prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: T he unemployment insurance (UI) system has two primary objectives: (1) to provide temporary, partial wage replacement for involuntarily unemployed workers and (2) to stabilize the economy during recessions  In support of these goals, several UI programs provide benefits for eligible unemployed workers  In general, when eligible workers lose their jobs, the joint federal-state Unemployment Compensation (UC) program may provide up to 26 weeks of income support through regular UC benefit payments  UC benefits may be extended for up to 13 weeks or 20 weeks by the Extended Benefit (EB) program if certain economic situations exist within the state  As of the date of this publication, although both the UC and EB programs are authorized, no state is in an active EB period  For an overview of EB, see the Appendix   The Social Security Act of 1935 (P L  74-271) authorizes the joint federal-state UC program to provide unemployment benefits  Most states provide up to a maximum of 26 weeks of UC benefits  Former federal workers may be eligible for unemployment benefits through the Unemployment Compensation for Federal Employees (UCFE) program  Former U S  military servicemembers may be eligible for unemployment benefits through the Unemployment Compensation for Ex-Servicemembers (UCX) program  The Emergency Unemployment Compensation Act of 1991 ( P L  102-164 ) provides that ex-servicemembers be treated the same as other unemployed workers with respect to benefit levels, the waiting period for benefits, and benefit duration  Although federal laws and regulations provide broad guidelines on UC benefit coverage, eligibility, and determination, the specifics regarding UC benefits are determined by each state  This results in essentially 53 different programs  Generally, UC eligibility is based on attaining qualified wages and employment in covered work over a 12-month period (called a base period) prior to unemployment  All states require a worker to have earned a certain amount of wages or to have worked for a certain period of time (or both) within the base period to be eligible to receive any UC benefits  The methods states use to determine eligibility vary greatly  Most state benefit formulas replace approximately half of a claimant's average weekly wage up to a weekly maximum  Additionally, each state's UC law requires individuals to have lost their jobs through no fault of their own, and recipients must be able to work, available for work, and actively seeking work  These eligibility requirements help ensure that UC benefits are directed toward workers with significant labor market experience and who are unemployed because of economic conditions  The UC program is financed by federal taxes under the Federal Unemployment Tax Act (FUTA) and by state payroll taxes under each state's State Unemployment Tax Act (SUTA)  The 0 6% effective net FUTA tax paid by employers on the first $7,000 of each employee's earnings (equaling no more than $42 per worker per year) funds federal and state administrative costs, loans to insolvent state UC accounts, the federal share (50%) of EB payments, and state employment services  SUTA taxes on employers are limited by federal law to funding regular UC benefits and the state share (50%) of EB payments  Federal law requires that the state tax be on at least the first $7,000 of each employee's earnings and that the maximum state tax rate be at least 5 4%  Federal law also requires each employer's state tax rate to be based on the amount of UC paid to former employees (known as "experience rating")  Within these broad requirements, each state has great flexibility in determining its SUTA structure  Generally, the more UC benefits paid out to its former employees, the higher the tax rate of the employer, up to a maximum established by state law  Funds from FUTA and SUTA are deposited in the appropriate accounts within the Unemployment Trust Fund (UTF)  The sequester order required by the Budget Control Act of 2011 (BCA; P L  112-25 ) and implemented on March 1, 2013 (after being delayed by P L  112-240 ), affected some but not all types of UI expenditures  Regular UC, UCX, and UCFE payments are not subject to the sequester reductions  EB and most forms of administrative funding are subject to the sequester reductions  The FY2019 sequestration order requires a 6 2% reduction in all nonexempt nondefense mandatory expenditures, but no sequestration reductions are applicable to discretionary programs, projects, and activities  As a result, EB expenditures are required to be reduced 6 2% (only on the federal share of EB benefits) for weeks of unemployment during FY2019  As of January 22, 2019, EB has not been activated in any state during FY2019  The lapse in federal appropriations that occurred from December 22, 2018, until January 25, 2019, caused a partial government shutdown  As a result, during this lapse in appropriations, agencies without funding furloughed federal employees, and many federal employees excepted from furlough were working without pay  Furloughed federal employees may be eligible for UCFE benefits  States are required to operate the UCFE program under the same terms and conditions that apply to regular state UC  Therefore, UCFE eligibility is determined under the laws of the state in which an individual's official duty station in federal civilian service is located  Federal employees who are in furlough status on account of a government shutdown are generally treated by state law as laid off with an expectation of recall  Depending on state laws and regulations, the state may have an option to not require federal employees to search for work given an expected recall  However, according to guidance from U S  Department of Labor (DOL), excepted federal employees who are performing services (but working without pay) would generally be ineligible for UCFE benefits based on states' definitions of "unemployment " Private-sector workers who are furloughed or laid off due to the partial government shutdown because they were employed by government contractors or other businesses may be eligible for regular UC benefits  UC eligibility for these workers would be based on the requirements set out under the state laws in the state where they had worked  In this climate, there has been congressional interest in assisting furloughed and excepted federal employees through the UI system  For example, as described below in the section on " Unemployment Compensation for Excepted Federal Employees During a Government Shutdown ," there are proposals to provide new authority to pay UCFE benefits to excepted federal workers who are working without pay  The most recent lapse in federal appropriations began December 22, 2018, and ended on January 25, 2019, with the enactment of H J Res  28   Because retroactive pay for furloughed and excepted federal employees was authorized under S  24 , the Government Employee Fair Treatment Act of 2019 (enacted January 16, 2019), UCFE payments made to federal employee claimants during this lapse in appropriations may be deemed an overpayment, subject to state UC laws regarding overpayment recovery  According to guidance from the Office of Personnel Management on this issue The state UI agency will determine whether or not an overpayment exists and, generally, the recovery of the UCFE overpayment is a matter for state action under its law; however, some state UI laws require the employer to recover such overpayment by collecting the overpayment amount from the employee  The Federal and state agencies will need to coordinate to determine the required action in accordance with the individual state UI law  Federal agencies are encouraged to develop lists or spreadsheets that can be provided to the state(s) containing the employees' names, social security numbers, and the amounts and periods of time covered by the retroactive payment  If a recession is deep enough and if state unemployment tax (SUTA) revenue is inadequate for long periods of time, states may have insufficient funds to pay for UC benefits  Federal law, which requires states to pay these benefits, provides a loan mechanism within the UTF framework that an insolvent state may use to meet its UC benefit payment obligations  States must pay back these loans  If the loans are not paid back quickly (depending on the timing of the beginning of the loan period), states may face interest charges, and states' employers may face increased net FUTA rates until the loans are repaid  The U S  Virgin Islands is the only jurisdiction with an outstanding loan  As of January 18, 2019, it had an outstanding loan of $68 4 million from the federal accounts within the UTF  At the end of 2017, fewer than half of states (24) had accrued enough funds in their accounts to meet or exceed the minimally solvent standard of an average high cost multiple (AHCM) of 1 0 in order to be prepared for a recession  Beginning in FY2015, DOL funded state efforts "addressing individual reemployment needs of UI claimants, and working to prevent and detect UI overpayments" through the voluntary Reemployment Services and Eligibility Assessment (RESEA) program  RESEA provides funding to states to conduct in-person interviews with selected UI claimants to (1) assure that claimants are complying with the eligibility rules, (2) determine if reemployment services are needed for the claimant to secure future employment, (3) refer the individual to reemployment services as necessary, and (4) provide labor market information that addresses the claimant's specific needs  Section 30206 of P L  115-123 codified the authority for DOL to administer a RESEA program  It also set out various requirements for states to use certain types of evidence-based interventions for UI claimants under RESEA and allocated discretionary funding for RESEA across three categories (base funding, outcome payments, and research and technical assistance)  State RESEA programs must include reasonable notice and accommodations to participating UI beneficiaries  On April 4, 2019, DOL published a proposed methodology to allocate base RESEA funds and outcome payments  DOL requested state and public comments on this proposal by May 6, 2019  The President's budget for FY2020 proposes changes to several aspects of the UI system  It would create a new required standard for state account balances within the UTF and a new benefit entitlement for paid parental leave financed through state unemployment taxes  The President's FY2020 budget also proposes a set of additional integrity measures, including the required use of certain databases to confirm UC eligibility and requiring Social Security Disability Insurance (SSDI) benefits offset UI benefits  The President's budget proposal for FY2020 would require states to maintain a minimum level of solvency in their UTF account balances to be at least half (0 5) of the state's AHCM  The proposal would alter the rules for calculating the net FUTA rate, requiring a higher net FUTA rate on a state's employers if that state maintained an AHCM of less than 0 5 on January 1 of two or more consecutive years  The additional FUTA revenue would be deposited into the state UTF account and would be terminated once the state met the 0 5 AHCM criteria  The President's budget proposal for FY2020 would require states to establish a paid parental leave benefit by 2020, using the UC program as its base for an administrative framework  States would be required to provide six weeks of benefits to a worker on leave or otherwise absent from work for the birth or adoption of the worker's child  States would have discretion to determine the parameters of eligibility and financing for this new paid parental leave benefit  The President's 2020 budget would require states to use three specific data sources to confirm an individual's eligibility for UC benefits: the State Information Data Exchange System (SIDES, administered by Information Technology Support Center [ITSC] and DOL); the National Directory for New Hires (NDNH, administered by the Department of Health and Human Services); and the Prisoner Update Processing System (PUPS, administered by the Social Security Administration)  The proposal would create several additional integrity measures, including giving the Secretary of Labor the authority to implement new corrective action measures in response to poor state administrative performance within the program; allowing states to retain a percentage of UC overpayments for program integrity use; requiring states to deposit all UC penalty and interest payments into a special state fund, with these funds required to be used for improving state UI administration as well as providing reemployment services for UI claimants; and offsetting SSDI benefits to account for concurrent receipt of UI benefits  Section 2105 of the Middle Class Tax Relief and Job Creation Act of 2012 ( P L  112-96 ; February 22, 2012) amended federal law to allow states to conduct two types of drug testing  First, it expanded the long-standing state option to disqualify UC applicants who were discharged from employment with their most recent employer (as defined under state law) for unlawful drug use by allowing states to drug test these applicants to determine UC benefit eligibility or disqualification


Report 2:  Second, it allowed states to drug test UC applicants for whom suitable work (as defined under state law) is available only in an occupation that regularly conducts drug testing, to be determined under new regulations issued by the Secretary of Labor  As required by  P L  112-96 , on August 1, 2016, DOL promulgated  20 C F R  Part 620 ,  a new rule to implement the provisions of the law relating to the drug testing of UC applicants for whom suitable work (as defined under state law) is available only in an occupation that regularly conducts drug testing  Amid concerns voiced by stakeholders about the 2016 DOL rule, Congress repealed this UC drug testing rule using the Congressional Review Act (CRA) via H J Res  42 / P L  115-17   On November 5, 2018, DOL published a Notice of Proposed Rulemaking (NPRM) to reissue the rule identifying occupations that regularly conduct drug testing for purposes of Section 2105 of  P L  112-96   The CRA prohibits an agency from reissuing the rule in "substantially the same form" or issuing a "new rule that is substantially the same" as the disapproved rule, "unless the reissued or new rule is specifically authorized by a law enacted after the date of the joint resolution disapproving the original rule " Notably, this is the first time an agency has proposed to reissue a rule after the original version was disapproved under the CRA  According to the 2018 NPRM, DOL has addressed the reissue requirements of the CRA by proposing a substantially different and more flexible approach to the statutory requirements than the 2016 Rule, enabling states to enact legislation to require drug testing for a far larger group of UC applicants than the previous rule permitted  This flexibility is intended to respect the diversity of states' economies and the different roles played by employment drug testing in those economies  Comments on the proposed 2018 rule were required to be submitted by January 4, 2019  On January 16, 2019, Senator Richard Blumenthal introduced S  165 , the Federal Unemployment Compensation Equity Act of 2019  This proposal would amend UCFE law and create a new permanent UCFE eligibility category for excepted federal employees who are unpaid but required to work during a government shutdown due to a lapse in appropriations  During any shutdown beginning on or after December 22, 2018, all excepted federal workers would be deemed eligible for UCFE benefits  Additionally, these employees would not be subject to a one-week waiting period (otherwise often required under state laws) before UCFE benefits were to be paid  On January 23, 2019, Representative Debbie Dingell introduced H R  725 , the Pay Federal Workers Act  This proposal would also provide UCFE benefits in a similar manner to S  165 , including permanently amending 5 U S C  Chapter 85 to provide federal authority for these benefits  On January 23, 2019, Representative Anthony Brown introduced H R  720   This proposal would deem excepted federal employees during a government shutdown to be eligible for UCFE during FY2019  The authority to provide UCFE to these excepted workers would expire at the end of FY2019  On February 8, 2019, Representative Katie Hill introduced H R  1117 , the Shutdown Fairness Act of 2019  This proposal would deem excepted federal employees and unpaid military servicemembers during a government shutdown to be eligible for UCFE or UCX during