an ongoing review) on (1) CIO responsibilities, (2) agency CIOs' involvement in approving IT contracts, (3) data center consolidation efforts, (4) the management of software licenses, and (5) compliance with cybersecurity requirements. The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the security of federal IT through a series of initiatives. As of May 2018, agencies had fully implemented about 61 percent of the approximately 800 IT management-related recommendations that GAO made from fiscal years 2010 through 2015. Likewise, since 2010, agencies had implemented about 66 percent of the approximately 2,700 security-related recommendations as of May 2018. Even with this progress, significant actions remain to be completed. Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. However, in a draft report on CIO responsibilities, GAO's preliminary results suggest that none of the 24 selected agencies have policies that fully address the role of their CIO, as called for by federal laws and guidance. GAO intends to recommend that OMB and each of the selected 24 agencies take actions to improve the effectiveness of CIO's implementation of their responsibilities. IT contract approval . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight over IT acquisitions. Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers, which was codified and expanded in FITARA. According to agencies, data center consolidation and optimization efforts have resulted in approximately $3.9 billion of cost savings through 2018. Even so, additional work remains. GAO has made 160 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets; however, as of May 2018, 80 of the recommendations have not been fully addressed. Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 135 recommendations to improve such management. Four years later, 78 of the recommendations remained open. Improving the security of federal IT systems . While the government has acted to protect federal information systems, agencies need to improve security programs, cyber capabilities, and the protection of personally identifiable information. Over the last several years, GAO has made about 2,700 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. As of May 2018, about 800 of the information security-related recommendations had not been implemented. From fiscal years 2010 through 2015, GAO made about 800 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. Since 2010, GAO also made about 2,700 recommendations to federal agencies to improve the security of federal systems. These recommendations include those to improve the implementation of CIO responsibilities, the oversight of the data center consolidation initiative, software license management efforts, and the strength of security programs and technical controls. Most agencies agreed with these recommendations, and GAO will continue to monitor their implementation.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2:  Subsequently, the Deputy Chief of Mission distributed guidance specific to that post stating that officials were not allowed to attend a trade mission’s events or meetings if representatives from a tobacco company were scheduled to give a presentation  Several post officials said that attending events organized by business associations is a key function of their job  They attend these events to, among other things, exchange information about the local business climate and learn about the concerns of American companies  Commerce and USDA officials identified ambiguities in the guidance concerning the types of services they are allowed to provide to tobacco companies or the tobacco industry  In 14 of the 21 Commerce emails we reviewed, officials at posts asked for additional guidance about the types of services they are permitted to provide to tobacco companies or the types of companies or products they can support  For example, some post officials asked whether they could engage with the host country government to obtain information about pending tobacco-related legislation at the request of a tobacco company  In one case, Commerce headquarters advised post officials that the restrictions did not prohibit them from raising concerns on a legislative proposal that would discriminate against foreign tobacco companies  They further noted that because of the sensitive nature of tobacco-related issues, any policy decision to engage should be weighed carefully  Commerce’s client eligibility policy does not provide a description of the types of actions Commerce officials should and should not take with regards to tobacco companies and products  The interagency guidance cable also does not provide information about some types of services, such as whether officials should engage with host country government officials to learn about pending tobacco-related legislation  According to a USDA official, some officials overseas interpret “promotional” activities differently and did not agree on whether both marketing and trade-related activities, such as enforcing trade agreements, are promotional activities  Commerce officials at post asked for additional guidance about whether they could provide export promotion services to companies exporting certain tobacco-related products in 3 of the 21 emails we reviewed  For example, some Commerce officials asked whether they could provide services to companies selling component parts for electronic nicotine delivery systems, such as e-liquids  Commerce’s prior client eligibility policy, issued in May 2017, did not include a list of tobacco products covered by the policy; whereas, the interagency guidance cable issued in 2014 states that tobacco products include tobacco delivery systems, such as electronic cigarettes, and the updated version issued in 2018 added non-combustible products, such as smokeless tobacco, to this description  However, neither the interagency guidance cable nor Commerce’s updated client eligibility policy specifically states whether the description includes component parts for electronic cigarettes and other tobacco products  GAO previously reported that electronic cigarettes include a wide range of products that share the same basic design and generally consist of three main parts: a power source, a heating element, and a cartridge or tank containing liquid solution, which is often sold separately  According to State officials in headquarters, the guidance on promoting tobacco was written for a broad audience and to make post officials mindful of the restrictions  They said they trust that officials overseas will use their professional judgment and in-country expertise to determine if post’s support for an event or a company will be construed as promotion of a tobacco product  Moreover, State and Commerce officials said that they expect officials overseas to ask headquarters questions to clarify the interagency guidance cable  While federal standards for internal control state that management should clearly document internal controls in policies and guidance to prevent officials from failing to achieve an objective or address a risk, we found that the interagency guidance does not provide examples of the factors post officials should consider when attending business association events  The guidance also lacks sufficient examples of the types of services officials are allowed to provide to tobacco companies and a clear description of tobacco products  More specific guidance would help ensure that State, Commerce, and USDA officials consistently implement their agency-specific funding restrictions on promoting tobacco exports  The United States exported over $2 billion in tobacco and tobacco-related products in 2017  Congress has enacted restrictions on the use of certain appropriated funds to