FY2019  The authority to provide UCFE to these excepted workers would expire at the end of FY2019  On January 15, 2019, Senator Ron Wyden and Representative Danny Davis introduced S  136 and H R  556 , the Economic Ladders to End Volatility and Advance Training and Employment Act of 2019 (the ELEVATE Act)   Among other provisions, this proposal would establish new self-employment and relocation assistance benefits for unemployed workers to be administered by the Social Security Administration, in consultation with DOL  The self-employment assistance benefits would provide weekly income replacement (half of prior earnings up to the maximum weekly benefit amount in the state) for up to of 26 weeks to individuals  They would be available to individuals who are (1) eligible for any type of UI benefit; or ineligible for any type of UI benefit, but became involuntarily unemployed over the previous 12 weeks; or were previously self-employed, but lost a hiring contract, and (2) have a viable business plan approved by their state department of labor, workforce board, or the Small Business Administration  Additionally, Section 3 of S  136 and H R  556 would provide up to $2,000 (or more, depending on family size) to fund to up to 90% of certain relocation expenses for eligible individuals and their families  In order to be eligible for this relocation assistance, an individual must be a (1) dislocated worker, (2) long-term unemployed individual, or (3) underemployed individual and also have filed a claim for relocation assistance and obtained suitable work with an expectation of obtaining such work in a new geographic region  On March 7, 2019, Representative Karen Bass introduced H R  1585 , the Violence Against Women Reauthorization Act of 2019  Among many other provisions, Section 703 of H R  1585 would require states to consider an individual who quit employment because of sexual harassment, domestic violence, sexual assault, or stalking to be eligible for UC benefits  The House passed H R  1585 on April 4, 2019  On March 14, 2019, Representative Stephanie Murphy introduced H R  1759 , the Building on Reemployment Improvements to Deliver Good Employment (BRIDGE) for Workers Act  This proposal would extend eligibility to any claimant of unemployment benefits, including those profiled as likely to exhaust benefits (rather than limiting eligibility to those who were profiled as likely to exhaust benefits)  The House passed H R  1759 on April 9, 2019  The Extended Benefit (EB) program was established by the Federal-State Extended Unemployment Compensation Act of 1970 (EUCA; P L  91-373) (26 U S C  §3304, note)  EUCA may extend receipt of unemployment benefits (extended benefits) at the state level if certain economic conditions exist within the state  As of the date of this publication, EB is not active in any state  Extended Benefit Triggers The EB program is triggered when a state's insured unemployment rate (IUR) or total unemployment rate (TUR) reaches certain levels  All states must pay up to 13 weeks of EB if the IUR for the previous 13 weeks is at least 5% and is 120% of the average of the rates for the same 13-week period in each of the two previous years  States may choose to enact two other optional thresholds  (States may choose one, two, or none ) If the state has chosen one or more of the EB trigger options, it would provide the following: Option 1—up to an additional 13 weeks of benefits if the state's IUR is at least 6%, regardless of previous years' averages  Option 2—up to an additional 13 weeks of benefits if the state's TUR is at least 6 5% and is at least 110% of the state's average TUR for the same 13 weeks in either of the previous two years; up to an additional 20 weeks of benefits if the state's TUR is at least 8% and is at least 110% of the state's average TUR for the same 13 weeks in either of the previous two years  EB benefits are not "grandfathered" (phased out) when a state triggers "off" the program  When a state triggers "off" of an EB period, all EB benefit payments in the state cease immediately regardless of individual entitlement  The EB benefit amount is equal to the eligible individual's weekly regular UC benefits  Under permanent law, FUTA finances half (50%) of the EB payments and 100% of EB administrative costs  States fund the other half (50%) of EB benefit costs through their SUTA  On March 7, 2019, Representative Karen Bass introduced H R  1585 , the Violence Against Women Reauthorization Act of 2019  Among many other provisions, Section 703 of H R  1585 would require states to consider an individual who quit employment because of sexual harassment, domestic violence, sexual assault, or stalking to be eligible for UC benefits  The House passed H R  1585 on April 4, 2019  On March 14, 2019, Representative Stephanie Murphy introduced H R  1759 , the Building on Reemployment Improvements to Deliver Good Employment (BRIDGE) for Workers Act  This proposal would extend eligibility to any claimant of unemployment benefits, including those profiled as likely to exhaust benefits (rather than limiting eligibility to those who were profiled as likely to exhaust benefits)  The House passed H R  1759 on April 9, 2019 

ground_truth: Federal agencies are dependent on information systems to carry out operations. The risks to these systems are increasing as security threats evolve and become more sophisticated. To reduce the risk of a successful cyberattack, agencies can deploy intrusion detection and prevention capabilities on their networks and systems. GAO first designated federal information security as a government-wide high-risk area in 1997. In 2015, GAO expanded this area to include protecting the privacy of personally identifiable information. Most recently, in September 2018, GAO updated the area to identify 10 critical actions that the federal government and other entities need to take to address major cybersecurity challenges. The federal approach and strategy for securing information systems is grounded in the provisions of the Federal Information Security Modernization Act of 2014 and Executive Order 13800. The act requires agencies to develop, document, and implement an agency-wide program to secure their information systems. The Executive Order, issued in May 2017, directs agencies to use the National Institute of Standards and Technology's cybersecurity framework to manage cybersecurity risks. The Federal Cybersecurity Enhancement Act of 2015 contained a provision for GAO to report on the effectiveness of the government's approach and strategy for securing its systems. GAO determined (1) the reported effectiveness of agencies' implementation of the government's approach and strategy; (2) the extent to which DHS and OMB have taken steps to facilitate the use of intrusion detection and prevention capabilities to secure federal systems; and (3) the extent to which agencies reported implementing capabilities to detect and prevent intrusions. To address these objectives, GAO analyzed OMB reports related to agencies' information security practices including OMB's annual report to Congress for fiscal year 2017. GAO also analyzed and summarized agency-reported security performance metrics and IG-reported information for the 23 civilian CFO Act agencies. In addition, GAO evaluated plans, reports, and other documents related to DHS intrusion detection and prevention programs, and interviewed OMB, DHS, and agency officials. The 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act) have often not effectively implemented the federal government's approach and strategy for securing information systems (see figure below). Until agencies more effectively implement the government's approach and strategy, federal systems will remain at risk. To illustrate: As required by Office of Management and Budget (OMB), inspectors general (IGs) evaluated the maturity of their agencies' information security programs using performance measures associated with the five core security functions—identify, protect, detect, respond, and recover. The IGs at 17 of the 23 agencies reported that their agencies' programs were not effectively implemented. IGs also evaluated information security controls as part of the annual audit of their agencies' financial statements, identifying material weaknesses or significant deficiencies in internal controls for financial reporting at 17 of the 23 civilian CFO Act agencies. Chief information officers (CIOs) for 17 of the 23 agencies reported not meeting all elements of the government's cybersecurity cross-agency priority goal. The goal was intended to improve cybersecurity performance through, among other things, maintaining ongoing awareness of information security, vulnerabilities, and threats; and implementing technologies and processes that reduce malware risk. Executive Order 13800 directed OMB, in coordination with the Department of Homeland Security (DHS), to assess and report on the sufficiency and appropriateness of federal agencies' processes for managing cybersecurity risks. Using performance measures for each of the five core security functions, OMB determined that 13 of the 23 agencies were managing overall enterprise risks, while the other 10 agencies were at risk. In assessing agency risk by core security function, OMB identified a few agencies to be at high risk (see figure at the top of next page). DHS and OMB facilitated the use of intrusion detection and prevention capabilities to secure federal agency systems, but further efforts remain. For example, in response to prior GAO recommendations, DHS had improved the capabilities of the National Cybersecurity Protection System (NCPS), which is intended to detect and prevent malicious traffic from entering agencies' computer networks. However, the system still had limitations, such as not having the capability to scan encrypted traffic. The department was also in the process of enhancing the capabilities of federal agencies to automate network monitoring for malicious activity through its Continuous Diagnostics and Mitigation (CDM) program. However, the program was running behind schedule and officials at most agencies indicated the need for additional training and guidance. Further, the Federal CIO issued a mandated report assessing agencies' intrusion detection and prevention capabilities, but the report did not address required information, such as the capability of NCPS to detect advanced persistent threats, and a cost/benefit comparison of capabilities to commercial technologies and tools. Selected agencies had not consistently implemented capabilities to detect and prevent intrusions into their computer networks. Specifically, the agencies told GAO that they had not fully implemented required actions for protecting email, cloud services, host-based systems, and network traffic from malicious activity. For example, 21 of 23 agencies had not, as of September 2018, sufficiently enhanced email protection through implementation of DHS' directive on enhanced email security. In addition, less than half of the agencies that use cloud services reported monitoring these services. Further, most of the selected 23 agencies had not fully implemented the tools and services available through the first two phases of DHS's CDM program. Until agencies more thoroughly implement capabilities to detect and prevent intrusions, federal systems and the information they process will be vulnerable to malicious threats. GAO is making two recommendations to DHS, to among other things, coordinate with agencies to identify additional needs for training and guidance. GAO is also making seven recommendations to OMB to, among other things, direct the Federal CIO to update the mandated report with required information, such as detecting advanced persistent threats. DHS concurred with GAO's recommendations. OMB did not indicate whether it concurred with the recommendations or not.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Cybersecurity incidents continue to impact federal entities and the information they maintain  According to OMB’s 2018 annual FISMA report to Congress, agencies reported 35,277 information security incidents to DHS’s U S  Computer Emergency Readiness Team (US-CERT) in fiscal year 2017  As shown in figure 1, these incidents involved threat vectors, such as web-based attacks, phishing attacks, and the loss or theft of computer equipment, among others  These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security  The following examples highlight the impact of such incidents: In March 2018, the Department of Justice reported that it had indicted nine Iranians for conducting a massive cybersecurity theft campaign on behalf of the Islamic Revolutionary Guard Corps  According to the department, the Iranians allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 U S  companies, and 5 federal government agencies, among other entities  In March 2018, a joint alert from DHS and the Federal Bureau of Investigation stated that, since at least March 2016, Russian government actors had targeted U S  government entities and critical infrastructure sectors, including the energy, nuclear, water, aviation, and critical manufacturing sectors  In June 2015, the Office of Personnel Management reported that an intrusion into its systems had affected the personnel records of about 4 2 million current and former federal employees  Then, in July 2015, the agency reported that a separate but related incident had compromised its systems and the files related to background investigations for at least 21 5 million individuals  The federal approach and strategy for securing information systems is prescribed by federal law and policy  FISMA sets requirements for effectively securing federal systems and information  In addition, the Federal Cybersecurity Enhancement Act of 2015 requires protecting federal networks through the use of federal intrusion prevention and detection capabilities  Further, Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, directs agencies to manage cybersecurity risks to the federal enterprise by, among other things, using the NIST Framework for Improving Critical Infrastructure Cybersecurity (cybersecurity framework)  FISMA was enacted to improve federal cybersecurity and clarify government-wide responsibilities  The law is intended to provide for improved oversight of federal agencies’ information security programs  Specifically, the law provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets  The law is also intended to ensure the effective oversight of information security risks, including those throughout civilian, national security, and law enforcement agencies  FISMA assigns OMB and DHS oversight roles in ensuring federal agencies’ compliance with the law  Among other things, FISMA requires OMB to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies, except with regard to national security systems  The law also assigns OMB the responsibility of requiring agencies to identify and provide information security protections commensurate with assessments of risk to their information and information systems  The law further requires DHS to administer the implementation of agency information security policies and practices for non-national security information systems, in consultation with OMB, by developing, issuing, and overseeing implementation of binding operational directives; monitoring agency implementation of information security policies and practices; and convening meetings with senior agency officials to help ensure their effective implementation of information security policies and practices, among other things  FISMA assigned to NIST the responsibility for developing standards and guidelines that include minimum information security requirements  To this end, NIST has issued several publications to provide guidance for agencies in implementing an information security program  For example, NIST Special Publication (SP) 800-53 provides guidance to agencies on the selection and implementation of information security and privacy controls for systems  FISMA also assigns to the head of each executive branch agency, responsibility for providing information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency  The law also delegates to the agency chief information officer (CIO), or comparable official, the authority to ensure compliance with FISMA requirements  The CIO is responsible for designating a senior agency information security officer whose primary duty is information security  In addition, the law requires agencies to develop, document, and implement an agency-wide information security program to secure federal information systems  Specifically, these information security programs are to provide risk-based protections for the information and information systems that support the operations and assets of the agency  Further, FISMA requires agencies to comply with DHS binding operational directives, OMB policies and procedures, and NIST federal information processing standards  FISMA also has reporting requirements for OMB and federal agencies  Specifically, OMB is to report annually, in consultation with DHS, on the effectiveness of agency information security policies and practices, including a summary of major agency information security incidents and an assessment of agency compliance with NIST standards  Further, the law requires agencies to report annually to OMB, DHS, certain congressional committees, and the Comptroller General of the United States on the adequacy and effectiveness of their information security policies, procedures, and practices, as well as their compliance with FISMA  The Federal Cybersecurity Enhancement Act of 2015, among other things, sets forth authority for enhancing federal intrusion prevention and detection capabilities among federal entities  The act contains several provisions for DHS and OMB  Specifically, the act requires that DHS deploy, operate, and maintain capabilities to prevent and detect cybersecurity risks in network traffic traveling to or from an agency’s information system  DHS is to make these capabilities available for use by any agency  In addition, the act requires DHS to improve intrusion detection and prevention capabilities, as appropriate, by regularly deploying new technologies and modifying existing technologies  The act also requires OMB and DHS, in consultation with appropriate agencies, to review and update government-wide policies and programs to ensure appropriate prioritization and use of network security monitoring tools within agency networks, and to brief appropriate congressional committees  In May 2017, the President signed Executive Order 13800, which sets policy for managing cybersecurity risk as an executive branch enterprise  Specifically, it outlines actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cybersecurity threats  To this end, the order states that the President will hold executive agency heads accountable for managing agency-wide cybersecurity risk and directs each executive agency to use the NIST cybersecurity framework to manage those risks  The cybersecurity framework, which provides guidance for cybersecurity activities, is based on five core security functions: Identify: Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities  Protect: Develop and implement appropriate safeguards to ensure delivery of critical services  Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event  Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident  Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services that were impaired due to a cybersecurity incident  According to NIST, these five functions should be performed concurrently and continuously to address cybersecurity risk  In addition, when considered together, they provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk  Within the five functions are 23 categories and 108 subcategories that include controls for achieving the intent of each function  Appendix II provides a description of the cybersecurity framework categories and subcategories of controls  In February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government, as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector  However, we noted that no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy  These characteristics would include, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  For example, in September 2018, we reported that recent executive branch initiatives that identify cybersecurity priorities for the federal government provide a good foundation toward establishing a more comprehensive strategy  Nevertheless, we pointed out that additional efforts were needed to address all of the desirable characteristics of a national strategy that we recommended  Specifically, recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  For example, these strategy documents did not generally include: milestones and performance measures to gauge results; resources needed to carry out the goals and objectives; and clearly defined roles and responsibilities for key agencies, such as DHS, the Department of Defense, and OMB  Ultimately, we determined that a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  Subsequent to our September 2018 report, the President issued the National Cyber Strategy on September 20, 2018  The strategy builds upon Executive Order 13800 and describes actions that federal agencies and the administration are to take to, among other things, secure federal information systems  For example, the strategy states that the administration is expected to further enable DHS to secure federal department and agency networks, to include ensuring that DHS has appropriate access to agency information systems for cybersecurity purposes and can take and direct action to safeguard systems  In addition, the strategy states that the administration plans to continue with its existing efforts underway to transition agencies to shared services and infrastructure and that DHS is to have appropriate visibility into those services and infrastructure to improve cybersecurity posture  DHS’s Network Security Deployment (NSD) division manages cybersecurity programs that are intended to improve the cybersecurity posture of the federal government  Among these programs, NCPS provides a capability to detect and prevent potentially malicious network traffic from entering agencies’ networks  In addition, the Continuous Diagnostics and Mitigation (CDM) program provides tools to agencies intended to identify and resolve cyber vulnerabilities on an ongoing basis  Operated by DHS’s US-CERT, NCPS is intended to detect and prevent cyber intrusions into agency networks, analyze network data for trends and anomalous data, and share information with agencies on cyber threats and incidents  Deployed in stages, this system, operationally known as EINSTEIN, has provided increasing capabilities to detect and prevent potential cyberattacks involving the network traffic entering or exiting the networks of participating federal agencies  Table 1 provides an overview of the EINSTEIN deployment stages to date  In January 2016, we reported the projected total life-cycle cost of the program was approximately $5 7 billion through fiscal year 2018  In addition, according to the Federal CIO, Congress appropriated $468 million in fiscal year 2017 and $402 million in fiscal year 2018 for NCPS  In that report, we also noted that NCPS was partially, but not fully, meeting most of its stated system objectives  Although the system’s intrusion detection capabilities provided the ability to detect known patterns of malicious activity on agency networks, it was limited in its capabilities to identify potential threats using anomaly-based detection  We also reported that although DHS had developed metrics for measuring the performance of NCPS, the metrics did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities  The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers  Further, DHS had not considered specific vulnerability information for agency information systems in making risk- based decisions about future intrusion prevention capabilities  Accordingly, we made nine recommendations to DHS to, among other things, enhance the NCPS capabilities for meeting its objectives and better define requirements for future capabilities  DHS agreed with each of our nine recommendations and indicated that it would take steps to address them  DHS’s CDM program provides federal agencies with tools and services that have the intended capability to automate network monitoring, correlate and analyze security-related information, and enhance risk- based decision making at agency and government-wide levels  These tools include sensors that perform automated scans or searches for known cyber vulnerabilities, the results of which can feed into a dashboard that, at an agency level, is intended to alert network managers and enable the agency to allocate resources based on the risk  Summary data from each participating agency’s dashboard is expected to be transmitted to the Federal Dashboard where the data can be used to inform decisions about cybersecurity risks across the federal government  There are four phases of CDM implementation: Phase 1—involves deploying products to automate hardware and software asset management, configuration settings, and common vulnerability management capabilities  According to the Cybersecurity Strategy and Implementation Plan, DHS purchased phase 1 tools and integration services for all participating agencies in fiscal year 2015  DHS plans to have all phase 1 tools deployed at participating agencies by the end of the second quarter of fiscal year 2019  Phase 2—intends to address privilege management and infrastructure integrity by allowing agencies to monitor users on their networks and to detect whether users are engaging in unauthorized activity  According to the Cybersecurity Strategy and Implementation Plan, DHS was to provide agencies with additional phase 2 capabilities throughout fiscal year 2016, with the full suite of CDM phase 2 capabilities delivered by the end of that fiscal year  However, according to the OMB FISMA Annual Report to Congress for Fiscal Year 2017, the CDM program began deploying Phase 2 tools and sensors during fiscal year 2017  DHS plans to have all phase 2 tools deployed at participating agencies by the end of fiscal year 2019  Phase 3—includes detection capabilities that are intended to assess agency network activity and identify any anomalies that may indicate a cybersecurity compromise  Full operating capability for phases 1, 2, and 3 is planned to be achieved by the end of fiscal year 2022  Phase 4—intends to provide tools to (1) protect data at rest, in transit, and in use; (2) prevent loss of data; and (3) manage and mitigate data breaches  According to CDM program officials, phase 4 has not been approved and no tools have been selected  An approach for protecting systems against cybersecurity compromise is for federal agencies to build successive layers of defense mechanisms at strategic points in their information technology infrastructures  This approach, commonly referred to as defense in depth, entails implementing a series of protective mechanisms so that if one mechanism fails to detect and prevent an attack, another will provide a backup defense  By utilizing defense in depth, federal agencies can reduce the risk of a successful cyberattack by implementing intrusion detection and prevention capabilities  NIST has developed guidelines for protecting agency information systems using intrusion detection and prevention capabilities  For example, NIST SP 800-53 recommends that agencies strategically deploy capabilities and perform monitoring of their systems to include observation of events occurring on their network and at the external boundary of their network  In addition, NIST SP 800-94 provides agencies with guidance in designing, implementing, configuring, securing, monitoring, and maintaining such capabilities  As part of their defense-in-depth approach and, as recommended by the NIST guidelines, agencies can deploy the following list of capabilities, among others, on their networks to detect and prevent an attack: Protecting email from intrusions: According to OMB, email, by way of phishing attacks, remains one of the most common threat vectors across the government  Methods for protecting email include encryption, false email alerts, and anti-spear-phishing training  Monitoring cloud services: Cloud vendors provide services to agencies, including Software as a Service, Platform as a Service, and Infrastructure as a Service  As agencies increasingly rely on cloud services, monitoring traffic to and from their cloud service providers helps to ensure that agencies detect malicious traffic  Using host-based intrusion prevention: Host-based intrusion prevention systems provide defense at an individual system or device level by protecting against malicious activities  Host-based capabilities include memory-based protection and application whitelisting  Monitoring external and internal traffic: Agencies can monitor external and internal traffic, including: encrypted traffic, traffic between workstations and servers on the network, and direct connections to outside entities such as universities  Monitoring traffic helps to ensure that agencies detect malicious activity  Using security information and event management: A security information and event management capability produces real-time alerts and notifications of significant security events  Security alerts and notifications can provide the agency with better situational awareness regarding possible intrusion activity  According to inspectors general, agency CIOs, and OMB reports on federal information security practices, many agencies were not effectively implementing the federal government’s approach and strategy to securing information systems as of fiscal year 2017  Agencies’ inspectors general determined that most of the 23 civilian CFO Act agencies did not have effective agency-wide information security programs  They also reported that agencies did not have effective information security controls in place, leading to deficiencies in internal control over financial reporting  In addition, the CIOs demonstrated that, during fiscal years 2016 and 2017, most agencies had not met all targets for the cybersecurity CAP goal for improving cybersecurity performance  Further, based on FISMA metrics reported for fiscal year 2017, OMB determined that 13 of the 23 agencies were managing risks to their enterprise, while the other 10 agencies were at risk of ineffectively identifying, protecting, detecting, responding to, and if necessary, recovering from cyber intrusions  Figure 2 summarizes agencies’ efforts to implement the government’s approach and strategy for securing information systems as of fiscal year 2017  Appendix III includes a table that provides an additional overview of the effectiveness of each agency’s implementation of the government’s approach and strategy to securing information systems  Inspectors general determined that more than half of the 23 civilian CFO Act agencies did not have effective agency-wide information security programs as of fiscal year 2017  Further, in agency financial statement audit reports for fiscal year 2017, inspectors general reported that, despite improvements being made in information security practices, most of the civilian CFO Act agencies continued to exhibit deficiencies in information security controls  As a result of these deficiencies, inspectors general reported material weaknesses or significant deficiencies in internal control over financial reporting  FISMA requires inspectors general to determine the effectiveness of their respective agencies’ information security programs  To do so, FISMA reporting instructions direct inspectors general to provide a maturity rating for agency information security policies, procedures, and practices related to the five core security functions established in the NIST cybersecurity framework, as well as for the agency-wide information security program  The ratings used to evaluate the effectiveness of agencies’ information security programs are based on a five-level maturity model, as described in table 2  According to this maturity model, Level 4 (managed and measurable) represents an effective level of security  Therefore, if an inspector general rates the agency’s information security program at Level 4 or Level 5, then that agency is considered to have an effective information security program  For fiscal year 2017, the inspectors general for 6 of the 23 civilian CFO Act agencies reported that their agencies had an effective agency-wide information security program  More specifically, for the 5 core security functions, most inspectors general reported that their agency was at Level 3 (consistently implemented) for the identify, protect, and recover functions, and at Level 2 (defined) for the detect and respond functions, as shown in figure 3  Inspectors general report on the effectiveness of agencies’ information security controls as part of the annual audits of the agencies’ financial statements  The reports resulting from these audits include a description of information security control deficiencies related to the five major control categories defined by the Federal Information System Controls Audit Manual (FISCAM)—access controls, configuration management, segregation