promote the sale or export of U S  tobacco or tobacco products since the 1990s, and State, Commerce, and USDA have developed and updated guidance to implement these restrictions  However, not all officials were aware of the restrictions and more than half had not received training about the restrictions  Including information about the restrictions in training materials would help make officials aware of the restrictions early in their careers and prompt them to seek guidance if a tobacco-related issue arises  If officials conducting export promotion activities are unaware of the funding restrictions on promoting tobacco sales and exports, they may also be unaware of the activities they should and should not undertake  Moreover, some officials said that the guidance is unclear in some areas  Although officials said they need to attend business association events to support all U S  companies conducting business in a country, they were unsure whether they can attend events where representatives from U S  tobacco companies may be present  In addition, some officials also indicated that the current guidance lacks clarity on the types of services officials are allowed to provide to tobacco interests and what constitutes a tobacco product  Although we did not identify any instances in which a State, Commerce, or USDA official directly promoted U S  tobacco products, clearer guidance would help to ensure that officials will consistently implement their agency-specific funding restrictions  We are making three recommendations, including two to State and one to USDA  Specifically: The Secretary of State should work with the Foreign Service Institute to include information about the funding restrictions and relevant guidance on promoting the sale or export of tobacco or tobacco products in its training materials for employees conducting export promotion activities overseas  (Recommendation 1) The Secretary of Agriculture should include information about the funding restrictions and relevant guidance on promoting the sale or export of tobacco or tobacco products in training materials for employees conducting export promotion activities overseas  (Recommendation 2) The Secretary of State, in consultation with the Secretary of Commerce and the Secretary of Agriculture, should assess the interagency guidance cable on promoting tobacco in light of questions raised by officials at posts overseas and update it to address ambiguities, as needed  (Recommendation 3) We provided a draft of this report to State, Commerce, USDA, and USTR for review and comment  In their comments, reproduced in appendix III, State concurred with our recommendations and described planned actions to address them  USDA concurred with the recommendation and told us that they had no comments on the draft report  Commerce and USTR told us that they had no comments on the draft report  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the appropriate congressional committees, the Secretary of the Department of State, the Secretary of the Department of Commerce, the Secretary of the U S  Department of Agriculture, the U S  Trade Representative, and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-3149 or gootnickd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IV  This report examines (1) the guidance select U S  agencies have issued to implement funding restrictions on promoting tobacco exports overseas, (2) to what extent overseas officials from select U S  agencies were aware of the restrictions and guidance, and (3) to what extent select U S  agencies have implemented this guidance overseas  To address our first objective, we reviewed U S  appropriations laws that prohibited the funds appropriated therein from being used to promote the sale or export of tobacco or tobacco products  We also reviewed guidance issued by the Departments of State (State) and Commerce (Commerce) concerning the promotion of tobacco exports overseas  We also interviewed officials in headquarters from State, Commerce, the U S  Department of Agriculture (USDA), and the Office of the U S  Trade Representative (USTR) about the funding restrictions on promoting tobacco exports overseas and the development and revision of guidance on tobacco promotion  To address our second objective, we interviewed officials in headquarters from State, Commerce, and USDA about any training officials posted overseas receive concerning the funding restrictions on promoting tobacco exports  In addition, we held structured interviews with 35 State, Commerce, and USDA officials overseas conducting export promotion activities and reached out to an additional 10 officials to ask about activities associated with the solicitation of gifts and attendance at corporate social responsibility events  These officials were located across 11 posts and in 9 countries  We interviewed officials in Cambodia, Croatia, Dominican Republic, Honduras, Indonesia, Philippines, South Africa, Thailand, and Vietnam  Because multiple officials from one agency attended a meeting in some cases, we are reporting their combined responses as one “office” response  Thus, we are reporting the results from the 24 offices we interviewed—9 State, 8 Commerce, and 7 USDA offices  We selected this non-generalizable sample of countries based on criteria that included the countries’ large or increasing amounts of U S  tobacco imports, relatively high tobacco smoking prevalence rates, and geographic dispersion  The information obtained from these interviews is neither generalizable nor reflects the experiences of all State, Commerce, and USDA officials serving at posts overseas, but it does provide insights into officials’ experiences at post and illustrative examples across our sample on the topics discussed  To address our third objective, we interviewed officials in headquarters from State, Commerce, and USDA about post officials’ implementation of guidance regarding the promotion of tobacco exports, the types of questions they receive from post officials about the funding restrictions and guidance, and the additional advice they provide to post officials overseas  We asked post officials about the clarity of guidance, whether they attended events sponsored or attended by representatives of U S  tobacco companies, and whether they discussed tobacco-related issues with host country government officials during our structured interviews with the 24 State, Commerce, and USDA offices overseas  We also analyzed a Commerce database, agency emails, and State cables and conducted a literature search  Commerce documents all the fee-based services it provides to companies in a database  We obtained a list of approximately 30,000 fee-based services Commerce provided in fiscal years 2013 through 2017, which included the name of the companies to which Commerce provided these services  We then downloaded a list of 763 U S  tobacco companies from Nexus using criteria such as industry classification codes related to tobacco and tobacco products and the location of company headquarters  We limited the list of U S  tobacco companies to those with revenues greater than $5 million  We then compared the two lists to determine if Commerce provided any fee-based services to U S  tobacco companies  To assess the reliability of the Commerce fee-based services data, we reviewed relevant documentation and interviewed knowledgeable officials about system controls  We determined that Commerce’s fee-based services data were sufficiently reliable for the purposes of our reporting objectives  In addition, we requested State, Commerce, and USDA email communications concerning tobacco-related issues sent between January 2015 and February 2018 from post officials to headquarters  State was only able to provide