of duties, contingency planning, and security management  The reports also identify the inspectors general’s designation of information security as a significant deficiency or material weakness in internal control over financial reporting systems  For fiscal year 2017, inspectors general continued to identify information security control deficiencies in each of the five major control categories across the 23 civilian CFO Act agencies  The number of agencies with deficiencies in the access control and contingency planning information security control categories decreased between fiscal years 2016 and 2017, according to the inspectors general  Nevertheless, the inspectors general reported that agencies continued to exhibit deficiencies in these two control categories  In addition, the number of agencies with deficiencies in the security management and segregation of duties control categories increased from the prior year  The number of agencies reported as having deficiencies in the configuration management control category remained the same  Figure 4 shows the number of agencies that reported deficiencies in each of the information security control categories for fiscal years 2016 and 2017  Overall, inspectors general for the 23 civilian CFO Act agencies reported progress in agencies’ information security practices for fiscal year 2017  Specifically, during that time, 17 inspectors general designated information security as either a significant deficiency (11) or material weakness (6) in internal control over financial reporting systems for their agencies  This is a decrease from the previous fiscal year when 19 inspectors general designated information security as a significant deficiency (12) or material weakness (7)  Reporting instructions contained in the fiscal year 2017 FISMA metrics directed CIOs to assess their agencies’ progress toward achieving outcomes that strengthen federal cybersecurity  To do this, CIOs evaluated their agencies’ performance in reaching targets for specific FISMA reporting metrics  According to the reporting instructions, certain metrics were selected to represent the administration’s cybersecurity CAP goal  These selected metrics allowed CIOs to evaluate their agencies progress in meeting targets for that goal  The cybersecurity CAP goal for fiscal years 2015 through 2017 was to improve cybersecurity performance by having an ongoing awareness of information security, vulnerabilities, and threats impacting the operating information environment; ensuring that only authorized users have access to resources and information; and implementing technologies and processes that reduce the risk of malware  The cybersecurity CAP goal consisted of three priority areas with a total of nine performance indicators  Each of the nine performance indicators had an expected level of performance, or target, for implementation  Table 3 shows the three priority areas and related performance indicators and targets of the cybersecurity CAP goal for fiscal years 2015 through 2017  According to agency CIO assessments for fiscal year 2017, 6 of the 23 agencies met all 9 targets for the cybersecurity CAP goal  More specifically, 8 agencies met all four targets for the information security continuous 16 agencies met the two targets for the identity, credential, and access management priority area; and 17 agencies met all three targets for the anti-phishing and malware defense priority area  In addition, CIOs reported that agencies were making progress in meeting the targets for the nine performance indicators for fiscal years 2016 and 2017, with increases in the number of agencies meeting the targets within each of the three priority areas  However, although the number of agencies that met the targets in individual priority areas showed a net increase, not all agencies maintained their status  For example, the CIO for one agency reported meeting all three targets for the anti-phishing and malware defense priority area in fiscal year 2016, but reported that the agency only met two of the three targets in fiscal year 2017  Figure 5 shows the number of agencies that reported meeting each of the targets within the individual cybersecurity CAP goal priority areas for fiscal years 2016 and 2017  Although the CIOs for only six agencies reported meeting each of the targets associated with all nine performance indicators for the three cybersecurity CAP goal priority areas, the CIOs at an additional eight agencies reported meeting each target for two of the three priority areas  Specifically, one CIO reported that its agency met each of the targets for the (1) information security continuous monitoring and (2) identity, credential, and access management priority areas; another CIO reported that its agency met each of the targets for the (1) information security continuous monitoring and (2) anti-phishing and malware defense priority areas; and the CIOs at six other agencies met each of the targets for the (1) identity, credential, and access management and (2) anti-phishing and malware defense priority areas  In fiscal year 2018, the President’s Management Agenda replaced the three cybersecurity-focused CAP goal priority areas with updated performance indicators, most of which are to be met by 2020: 1  the manage asset security priority area is similar to the information security continuous monitoring priority area from the previous CAP goal and has a focus on understanding the assets and users on agency networks  In addition to hardware asset and software asset management, this priority area includes performance indicators for authorization and mobile device management  2  the limit personnel access priority area focuses on issues of access management  This area includes performance indicators for using automated access management and managing access for privileged network and high-impact system users  The privileged network access management performance indicator is a continuation of the identity, credential, and access management priority area of the previous cybersecurity CAP goal  Therefore, agencies are expected to complete this metric by the end of the fiscal year 2018 FISMA reporting year  3  the protect networks and data priority area, which is similar to the anti-phishing and malware defense priority area from the previous cybersecurity CAP goal, has three new performance indicators: intrusion detection and prevention, exfiltration and enhanced defenses, and data protection  Appendix IV describes the updated cybersecurity-focused CAP priority areas and performance indicators in more detail  In Executive Order 13800, the President directed OMB, in coordination with DHS, to assess and report to the executive branch on the sufficiency and appropriateness of federal agencies’ processes for managing cybersecurity risks  For these risk management assessments, OMB leveraged the FISMA metrics reported by agency CIOs and inspectors general for fiscal year 2017  The metrics addressed domains that correspond with the five core security functions identified in the cybersecurity framework  Table 4 lists these domains and their relationship to the core functions  Based on OMB’s evaluation of these domains, agency risk management processes related to the five core security functions and overall agency enterprise fell into one of the following three rating categories: managing risk: required cybersecurity policies, procedures, and tools are in use and the agency actively manages cybersecurity risks; at risk: some essential policies, processes, and tools are in place to mitigate overall cybersecurity risk, but significant gaps remain; and high risk: key fundamental cybersecurity policies, processes, and tools are either not in place or not deployed sufficiently  For fiscal year 2017, OMB reported that not all agencies were managing risk  When considering each of the five core security functions, OMB reported that most of the 23 agencies were at risk or at high risk with regard to the identify and protect core security functions  Less than half of the 23 agencies were at risk with regard to the detect, respond, and recover core security functions  Overall, OMB determined that 13 agencies were managing risk and that the remaining 10 agencies were at risk of not effectively identifying, protecting, detecting, responding to, and if necessary, recovering from cyber intrusions  Figure 6 shows OMB’s risk management assessment ratings by core security function across the 23 agencies for fiscal year 2017  DHS and OMB, as required by law and policy, have taken various actions to facilitate the agencies’ use of intrusion detection and prevention capabilities to secure federal systems  For example, DHS has developed an intrusion assessment plan, deployed NCPS to offer intrusion detection and prevention capabilities to agencies, and is providing tools and services to agencies to monitor their networks through its CDM program  However, NCPS still had limitations in detecting certain types of traffic and agencies were not sending all appropriate traffic through the system  Further, CDM was behind at meeting planned implementation dates, and agencies have requested additional training and guidance for these services  OMB has taken steps to improve upon agencies’ capabilities, but has not completed a policy and strategy to do so, or fully reported on its assessment of agencies’ capabilities  The Federal Cybersecurity Enhancement Act of 2015 requires DHS, in coordination with OMB, to develop and implement an intrusion assessment plan to proactively detect, identify, and remove intruders in agency information systems on a routine basis  The act also requires that the plan be updated, as necessary  In December 2016, DHS documented its Intrusion Assessment Plan  In the plan, DHS outlined tools, platforms, resources, and ongoing work that the department provides, and that are intended to help agencies detect, identify, and remove intruders on their networks and systems  The intrusion assessment plan also outlines a defense-in-depth strategy, which utilizes multiple layers of cybersecurity and deploys multiple capabilities in combination, to secure agencies’ networks and information systems  For example, the plan calls for DHS to implement NCPS to provide a perimeter defense for the networks of federal civilian executive branch agencies, while the agencies are to deploy their own intrusion detection and prevention capabilities inside their networks  DHS submitted its intrusion assessment plan to OMB in January 2017  The Federal Cybersecurity Enhancement Act of 2015 also requires DHS to deploy, operate, and maintain a capability to detect cybersecurity risks and prevent network traffic associated with such risks from transiting to or from an agency information system  In addition, the act requires that DHS make regular improvements to intrusion detection and prevention capabilities by deploying new technologies and modifying existing technologies  Further, the act requires agencies to use this capability on all information traveling between their information systems and any information system other than an agency information system  DHS developed NCPS, operationally known as EINSTEIN, to provide the capabilities to detect and prevent potentially malicious network traffic from entering agency networks  Consistent with recommendations we made to DHS in January 2016, DHS has taken actions to improve these capabilities and has other actions underway  For example, the department determined that enhancing NCPS’s current intrusion detection approach to include functionality that would detect deviations from normal network behavior baselines would be feasible  In addition, according to DHS officials, the department was operationalizing functionality intended to identify malicious activity in network traffic otherwise missed by signature-based methods  determined that developing enhancements to current intrusion detection capabilities to facilitate the scanning of Internet Protocol Version 6 (IPv6) traffic would be feasible  According to DHS officials, the department has developed plans to fully support IPv6 for several of its NCPS intrusion detection capabilities  Further, the department has developed implementation schedules and begun roll-out of the enhancements  updated the tool it uses to manage and deploy intrusion detection signatures to include a mechanism to clearly link signatures to publicly available, open-source information  developed clearly defined requirements for detecting threats on agency internal networks and at cloud service providers to help better ensure effective support of information security activities  According to DHS officials, the department was also continuing pilot activities with cloud service providers to enhance protections of agency assets  developed processes and procedures for using vulnerability information, such as data from the CDM program as it becomes available, to help ensure the department is using a risk-based approach for the selection/development of future NCPS intrusion prevention capabilities  Nevertheless, NCPS continues to have known limitations in its ability to identify potential threats  For example: NCPS does not have the ability to effectively detect intrusions across multiple types of traffic  Specifically, DHS determined that developing enhancements to current intrusion detection capabilities to facilitate the scanning of traffic related to supervisory control and data acquisition (SCADA) control systems would not be feasible  However, according to DHS officials, the department is exploring capabilities that are intended to provide critical, cross-sector, real-time visibility into critical infrastructure companies that utilize SCADA systems  In addition, DHS determined that the scanning of encrypted traffic would not be feasible  Nevertheless, according to its officials, the department performed research on potential architectural, technical, and policy mitigation strategies that could provide both the protection and situational awareness for encrypted traffic  The department has actions under way to continue its research in this area  DHS does not always explicitly ask agencies for feedback or confirmation of receipt of NCPS-related notification  While the department had drafted a standard operating procedure related to its incident notification process, the policy did not instruct DHS analysts specifically to include a solicitation of feedback from agencies within the notification  Further, US-CERT could not provide any information regarding the timetable for when these procedures would take effect  Metrics for NCPS, as provided by DHS, do not provide information about how well the system is enhancing government information security or the quality, efficiency and accuracy of supporting actions  Without the deployment of comprehensive measures, DHS cannot appropriately articulate the value provided by NCPS  While the department had taken actions to develop new measures, these measures did not provide a qualitative or quantitative assessment of the system’s ability to fulfill the system’s objectives  NSD did not provide guidance to agencies on how to securely route their information to their Internet service providers  Without providing network routing guidance, NSD has no assurance that the traffic it sees constitutes all or only a subset of the traffic the customer agencies intend to send  As shown in table 5, as of October 2018, the department had implemented five of the nine recommendations and was in the process of implementing the remainder  However, until DHS completes implementation of the remaining recommendations, the effectiveness of NCPS’s intrusion detection and prevention capabilities may be hindered  In addition, the 23 civilian CFO Act agencies had implemented NCPS capabilities to varying degrees  In a March 2018 report, OMB reported that 21 (about 91 percent) of the 23 agencies had implemented the first two iterations of the NCPS capabilities  In addition, 15 (about 65 percent) of the 23 agencies had implemented all three NCPS capabilities, as shown in table 6 below  However, agencies did not route all network traffic for all information traveling between their information systems and any information system other than an agency information system through NCPS sensors  For example, officials at 13 of 23 agencies stated that not all of their agency external network traffic flowed through NCPS  To illustrate, officials at one agency estimated that 20 percent of their external network traffic did not flow through the system  In addition, 4 of the agencies in our review previously cited several challenges in routing all of their traffic through NCPS intrusion detection sensors, including capacity limitations of the sensors, agreements with external business partners that use direct network connections, interagency network connections that do not route through Internet gateways, use of encrypted communications mechanisms, and backup network circuits that are not used regularly  NSD officials stated that agencies are responsible for routing their traffic to the intrusion detection sensors, and DHS does not have a role in that aspect of NCPS implementation  As a result, potential cyberattacks may not be detected or prevented for a portion of the external traffic at federal agencies  As noted above, we previously recommended that DHS work with agencies to better ensure the complete routing of information to NCPS sensors  The Federal Cybersecurity Enhancement Act of 2015 requires DHS to include, in the efforts of the department to continuously diagnose and mitigate cybersecurity risks, advanced network security tools to improve the visibility of network activity and to detect and mitigate intrusions and anomalous activity  According to DHS officials, the department is addressing the requirement to improve the visibility of network activity by including advanced network security tools as a part of CDM phase 3  In April 2018, we testified that DHS had previously planned to provide 97 percent of federal agencies with the services they needed for CDM phase 3 in fiscal year 2017  In addition, according to OMB’s annual FISMA report for fiscal year 2017, the CDM program was to continue to incorporate additional capabilities, including phase 3, in fiscal year 2018  However, DHS now expects initial operational capabilities to be in place for phase 3 in fiscal year 2019  The department has awarded contracts of approximately $3 26 billion to support its Dynamic and Evolving Federal Enterprise Network Defense (also known as DEFEND) aspect of the CDM program, which is to include phase 3  DEFEND also is to provide coverage for existing agency deployments  According to DHS documentation, the task orders associated with DEFEND are to be issued between the second quarter of fiscal year 2018 and the second quarter of fiscal year 2024  FISMA requires that DHS provide operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security  Toward this end, DHS has available training and guidance related to the implementation of the capabilities of NCPS (i e , EINSTEIN) and CDM  Specifically: According the DHS officials, the department offers training and guidance to agencies on EINSTEIN 1 implementation  For example, DHS established a program in which the Software Engineering Institute will provide training and mentoring to agencies looking to enhance their understanding of, and proficiency with, the EINSTEIN 1 capability (e g , network traffic information)  NCPS program officials stated that agencies can use this service, which is available at no charge to them, on an unlimited basis as long as the requests relate to EINSTEIN 1  According to the officials, training and guidance related to EINSTEIN 2 and EINSTEIN 3 Accelerated is limited because DHS intentionally restricts the amount of data provided to agencies  According to DHS officials, the department also offers training and guidance to assist agencies with the implementation and use of resources associated with the CDM program, including webinars, guides, and computer-based training  The DEFEND contracts that the department awarded also include a mechanism for agencies to procure specialized tailored training, such as on the use of CDM tools  The department also offers customer advisory forums every other month that agencies are invited to attend  According to CDM program officials, the program’s governance, among other topics, is commonly discussed during these forums  Further, the department provides agencies with guidance, such as various governance documents, best practices, and frequently asked questions, through a web portal that is made available by OMB  In addition, US-CERT offers the CDM training program, which is to provide CDM implementation resources  Nevertheless, most agencies told us that they wanted DHS to provide more training and guidance as it relates to their implementation of the capabilities made available by NCPS and CDM  Specifically, Officials from 16 of 23 agencies reported that they wanted to receive additional training on NCPS capabilities  For example, officials at 5 agencies stated that they would like to receive training related to using network traffic information, understanding alerts, or implementing capabilities for cloud services  The officials also stated that they wanted training specific to agency security personnel  Officials from 19 of 23 agencies stated that they wanted to receive additional guidance related to NCPS’s capabilities, but not all of the 19 provided specific details  For example, officials from at least 3 agencies stated that they wanted additional guidance such as, “how to” documents, descriptions of architecture details, or guidance documents that explain NCPS’s capabilities so that agencies can gauge the gap between the security that the system provides and the security being provided by their own agency’s capabilities  Officials from 21 of 23 agencies reported that they wanted to receive additional training on implementing CDM at their agencies  For example, officials from 7 agencies suggested that additional training on the use of the tools would be beneficial  Officials from 22 of 23 agencies stated that they wanted additional guidance as it relates to CDM implementation  For example, officials from one agency stated that they would like examples of best practices and successful deployments  These requests for additional training and guidance demonstrate that agencies are either unaware of the available training and guidance, or that the training may not meet their needs  Until DHS coordinates with agencies to determine if additional training and guidance are needed, agencies may not be able to fully realize the benefits of the capabilities provided by the NCPS and CDM programs  Although OMB took steps to report on agencies’ implementation of intrusion detection and prevention capabilities, it did not report on all required actions  For example, the office did not submit DHS’s intrusion plan to Congress as required by the Federal Cybersecurity Enhancement Act of 2015  In addition, OMB provided various reports to Congress that described agencies’ intrusion detection and prevention capabilities, but the reports did not always include all information required by the act  Further, OMB developed a draft policy and strategy that were intended to improve agency capabilities, but it had not finalized these documents  The Federal Cybersecurity Enhancement Act of 2015 requires OMB to submit the intrusion assessment plan developed by DHS to the appropriate congressional committees no later than 6 months after the date of enactment of the act  The act also required OMB to submit to Congress a description of the implementation of the intrusion assessment plan and the findings of the intrusion assessments conducted pursuant to the intrusion assessment plan no later than 1 year after the date of enactment of the act, and annually thereafter  Although DHS developed and documented an intrusion assessment plan, which described a defense-in-depth approach to security, OMB did not submit the plan to Congress, as called for in the act  Even though DHS submitted the plan to OMB in January 2017, OMB had not submitted it to Congress as of October 2018 (21 months after DHS submitted the plan and 28 months past the due date)  On the other hand, OMB did submit its own reports to Congress which generally described elements of the implementation of DHS’s intrusion assessment plan and intrusion assessment findings  In September 2017, OMB issued its analysis of agencies’ implementation of intrusion detection and prevention capabilities, or more specifically, agencies’ implementation of the various versions of NCPS  In addition, the office’s annual FISMA report, issued most recently in March 2018, generally covered elements of the intrusion assessment plan  OMB personnel within the Office of the Federal CIO believed that these two reports, along with a process the office had initiated to validate incidents across the government, addressed the requirement for OMB to submit to Congress a description of the implementation of the intrusion assessment plan and the findings of the intrusion assessments conducted pursuant to the plan  However, the September 2017 and March 2018 reports did not address other elements described in DHS’s intrusion assessment plan  For example, OMB did not describe agency roles associated with segmenting their networks, identifying key servers based on threat and impact, ensuring all applications are appropriately tracked and configured, and categorizing and tagging data based on threat and impact  While OMB has provided important information to congressional stakeholders through its own reports, until it submits the plan and addresses all elements described in DHS’s intrusion assessment plan, it will continue to be remiss in providing timely and sufficiently detailed information regarding the intrusion assessment plan to congressional stakeholders to support their oversight responsibilities  The Federal Cybersecurity Enhancement Act of 2015 also required that OMB submit an analysis of agencies’ application of the intrusion detection and prevention capabilities to Congress no later than 18 months after the date of enactment of the act, and annually thereafter  OMB was to include a list of federal agencies and the degree to which each agency had applied the intrusion detection and prevention capabilities in this analysis  As discussed previously in this report, OMB issued its analysis of agencies’ implementation of intrusion detection and prevention capabilities in September 2017  However, the analysis did not include the degree to which agencies had applied the intrusion detection and prevention capabilities  For example, the analysis did not reflect that not all agencies were using this capability on all information traveling between their systems and any system other than an agency system, as required by the act  Until OMB includes the degree to which agencies have applied intrusion detection and prevention capabilities in its analysis, it cannot provide congressional stakeholders with an accurate portrayal of the extent to which the capabilities are detecting and preventing potential intrusions  The Federal Cybersecurity Enhancement Act of 2015 further required that the Federal Chief Information Officer, within OMB, submit a report to Congress no earlier than 18 months after the date of enactment, but no later than 2 years after that date, assessing the intrusion detection and intrusion prevention capabilities that DHS made available to agencies  The act required that the report address (1) the effectiveness of DHS’s system used for detecting, disrupting, and preventing cyber-threat actors, including advanced persistent threats, from accessing agency information and agency information systems; (2) whether the intrusion detection and prevention capabilities, continuous diagnostics and mitigation, and other systems deployed are effective in securing federal information systems; (3) the costs and benefits of the intrusion detection and prevention capabilities, including as compared to commercial technologies and tools, and including the value of classified cyber threat indicators; and (4) the capability of agencies to protect sensitive cyber threat indicators and defensive measures if they were shared through unclassified mechanisms for use in commercial technologies and tools  In a report issued in September 2018 (about 8 months past the required due date), the Federal Chief Information Officer provided Congress an assessment of intrusion detection and intrusion prevention capabilities across the federal enterprise  The report pointed out, among other things, that agencies did not possess or properly deploy capabilities to detect or prevent intrusions or minimize the impact of intrusions when they occur  In addition, the report acknowledged the need to improve the effectiveness of intrusion detection and intrusion prevention capabilities and stated that OMB would track performance through the CAP goal and annual FISMA reports  However, the report did not address all of the requirements specified in the act  For example, the report did not address whether DHS’s system (i e , NCPS) was effective in detecting advanced persistent threats  In addition, the report did not include a comparison of the costs and benefits of the intrusion detection and prevention capabilities versus commercial technologies and tools, or the value of classified cyber threat indicators  Further, the report did not address the capability of agencies to protect sensitive cyber threat indicators and defensive measures  Until OMB updates the Federal CIO report to address all of the requirements specified in the act, it will continue to be remiss in providing timely and sufficiently detailed information, such as that related to costs and benefits, among other elements in the act, to congressional stakeholders to support their oversight responsibilities  In addition to OMB’s responsibilities in the Federal Cybersecurity Enhancement Act of 2015, OMB has initiated plans for further improving agencies’ intrusion detection and prevention capabilities  In response to a tasking in Executive Order 13800, the Director of the American Technology Council coordinated the development of a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration, regarding the modernization of federal information technology (IT)  The report, Report to the President on Federal IT Modernization, identified actions that OMB should take for (1) prioritizing the modernization of high-risk, high-value assets and (2) modernizing the Trusted Internet Connection (TIC) program and NCPS to improve protections, remove barriers, and enable commercial cloud migration  For example, OMB was to take the following actions subsequent to the December 13, 2017 report issuance date: Within 60 days: Update a TIC policy to address challenges with agencies’ perimeter-based architectures, such as the modernization of NCPS  In addition, introduce a “90 day sprint” during which approved projects would pilot proposed changes in TIC requirements  Within 90 days: Update the annual FISMA and CAP goal metrics to focus on those critical capabilities that were most commonly lacking among agencies and focus oversight assessments on high-value assets  Within 120 days: In conjunction with DHS, develop a strategy for optimally realigning resources across agencies to reduce the risk to high-value assets and respond to cybersecurity incidents for those assets  OMB has taken steps toward implementing several, but not all, of these actions  For example, it introduced a “90 day sprint” and, according to knowledgeable OMB staff, the outcomes of this action are directly informing changes in TIC requirements  In addition, OMB updated the annual FISMA and CAP goal metrics by including several metrics that focus on high-value assets  The updated FISMA and CAP goal metrics went into effect in April 2018  However, while OMB had taken steps toward updating the TIC policy and developing a strategy for optimally realigning resources, the policy and strategy were in draft and had not yet been finalized as of October 2018  The agency did not specify a time frame for finalizing the policy and strategy  Until OMB finalizes the TIC policy and the strategy for optimally realigning resources, the enhancements offered through the policy and strategy are unlikely to be realized  FISMA requires agencies to provide information security protections to prevent unauthorized access to their systems and information  Officials from the 23 selected agencies reported to us that they generally took steps to meet this requirement by augmenting the tools and services provided by DHS with their own intrusion detection and prevention capabilities  However, agencies did not consistently implement five key capabilities specified by DHS and NIST guidance  In addition, most of the agencies did not fully implement any of the phases of DHS’s CDM program that is intended to improve their capabilities to detect and prevent intrusions  Binding Operational Directive (BOD) 18-01 instructs agencies to enhance email security  These enhancements include enabling encrypted email transmission, ensuring that receiving mail servers know what actions the agency would like taken when an email falsely claims to have originated from the agency, and removing certain insecure protocols, among others  The final