one such email  USDA provided several emails, but the emails were not from USDA post officials to USDA officials in headquarters  Commerce provided us 21 emails that matched our request and an additional 20 emails from officials working throughout the United States  We analyzed the Commerce email communications to identify commonly asked questions or concerns about the existing guidance and actions the agencies should take to support U S  tobacco companies or the tobacco industry  We also requested State cables from the eight countries in our sample sent between January 2013 and December 2017 that referenced at least 1 of the 10 U S  tobacco companies with the highest revenues  We received and reviewed cables from six of these countries  We also conducted a literature search to identify instances in which U S  government officials may have conducted activities addressed by the interagency tobacco guidance cable  To identify relevant articles, such as trade or industry articles, we searched various databases, including ProQuest and Nexus  From these sources, we identified one article relevant to our research objective  We performed these searches in December 2017 and searched for articles published from January 2013 to December 2017  We also interviewed representatives of the tobacco control community and business associations to obtain their perspectives concerning U S  government support for tobacco exports and U S  government interactions with U S  tobacco companies  Specifically, we interviewed the World Health Organization (WHO), four global or regional tobacco control nongovernmental organizations, and several local nongovernmental organizations in two countries in our scope  In addition, we interviewed officials from the local American Chamber of Commerce and the U S - Association of Southeast Asian Nations Business Council in two countries  The information obtained from these interviews is neither generalizable nor reflects the experiences of all tobacco control organizations or business associations, but it does provide insights into these officials’ experiences  We conducted this performance audit from November 2017 to December 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The United States exported over $2 1 billion in tobacco and tobacco products in 2017  Figure 1 shows how tobacco exports fluctuated from 2007 to 2017  Specifically, total tobacco exports have ranged from a high of approximately $2 4 billion in 2007 to a low of about $1 7 billion in 2012  U S  tobacco exports to Asia have decreased by 68 percent over the past 11 years, whereas exports to North America have increased 10-fold (see fig  2)  Most of the decrease in exports to Asia is attributable to reduced exports to Japan, which fell 95 percent from 2007 to 2017  Most of the increases in exports to North America are attributable to Canada, which accounted for approximately 40 percent of total U S  tobacco exports in 2017  David B  Gootnick, (202) 512-3149 or gootnickd@gao gov  In addition to the contact named above, Cheryl Goodman (Assistant Director), Celia Thomas (Assistant Director), Amanda Bartine, Leah DeWolf, Jewel Conrad, Aldo Salerno, and Neil Doherty made key contributions to this report  Grace Lui, Justin Fisher, and Ming Chen provided technical assistance 
Report 2:  We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals  Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis  Our previous work on performance metrics identified 10 attributes of effective performance  Table 7 identifies each key attribute of effective performance measures along with its definition  We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch  We primarily focused on key attributes which could be applied to individual measures  These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data  Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement  Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures  As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines  Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data  Clarity  The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described  For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks  The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks  However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines  It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines  The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous ” However, the database does not specifically define these topics or explain the methodology for calculating the measures  Unclear measures could be confusing and misleading to users  Core program activities  The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry  However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures  The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented  If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders  Limited overlap  The pipeline-related measures in the 2018 NSTS do not have limited overlap  As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines  The management measure is based on the number of complete pipeline security reviews  The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups  Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017  This is similar to four of the five NSTS measures  Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management  Linkage  The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute  For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities  However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned  If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission  Measurable target  TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets  For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans  However, the management measure did include target numbers of pipeline security reviews by fiscal year  Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets  Without measurable targets, TSA cannot tell if performance is meeting expectations  Objectivity  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective  If measures are not objective, the results of performance assessments may be systematically overstated or understated  Reliability  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable  If measures are not reliable, reported performance data may be inconsistent and add uncertainty  Baseline and trend data  TSA’s measures generally did not include baseline and trend data  For example, none of the NSTS measures included past results and compared them to measurable targets  TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important  However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals  The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year  The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure  However, baseline and trend data are not tracked or reported in either database  Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved  Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program  TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines  For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016  They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures  The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage  However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures  In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress  Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks  This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data  Further examples include the following: Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations  For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results  To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated  For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation  Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context  For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years  This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals  According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)  However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable  When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate  For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility  In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type  In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions  TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities  TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan  We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate  First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013  TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014  A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014  However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond  As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs  The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database  However, this database does not include all of the information that TSA collects when conducting CSRs  Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions  Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases  For example: The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields  The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures  The CFSR recommendations database had missing data in 3 of 9 fields  There was also inconsistent data entry formats in 3 fields  The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields  Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR  TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards  This was for two reasons  First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards  However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards  For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered  Second, only a small number of TSA employees enter information into these databases  TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered  As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews  Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks  The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate  In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination  The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means  Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program  Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk  By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines  A successful pipeline attack could have dire consequences on public health and safety, as well as the U S  economy  Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network  To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program  TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices  However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed  TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking  Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture  Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods  We are making 10 recommendations to TSA: The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals  (Recommendation 1) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  (Recommendation 2) The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  (Recommendation 3) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data  (Recommendation 4) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment  (Recommendation 5) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  (Recommendation 6) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach  (Recommendation 7) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data  (Recommendation 8) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status  (Recommendation 9) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  (Recommendation 10) We provided a draft of this report to DHS, DOE, DOT, and FERC  DHS provided written comments which are reproduced in appendix III  In its comments, DHS concurred with our recommendations and described actions planned to address them  DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate  We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed  For those who provided technical comments, we incorporated them as appropriate  With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate  DHS estimated that this effort would be completed by March 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  DHS estimated that this effort would be completed by May 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool  According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities  DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status  DHS estimated that this effort would be completed by October 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  DHS estimated that this effort would be completed by July 31, 2019  This action, if fully implemented, should address the intent of the recommendation  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date  At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao gov, and Nick Marinos at (202) 512-9342 or marinosn@gao gov  Key contributors to this report are listed in appendix IV  This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations  This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed  The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007  The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input)  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies  However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21)  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence  Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence  We identified several shortfalls in the pipeline risk assessment’s calculation of threat  First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally  Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014  Third, the threat calculation does not take into account natural hazards  Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline  However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems  Further, this judgment is not documented in the risk assessment’s methodology  According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments  Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline  Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats  However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment  These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation  Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results  Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems  However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years  In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved  For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines  Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry  Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms  However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology  Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score  To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used  Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk  Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes  For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region  Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms  For example, according to the U S  Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals  In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline  Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily  Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards  According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property  As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission  According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems  However, we identified possible sources of data for the Pipeline Security Branch to consider  For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines  Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system  According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards  We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction  Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors  The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology  As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment  Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP  Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience  The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making  By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments  Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels  Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach  Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews  The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap  However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability  For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores  However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch  The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management  Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes  Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation  This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction  The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment  In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines  For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function  Pipelines that freeze and then rupture can affect the energy and transportation systems sectors  As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard  While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability  For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline  According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change  Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack  The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage  By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system  This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems  Capturing cybersecurity in the risk assessment is also an area for improvement  Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment  However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines  Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment  This could be an element of the feedback mechanism described above and emphasized in the NIPP  Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines  As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs  Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations  According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience  The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases  However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity  Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors  Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent  The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency  Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency  Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment  As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014  When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk  According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year  However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner  The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score  Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk  Chris P  Currie at (404) 679-1875 or curriec@gao gov Nick Marinos at (202) 512-9342 or marinosn@gao gov  In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W  Gilmore, Assistant Director; and Michael C  Lenington, Analyst-in-Charge, managed this assignment  Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A  Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report 

ground_truth: The World Health Organization estimates that tobacco use kills over 7 million people each year, more than tuberculosis, HIV/AIDS, and malaria combined. Since the 1990s, Congress has enacted restrictions regarding the use of certain appropriated funds to promote U.S. tobacco exports. GAO was asked to review the implementation of these restrictions. This report examines (1) guidance select U.S. agencies have issued to implement these restrictions, (2) whether overseas officials from select U.S. agencies were aware of the restrictions and guidance, and (3) select U.S. agencies' implementation of the guidance overseas. GAO reviewed U.S. laws, agency guidance, and internal communications; analyzed Commerce data; and interviewed agency officials in Washington, D.C. and in 24 offices across 11 overseas posts in 9 countries. GAO selected these countries based on criteria that included U.S. tobacco export totals, smoking rates, and geographic dispersion. Congress has restricted the use of certain appropriated funding to promote tobacco exports and the Departments of State (State), Commerce (Commerce), and Agriculture (USDA) have issued interagency guidance through the cable system that they rely on to implement these restrictions. State collaborates with these and other agencies to periodically update this cable. The cable informs officials about the types of actions they should take—such as providing routine business facilitation services to all U.S. companies—and the types of actions they should not take—such as attending events sponsored by tobacco companies. Most, but not all, officials overseas that GAO interviewed were aware of the restrictions and received some guidance concerning the restrictions. However, GAO found that some officials did not recall receiving the interagency guidance cable. In addition, State and USDA's current training materials do not address the restrictions. Federal internal control standards state that appropriate training is essential to an organization's operational success. Thus, providing officials overseas with training about the funding restrictions and related guidance would help to ensure that officials are aware of the restrictions. U.S. officials overseas have implemented restrictions on promoting tobacco, but some officials said that the interagency guidance lacks clarity. Officials said that they have not promoted tobacco by, for example, attending events sponsored solely by tobacco companies. However, officials identified three areas of the guidance that are unclear: (1) attendance at events not sponsored by U.S. tobacco companies but attended by representatives of these companies; (2) the types of services officials can provide tobacco companies; and (3) the description of tobacco products, such as whether component parts for electronic cigarettes are included. Federal standards for internal control state that management should clearly document internal controls in policies and guidance to prevent officials from failing to achieve an objective or address a risk. By providing more specific guidance, the agencies would help ensure that officials consistently implement the funding restrictions on promoting tobacco. GAO recommends that (1) State and USDA include information about the funding restrictions and guidance in training materials for relevant employees and (2) State, in consultation with Commerce and USDA, assess and update the interagency guidance cable, as needed, on promoting tobacco in light of questions raised by officials at posts overseas. State and USDA concurred with the recommendations.