deadline for implementing all BOD 18-01 requirements was October 16, 2018  Additionally, NIST SP 800-53 Revision 4 recommends that security awareness training include training on how to recognize and prevent spear-phishing attempts  As of September 2018, only 2 of the 23 agencies reported implementing all of the email requirements  For the remaining 21 agencies: 9 agencies stated that their agency had plans to implement all enhancements by the October 2018 deadline, 1 agency was uncertain whether it would meet the deadline, and 11 stated they would not be able to meet the deadline  By contrast, the majority of agencies (22 of 23) reported that they had trained staff on spear-phishing exercises, as recommended by NIST SP 800-53 Revision 4  Officials at the remaining agency told us that the agency planned to have spear-phishing exercises in fiscal year 2019  Such training should help ensure that phishing will be a less effective attack vector against the majority of agencies  While agencies benefit from secure protocols and spear-phishing training, implementing the remaining BOD 18-01 email requirements would provide additional protection to agency information systems  NIST recommends that federal agencies deploy intrusion detection and prevention capabilities  These capabilities include monitoring cloud services, using host-based intrusion prevention systems, monitoring external and internal network traffic, and using a security information and event management (SIEM) system  However, in our semi-structured interviews of the 23 agencies, officials told us that they often had not implemented many of these capabilities  Such inconsistent implementation exposes federal systems and the information they contain to additional risk  As part of their continuing oversight efforts, OMB and DHS can use the information below to work with agencies to identify obstacles and impediments affecting the agencies’ abilities to implement these capabilities  NIST SP 800-53 Revision 4 states that agencies should monitor and control communications at the external boundary of the network  However, as of June 2018, fewer than half of the agencies that used cloud computing services were monitoring cloud traffic  Specifically: 10 of 22 agencies that used Infrastructure as a Service were monitoring inbound and outbound Infrastructure as a Service traffic, 7 of 21 agencies that used Platform as a Service were monitoring inbound and outbound Platform as a Service traffic, and 10 of 23 agencies that used Software as a Service were monitoring inbound and outbound Software as a Service traffic  Without monitoring traffic to and from cloud service providers, agencies risk a greater chance of malicious cloud activity detrimentally affecting agency information security  NIST SP 800-53 Revision 4 states that agency internal monitoring may be achieved by utilizing intrusion prevention capabilities  These capabilities include using host-based intrusion prevention systems to provide defense at an individual system or device level by protecting against malicious activities  Host-based capabilities include memory-based protection and application whitelisting  As of June 2018, officials at the 23 agencies reported the following to us: 16 agencies used host-based intrusion prevention capabilities, 15 agencies used memory-based protection, and 8 agencies used host-based application whitelisting  Until host-based intrusion protections are fully deployed, agencies will be at greater risk of malicious activity adversely affecting agency operations  NIST SP 800-53 Revision 4 also states that agencies should monitor and control communications at the external boundary of the network and at key internal boundaries (e g , network traffic)  NIST guidance also stated that an agency should deploy monitoring devices strategically within the network to detect essential information  However, the agencies in our review did not always monitor external and internal traffic  For example, of the 23 agencies: 5 reported that they were not monitoring inbound or outbound direct connections to outside entities  11 reported that they were not persistently monitoring inbound encrypted traffic  8 reported that they were not persistently monitoring outbound encrypted traffic  In addition, 13 agencies reported they were not using a network-based session capture solution  Of the 10 agencies that reported using this solution, officials from 2 agencies stated that they were not capturing workstation-to-workstation connections  Without thorough monitoring of external and internal traffic, agencies will have less assurance that they are aware of compromised or potentially compromised traffic within their network  NIST SP 800-53 Revision 4 states that agencies should establish enhanced monitoring capabilities  Such capabilities should include automated mechanisms that collect and analyze incident data for increased threat and situational awareness  According to NIST, a security information and event management (SIEM) system analyzes data from different sources and identifies and prioritizes significant events  Sources of data used by SIEM systems include logs from database systems, network devices, security systems, web applications, and workstation operating systems  Of the 23 agencies that we reviewed, 21 reported using a SIEM capability  Over half of the agencies employing a SIEM used one or more of their logs to match against known vulnerabilities and advanced persistent threats, as well as to create real-time alerts  For example, of the 21 agencies: 14 agencies reported collecting database logs, but only 7 agencies reported using the logs to match against known vulnerabilities and persistent threats and to create real-time alerts; 20 agencies reported collecting network logs, but only 13 agencies reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts; 21 agencies reported collecting security logs, but only 13 reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts; 15 agencies reported collecting web application logs, but only 9 agencies reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts; and 13 agencies reported collecting workstation logs, but only 8 agencies reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts  Only 5 agencies collected all 5 types of logs and used them to match against known vulnerabilities and persistent threats and to create real- time alerts  By not fully using SIEM capabilities, agencies will have less assurance that relevant personnel will be aware of possible weaknesses or intrusions  To further enhance their intrusion detection and prevention capabilities, the 23 civilian CFO Act agencies were in the process of implementing DHS’s CDM program  As previously discussed, Phase 1 of the program involves deploying products to automate hardware and software asset management, configuration settings, and common vulnerability management capabilities  Phase 2 intends to address privilege management and infrastructure integrity by allowing agencies to monitor users on their networks and to detect whether users are engaging in unauthorized activity  Phase 3 is intended to assess agency network activity and identify any anomalies that may indicate a cybersecurity compromise  As of June 2018, most agencies had not fully implemented any of the three phases  As shown in Figure 7, 15 agencies had partially implemented phase 1, 21 had partially or not yet begun to implement phase 2, and none of the agencies had fully implemented phase 3  Agencies’ implementation status has been affected, at least in part, due to delays in DHS’s deployment of the program phases  As a result, federal systems will remain at risk until the program is fully deployed  Many agencies have not effectively implemented the federal approach and strategy for securing information systems  For example, the inspectors general for 17 of the 23 selected agencies reported that their agencies had not effectively implemented their information security programs and had significant information security deficiencies associated with internal control over financial reporting  In addition, CIOs for 17 agencies reported not meeting all nine targets for the cybersecurity cross- agency priority goal  Further, OMB determined that that only 13 of the 23 agencies were managing risks to their overall enterprise, while the other 10 agencies were at risk  Until agencies more effectively implement the government’s approach and strategy, federal systems will remain at risk  DHS and OMB have initiatives underway that are intended to further improve agencies’ security posture  However, although DHS had provided training and guidance for NCPS and CDM, agencies expressed the need for more  In addition, OMB had also not finalized its policy and strategy aimed at addressing challenges with perimeter security and protecting high value assets, respectively  OMB had also not provided useful information to Congress, such as a description of agencies’ implementation of DHS’s intrusion assessment plan, the degree to which agencies are using NCPS, a complete analysis of agencies’ implementation of DHS’s intrusion assessment plan, or the costs and benefits of using commercial tools  Although agencies’ officials reported various efforts underway to enhance their agency’s intrusion detection and prevention capabilities, implementation efforts across the federal government were not consistent  OMB and DHS can use the information provided in this report to work with agencies to identify obstacles and impediments affecting the agencies’ abilities to implement these capabilities  We are making a total of nine recommendations, including two to DHS and seven to OMB  Specifically: The Secretary of DHS should direct the Network Security Deployment division to coordinate further with federal agencies to identify training and guidance needs for implementing NCPS and CDM  (Recommendation 1) The Secretary of DHS should direct the appropriate staff to work with OMB to follow up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities  (Recommendation 2) The Director of OMB should submit the intrusion assessment plan to the appropriate congressional committees  (Recommendation 3) The Director of OMB should report on implementation of the defense- in-depth strategy described in the intrusion assessment plan, including all elements described in the plan  (Recommendation 4) The Director of OMB should update the analysis of agencies’ intrusion detection and prevention capabilities to include the degree to which agencies are using NCPS  (Recommendation 5) The Director of OMB should direct the Federal CIO to update her report to Congress to include required information, such as detecting advanced persistent threats, a comparison of the costs and benefits of the capabilities versus commercial technologies and tools, and the capability of agencies to protect sensitive cyber threat indicators and defense measures  (Recommendation 6) The Director of OMB should establish a time frame for finalizing the Trusted Internet Connections policy intended to address challenges with agencies’ perimeter-based architectures and issue it when finalized  (Recommendation 7) The Director of OMB should establish a time frame for finalizing the strategy for realigning resources across agencies to protect high- value assets and issue it when finalized  (Recommendation 8) The Director of OMB should direct the Federal CIO to work with DHS to follow-up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities  (Recommendation 9) We provided a draft of this report to OMB and the 23 civilian CFO Act agencies, including DHS, covered by our review  In response, OMB provided comments via email, and DHS and three other agencies (the Department of Commerce, Social Security Administration, and U S  Agency for International Development) provided written comments, which are reprinted in appendices V through VIII, respectively  The 19 remaining agencies (the Departments of Agriculture, Education, Energy, Health and Human Services, Housing and Urban Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and Veterans Affairs; as well as the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, National Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management, and Small Business Administration) stated via email that they had no comments  In its comments, which the OMB liaison provided to GAO via email on December 7, 2018, OMB did not state whether it agreed or disagreed with the seven recommendations that we made to it  Rather, according to the liaison, OMB agreed with the facts in our draft report, but found that the report did not reflect the agency’s rationale for not submitting the DHS intrusion assessment plan to Congress and a report on the implementation of the plan, as required by the Federal Cybersecurity Enhancement Act of 2015  The liaison stated that OMB is working closely with DHS to provide strategic direction in assessing gaps in, and modernizing, the manner in which intrusion detection and prevention capabilities are delivered to the federal government  Further, in a subsequent email on December 10, 2018, OMB said it believes the Federal CIO’s September 2018 report to Congress, along with data provided in OMB’s fiscal year 2017 FISMA report to Congress, achieves the outcomes sought by the Federal Cybersecurity Enhancement Act of 2015 and demonstrates OMB's continuous engagement with DHS across the evolution of the intrusion detection and prevention program  As stated in our report, we acknowledge that OMB has provided important information to congressional stakeholders through its reports  However, OMB’s reports did not cover all outcomes described in the act  For example, as we pointed out, these reports did not fully address implementation of the defense-in-depth strategy described in DHS’s intrusion assessment plan  In addition, although OMB reported on several elements required by the Federal Cybersecurity Enhancement Act of 2015, it did not report on all of the required elements  For example, the reports did not address whether DHS’s NCPS was effective in detecting advanced persistent threats  The reports also did not include a comparison of the costs and benefits of the intrusion detection and prevention capabilities versus commercial technologies and tools, or the value of classified cyber threat indicators  Further, the reports did not address the capability of agencies to protect sensitive cyber threat indicators and defensive measures  Accordingly, we maintain that our recommendations for OMB to report on required elements in the Federal Cybersecurity Enhancement Act of 2015 are warranted  In addition, OMB suggested that we revise our recommendations to the agency to include a shared responsibility with DHS to help drive desired outcomes  However, six of the seven recommendations we are making to OMB are related to specific OMB responsibilities cited in either the Federal Cybersecurity Enhancement Act of 2015 or the Report to the President on Federal IT Modernization  As such, we believe the recommendations are appropriately addressed to OMB  Furthermore, our recommendations do not prevent OMB from working with DHS to implement them  Our seventh recommendation to OMB—to work with DHS to follow up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities—includes a shared responsibility with DHS  OMB also provided technical comments, which we incorporated into the report, as appropriate  Subsequent to providing initial comments on our draft report, OMB issued a memorandum intended to provide a strategy for realigning resources across agencies to protect high-value assets  This action addresses our recommendation 8, which called for the Director of OMB to establish a time frame for finalizing the strategy for realigning resources across agencies to protect high-value assets, and to issue the strategy when finalized  In its comments, DHS stated that it concurred with the two recommendations we made to the department  DHS stated that it expects to implement the recommendations in 2019  The Department of Commerce commented that the report was reasonable and that the department agreed with the findings and recommendations  In its comments, the Social Security Administration stated that protecting its networks and information is a critical priority  According to the agency, it continued to make improvements in fiscal year 2018, such as improvements and progress in securing applications, leveraging the cloud, managing its assets and vulnerabilities, strengthening its network and incident response capabilities, improving its security training, and enhancing the overall effectiveness of its cybersecurity program  Finally, the U S  Agency for International Development commented that its inspector general had improved the agency’s capability maturity ratings for core security functions in fiscal year 2018  The agency also pointed out that it was the only selected agency in which fiscal year 2017 indicators of effectiveness in implementing the federal approach and strategy for securing information systems were all positive (as noted in Appendix III)  We are sending copies of this report to appropriate congressional committees, the Director of OMB, the heads of the 23 civilian CFO Act agencies and their inspectors general, and other interested congressional parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IX  The Federal Cybersecurity Enhancement Act of 2015, which was enacted December 18, 2015, included a provision for GAO to report on the effectiveness of the federal government’s approach and strategy for securing agency information systems, including intrusion detection and prevention capabilities  The objectives of our review were to assess: (1) the reported effectiveness of selected agencies’ implementation of the federal government’s approach and strategy to securing agency information systems; (2) the extent to which the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS) have facilitated the use of intrusion detection and prevention capabilities to secure federal agency information systems; and (3) the extent to which selected agencies reported implementing intrusion detection and prevention capabilities  Selected agencies for our review were the 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act)  We did not include the Department of Defense because the Federal Cybersecurity Enhancement Act of 2015 only pertains to civilian agencies  Because we focused our work on the 23 civilian agencies, results from these reviews are not generalizable to the entire federal government  To assess the reported effectiveness of agencies’ implementation of the federal government’s approach and strategy to securing agency information systems, we described the federal government’s approach and strategy by summarizing the Federal Information Security Modernization Act of 2014 (FISMA), Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, and the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity (cybersecurity framework)  assessed the reported effectiveness of agencies’ implementation of the approach and strategy by reviewing annual reports from OMB and the inspectors general (IG) of the 23 civilian CFO Act agencies regarding the reported implementation of FISMA for fiscal year 2017  We described the IG reported maturity levels, including the Office of Inspectors General FISMA Reporting Metrics definition of “effectiveness ” These maturity levels are based on security domains aligned with the five core functions in NIST’s cybersecurity framework  We also summarized IG reported conclusions on the effectiveness of agencies’ information security programs for fiscal year 2017  reviewed the fiscal year 2016 and 2017 financial statement audit reports for each of the 23 civilian CFO Act agencies to identify the extent to which any significant deficiencies or material weaknesses related to information security over financial systems had been reported and to identify information security control weaknesses reported by the IGs  identified whether agencies had met the targets for the cybersecurity- focused cross-agency priority goal for fiscal years 2016 and 2017 by examining agency-reported performance metrics for fiscal years 2016 and 2017  evaluated OMB’s agency risk management assessment ratings to make a determination on how agencies were managing risk to their enterprise  These conclusions were based on FISMA metrics, and are aligned with the five core security functions defined in the cybersecurity framework  interviewed knowledgeable OMB officials and staff to obtain their views on the reported effectiveness of the federal government’s approach and strategy to securing agency information systems  To assess the extent to which OMB and DHS have facilitated the use of intrusion detection and prevention capabilities to secure federal agency information systems, we determined the extent OMB and DHS fulfilled their requirements described in the Federal Cybersecurity Enhancement Act of 2015 by collecting and reviewing artifacts from OMB and DHS and comparing them to the provisions outlined in the act  We also interviewed knowledgeable officials from OMB and DHS regarding their efforts to fulfill their requirements described in the act  determined the effectiveness of corrective actions taken by DHS to address nine previously reported recommendations we made in our report related to NCPS  Specifically, we collected appropriate artifacts and assessed the artifacts against the criteria used in that report, and determined the extent to which the actions taken by DHS met the intent of the recommendations, and we met with DHS staff responsible for the remediation activities and obtained their views of the status of actions taken to address the recommendations  held semi-structured interviews with knowledgeable officials from the 23 civilian CFO Act agencies  During these interviews, we obtained the agency’s views on whether they need more training and guidance from DHS for NCPS and CDM  We also interviewed knowledgeable officials and staff at DHS to obtain their views on how DHS had improved the intrusion detection and prevention capabilities it provides to federal agencies  We also interviewed DHS officials to obtain their views on the training and guidance that the department makes available to agencies  To assess the extent to which selected agencies reported implementing intrusion detection and prevention capabilities, we described the reported intrusion detection and prevention capabilities implemented by the 23 civilian CFO Act civilian agencies by summarizing implemented intrusion detection and prevention capability information obtained from the semi-structured interviews at the 23 civilian CFO Act agencies described above; identifying the extent to which the 23 civilian CFO Act agencies were in compliance with DHS’s binding operating directive (BOD) pertaining to enhanced email and web security (BOD 18-01) by collecting and summarizing Cyber Hygiene Trustworthy Email reports from the 23 agencies and determining the extent to which the agencies had taken required actions to implement the BOD  During the semi-structured interviews, we also obtained the agency’s views and experiences with other programs and services provided by DHS, including the extent to which agencies had implemented the tools offered by the department’s Continuous Diagnostics and Mitigation (CDM) program  To determine the reliability of submitted data and obtain clarification about agencies’ processes to ensure the accuracy and completeness of data used in their respective FISMA reports, we analyzed documents and conducted interviews with officials from 6 of the 23 civilian CFO Act agencies  To select these six agencies, we sorted agency fiscal year 2017 information technology budget data from highest to lowest amount and then divided the data into three tiers: high spending, medium spending, and low spending  We then randomly selected two agencies from each of the three tiers  The selected agencies were the Departments of Agriculture, Commerce, Housing and Urban Development, Transportation, and Veterans Affairs, and the U S  Agency for International Development  While not generalizable to all agencies, the information we collected and analyzed about the six selected agencies provided insights into various processes in place to produce FISMA reports  Based on this assessment, we determined that the data were sufficiently reliable for the purposes of our reporting objectives  We conducted this performance audit from December 2017 to December 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The National Institute of Standards and Technology established the cybersecurity framework to provide guidance for cybersecurity activities within the private sector and government agencies at all levels  The cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover  Within the five functions are 23 categories and 108 subcategories that define discrete outcomes for each function, as described in table 7  The federal approach and strategy for securing information systems is prescribed by federal law and policy, including the Federal Information Security Modernization Act of 2014 and the presidential executive order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure  Accordingly, federal reports describing agency implementation of this law and policy, and reports of related agency information security activities, indicated the effectiveness of agencies’ efforts to implement the federal approach and strategy  Table 8 summarizes the reported effectiveness of the 23 civilian Chief Financial Officers Act of 1990 agencies to implement the government’s approach and strategy to securing information systems  The President’s Management Agenda identifies cross-agency priority (CAP) goals to target areas where multiple agencies must collaborate to effect change  The agenda issued in fiscal year 2018 established an information technology modernization goal that includes a cybersecurity objective with specific priority areas and performance indicators  This cybersecurity-focused goal is intended to drive progress in the government’s efforts to modernize information technology to increase productivity and security  Figure 8 describes the 3 updated cybersecurity- focused cross-agency priority areas and 10 performance indicators  Each federal agency is expected to meet one of the 10 new performance indicators by the end of fiscal year 2018 and the remainder by 2020  In addition to the individual named above, Jeffrey Knott (assistant director), Daniel Swartz (analyst-in-charge), David Blanding, Chris Businsky, Kristi Dorsey, Di’Mond Spencer, Priscilla Smith, and Edward Varty made key contributions to this report  West Coile, Franklin Jackson, and Chris Warweg also provided assistance 


Report 2: The federal government receives funds from numerous sources in addition to tax revenues, including collections of user fees, fines, and penalties  According to the Budget of the U S  Government, in fiscal year 2017, the U S  government’s total receipts were $3 3 trillion and collections of fees, fines, penalties, and forfeitures were more than $350 billion  User fees (fees): Fees are charges assessed to users for goods or services provided by the federal government, such as fees to enter a national park, and charges assessed for regulatory services, such as fees charged by the Food and Drug Administration for prescription drug applications  Fees are an approach to financing federal programs or activities that, in general, are related to some voluntary transaction or request for government services above and beyond what is normally available to the public  By requiring identifiable beneficiaries to pay all or part of the cost of a good or service, fees can promote both equity and economic efficiency  Regularly reviewing fees help ensure that agencies, Congress, and stakeholders have complete information  Fines and penalties: Criminal fines and penalty payments are imposed by courts as punishment for criminal violations  Civil monetary penalties are not a result of criminal proceedings but are employed by courts and federal agencies to enforce federal laws and regulations  For example, civil monetary penalty payments are collected from financial institutions by certain financial regulators, such as the Federal Deposit Insurance Corporation, from enforcement actions assessed against financial institutions for violations related to anti-money laundering requirements  Reviews and, as needed, adjustments to fines and penalties could help ensure they provide a meaningful incentive for compliance  The design and structure of statutory authorities for fees, fines, and penalties can vary widely  In prior work, we have identified key design decisions related to how fee, fine, and penalty collections are used that help Congress balance agency flexibility with congressional control and oversight  Congress determines the availability of collections by defining the extent to which an agency may obligate and expend them, including the availability of the funds, the period of time the collections are available for obligation, the purposes for which they may be obligated, and the amount of the collections that are available to the agency  Fees, fines, and penalties may be categorized as one of three types of collections based on the structure of their statutory authority: offsetting collections, offsetting receipts, or governmental receipts (see figure 1)  Offsetting collections can provide agencies with more flexibility because they are generally available for agency obligation without an additional annual appropriation  In contrast, offsetting receipts and governmental receipts involve greater congressional opportunities for control and oversight because, generally, additional congressional action is needed before the collections are available for agency obligation  For example, Congress must appropriate collections from offsetting receipts before agencies are authorized to obligate these funds  The type of collection also determines how OMB and Treasury report the collections  Offsetting collections and offsetting receipts result from businesslike transactions and are recorded as offsets to spending  Offsetting collections are authorized by law to be credited to appropriation or fund expenditure accounts, while offsetting receipts are deposited in receipt accounts  Because offsetting collections are offsets to spending, an account will generally show the net amount that was collected and spent at any point in time  While there is no statutory requirement for government-wide reporting of data of specific fees, fines and penalties, Congress has enacted legislation to make other data on federal spending and federal programs publicly available: The Digital Accountability and Transparency Act of 2014 (DATA Act)  The DATA Act built on previous transparency legislation by expanding what federal agencies are required to report regarding their spending  The act significantly increased the types of data that must be reported, and required the use of government-wide data standards and regular reviews of data quality to help improve the transparency and accountability of federal spending data  These data are reported on the USAspending gov website  The GPRA Modernization Act of 2010 (GPRAMA)  GPRAMA, in part, requires OMB to present a coherent picture of all federal programs by making information available about each federal program on a website, including related budget and performance information  Programs have been defined as an organized set of activities directed toward a common purpose or goal that an agency undertakes or proposes to carry out its responsibilities  A federal program inventory would consist of the individual programs identified by the agencies and OMB and information collected about each of them  OMB and agencies implemented the inventory once, in May 2013  In October 2014, we found several issues limited the usefulness of that inventory and made several recommendations to OMB to ensure the effective implementation of federal program inventory requirements and to make the inventories more useful  Further, in September 2017, we found that OMB continued to delay implementation of the program inventory  We recommended that OMB consider a systematic approach to developing the program inventory and issue instructions to provide time frames and milestones for its implementation  Although OMB updated its instruction in June 2018, it did not provide any time frames or milestones for implementing the inventory  OMB has yet to develop a systematic approach for resuming implementation of the inventory or specific time frames for doing so  There is no source of data that lists all collections of specific fees, fines, and penalties at a government-wide or agency level  Both OMB and Treasury report government-wide budgetary and financial data, including some information on collections of fees, fines, and penalties; however, none of the reports identifies all specific fees, fines, and penalties, and their associated collection amounts at a government-wide level  OMB reports budgetary and financial data in various parts of the Budget of the U S  Government, including Analytical Perspectives, the Budget Appendix, and the Public Budget Database  Treasury reports financial data in the Combined Statement  Each source provides information for a broader purpose than reporting on collections of fees, fines, and penalties  OMB and Treasury provide specific instructions for agency submission of the underlying data, as described in table 2  OMB’s reports include budgetary and financial information on federal collections at different levels of detail—from aggregated government-wide data to agency account-level data—depending on the source and its purpose  Analytical Perspectives identifies collections as fees and as fines, penalties, and forfeitures and reports government-wide summary information on these collections  For example, in a table summarizing government-wide governmental receipts in Analytical Perspectives, OMB reported fines, penalties, and forfeitures in federal funds as $20 98 billion and in trust funds as $1 17 billion for fiscal year 2017  These summary data do not provide a government-wide total of all federal collections from fines, penalties, and forfeitures because they do not include those that are categorized as offsetting collections or offsetting receipts, according to OMB staff  OMB staff said that OMB does not publish a government- wide total of fines, penalties, and forfeitures  OMB data on governmental receipts include source codes—including a code that identifies fines, penalties, and forfeitures—but data on offsetting collections and offsetting receipts do not include a comparable source code  In the Budget Appendix and the Public Budget Database, OMB reports account-level information by agency, identified by types of collections, such as offsetting collections, offsetting receipts, and governmental receipts  The Budget Appendix and the Public Budget Database do not label collections as fees, fines, or penalties and therefore, cannot be used to calculate government-wide totals for fees, fines, or penalties  To assemble Analytical Perspectives, the Budget Appendix, and the Public Budget Database, OMB compiles data from federal agencies into OMB MAX  OMB MAX, which is not publicly available, contains government-wide data at the account level and captures information such as the type of collection and the type of fund to which collections are deposited  While the data in OMB MAX help drive reporting in the Budget, not all data compiled in OMB MAX appear in the Budget  For example, OMB MAX includes an indicator for accounts that contain fees, but that information is not made available in the Budget of the U S  Government  According to congressional staff we spoke with, they do not have open access to OMB MAX, but OMB provides excerpts of OMB MAX data to staff upon request  Treasury’s Combined Statement reports both government-wide totals and agency account-level data for collections classified as receipts, by various source categories—such as proprietary receipts from the public, miscellaneous receipts, and fines, penalties, and forfeitures  Fees  Fees may fall within several source categories  Therefore, Treasury does not have a single government-wide total for fees  It does present government-wide totals for various source categories, including, Sale of Products and Fees for Permits and Regulatory and Judicial Services, for example  Treasury also reports some fees under non-fee categories, such as Miscellaneous Taxes and Excise Taxes  Fines, Penalties, and Forfeitures  Treasury reports a government- wide total of receipts of fines, penalties, and forfeitures, which in fiscal year 2017 was $22 2 billion  Treasury’s Combined Statement presents these data, disaggregated by account, in the tables Receipts by Source Categories and Receipts by Department  For example, it identifies total Internal Revenue Service receipts in the category Fines, Penalties, and Forfeitures of about $6 8 million in fiscal year 2017  Treasury also reports some fines, penalties, and forfeitures receipts under other categories; these receipts are not included in its total of fines, penalties, and forfeitures  For example, Department of Homeland Security breached bond penalties are reported in two categories labeled as fees: Miscellaneous Receipts – Fees for Permits and Regulatory and Judicial Services and Offsetting Governmental Receipts – Regulatory Fees (see figure 2)  In addition to the government-wide data sources, agencies report some data on their collections of specific fees, fines, and penalties in their annual financial reports, congressional budget justifications, and on agency websites  These data are dispersed by agency, are not comprehensive, and cannot be aggregated to create government-wide data because they vary in format and in the level of detail presented  For example: The Environmental Protection Agency (EPA) has an online, searchable database of enforcement and compliance information that includes data on individual fine and penalty assessments for violations of certain, but not all, statutes  The Department of Labor also makes selected enforcement data accessible in an online database collected by the Employee Benefits Security Administration, the Mine Safety and Health Administration, the Occupational Safety and Health Administration, and the Wage and Hour Division without Department of Labor-wide data standards on individual fine and penalty assessments  USDA’s Animal and Plant Health Inspection Service’s 2019 Congressional Budget Justification, on the other hand, is a PDF document that provides annual collection totals for Agriculture Quarantine Inspection Fees, Import-Export User Fees, Phytosanitary Certificate User Fees, Veterinary Diagnostics User Fees, and Other User Fees, rather than disaggregated to individual fee assessments  The government-wide totals for fees that OMB reports in Analytical Perspectives are not presented at a more disaggregated level, such as by agency or program, except for some major fee collections identified by OMB  For example, in Analytical Perspectives for fiscal year 2017, OMB reported $335 4 billion as a government-wide total of fee collections  OMB also reported some disaggregated data for the subset of fees that were offsetting collections and offsetting receipts  Specifically, it listed 11 fees totaling $258 4 billion collected by specific agencies and listed the remaining $72 3 billion as “all other user charges” without identifying the agency or program  As described in table 1 above, clear and accessible data can be aggregated or disaggregated by the user  OMB has more detailed data on collections in OMB MAX, including the agency, account, type of collection, and fund type, which it uses to compile reported totals of fees as well as fines, penalties, and forfeitures  OMB does not publicly report these data disaggregated below the government-wide level, such as at the agency level  OMB staff said that they do not report the disaggregated data because the purpose of Analytical Perspectives is to develop or support the President’s policies and more detailed tables may not be included if they are not considered necessary for that purpose  However, Analytical Perspectives also serves to provide other significant data that place the President’s Budget in context and assist the public and policymakers in better understanding the budget proposals  For example, Analytical Perspectives includes a chapter on aid to state and local governments that presents the President’s budget proposals for grant programs along with crosscutting information on federal grants to state and local governments, including government-wide grant spending, by agency and program  Analytical Perspectives also presents a summary of fee proposals but does not provide comparable crosscutting information about current fees  For fines and penalties, neither proposals nor crosscutting information is presented by agency  Until OMB makes more disaggregated data on fees, fines, and penalties maintained in its OMB MAX database—such as collections by agency—publicly available, Congress has limited information on such collections to inform oversight and decision-making  Analytical Perspectives’ government-wide totals of fees may include inaccurately labeled collections—other collections that are not fees—and may exclude some fee collections  Data that are clear and accessible are presented with known limitations, as shown in table 1  OMB Circular No  A-11 states that all accounts in which more than half of collections are from fees will be designated as containing fees  OMB staff said that the entire account is designated as containing fees because account-level data are the most disaggregated data OMB collects from agencies  OMB calculates its government-wide total for fees by adding collections in all accounts designated in OMB MAX as containing user fees  However, agency accounts can include multiple sources of budget authority  For example, Treasury’s U S  Mint’s account “United States Mint Public Enterprise Fund” includes offsetting collections from Mint operations and programs; these include the production and sale of commemorative coins and medals, the production and sale of circulating coinage, the protection of government assets, as well as gifts and bequests of property  The United States Mint Public Enterprise Fund is designated as containing fees in OMB MAX  Therefore, budget authority that is not derived from the collection of fees but is still included in this account will be designated as fees as well when calculating a government-wide total  Conversely, accounts in which fees contribute to less than half of collections are not designated as containing fees amounts, and those fees will not be included in the government-wide total OMB calculates  OMB Circular No  A-11 describes the designation of fee accounts, but the data presented in Analytical Perspectives as totals for fees do not disclose OMB’s designation criteria, including the limitations to the accuracy of the data  OMB staff said they do not report this limitation because they consider OMB Circular No  A-11 a more appropriate document for providing technical information like the designation of accounts containing user fees  However, the section on fees in Analytical Perspectives does not direct the reader to OMB Circular No  A-11 for key information related to the data presented on fees  For other topics, including lease-purchase agreements, Analytical Perspectives directs the reader to OMB Circular No  A-11 for further details  Furthermore, for other topics, OMB provided explanatory information along with the data in Analytical Perspectives  For example, OMB explained a recent change to definitions in the research and development section of Analytical Perspectives and the effect of the change on budget authority  Until OMB provides a description of data limitations regarding the criteria used to identify accounts with fees for compiling government-wide totals in Analytical Perspectives, or directs users to the relevant section of OMB Circular No  A-11, some users are likely to be unaware of the potential for the total user fees to be overestimated or underestimated  In addition, OMB does not regularly review and update implementation of its criteria for designating fees  Standards for Internal Control in the Federal Government state that agency management should use quality information to achieve the objectives, such as processing data into quality information that is current and accurate  OMB Circular No  A-11 states that the fee designation is applied at the time the account is established  OMB staff told us that when establishing a new account, OMB collaborates with Treasury to determine the legal attributes of the account, including any fee authorities, and whether to designate the account as containing fees  OMB staff further explained they review the designation when new legislation is enacted that would change the attributes of the account, or if an agency informs OMB that the makeup of an account has changed because of programmatic changes  However, OMB Circular No  A-11 does not instruct agencies to regularly review or update this designation and report changes to OMB  Therefore, if the makeup of collections in an account changes so that fees go from being more than half of the collections to less than half, or vice versa, the account’s fee designation may not be updated accordingly  Until OMB instructs agencies to regularly review the fee designation in OMB MAX and update the designation, as needed, OMB cannot provide reasonable assurance that accounts are designated correctly, and that the government-wide totals of fees reported in Analytical Perspectives are accurate  While Analytical Perspectives reports government-wide data labeled as fees, fines, and penalties, the other three sources we reviewed—the Budget Appendix, the Public Budget Database, and the Combined Statement—report account-level information by agency  Users cannot further disaggregate the data presented to specific fee, fine, and penalty collections  For example, USDA’s Animal and Plant Health Inspection Service (APHIS) is funded in part by six fees: (1) Agricultural Quarantine Inspection (AQI) fee, (2) Phytosanitary Export Certification fee, (3) Veterinary Services Import Export fee, (4) Veterinary Diagnostics fee, (5) Reimbursable Overtime, and (6) Trust Funds and Reimbursable Funds  However, a user cannot identify collections from each of these APHIS fees in the Budget Appendix  The Budget Appendix specifically identifies AQI fee collections—$768 million in fiscal year 2017—because they are receipts deposited to a trust fund  The other five fees are combined within the total for offsetting collections—$152 million (see figure 3)  The Budget Appendix, the Public Budget Database, and the Combined Statement report data at the account level because the purposes of these reports are broader than fees, fines, and penalties, and OMB and Treasury instruct agencies to report data at that level  Treasury’s Financial Manual states that agencies post appropriations and spending authorizations by Congress to accounts established by Treasury  OMB’s Circular No  A-11 instructs agencies to report data at the budget account level in OMB MAX, which supports the data in the Budget Appendix and the Public Budget Database  Because OMB and Treasury do not collect data that can be disaggregated to the level of fee, fine, or penalty, the collections for specific fees, fines, and penalties within accounts are not identifiable within account totals  Both the Budget Appendix and Public Budget Database label and present data within each account by collection type: offsetting collections, offsetting receipts, and governmental receipts  These collection types include fees, fines, and penalties, as well as other sources of collections, as shown in the text box below  Budgetary Collections as Labeled by the Budget of the U S  Government Include More than Fees, Fines, and Penalties Offsetting Collections and Offsetting Receipts include user fees as w ell as reimbursements for damages, intragovernmental transactions, and voluntary gifts and donations to the government  Governmental Receipts include collections that result from the government’s exercise of its sovereign pow er to tax or otherw ise compel payment, and include taxes, compulsory user fees, regulatory fees, customs duties, court fines, certain license fees, and deposits of earnings by the Federal Reserve System  As a result, the user cannot separate fees, fines, and penalties from other collections  For example, offsetting collections may include fees, reimbursements for damages, gifts or donations of money to the government, and intragovernmental transactions with other government accounts  Analytical Perspectives explains that amounts collected by government agencies are recorded in two ways that broadly affect the formulation of the government-wide budget, but may not provide detail on specific agency collections: (1) governmental receipts, which are compared to total outlays in calculating the surplus or deficit; and (2) offsetting collections or offsetting receipts, which are deducted from gross outlays to calculate net outlay figures  These collections are presented together for budgeting purposes, but cannot be separated to specific fees, fines, or penalties  Therefore, it is not clear what percentage of the reported collections are fees, fines, and penalties as opposed to other collections  Treasury’s Combined Statement and OMB’s Public Budget Database do not identify offsetting collections, including collections of fees, fines, and penalties  Instead, the Combined Statement reports net outlays, which include any offsetting collections as deductions from outlays  Similarly, the Public Budget Database reports budget authority net of any offsetting collections  Treasury clearly describes this presentation of the data in the Combined Statement, but OMB does not in the Public Budget Database  In the “Explanation of Transactions and Basis of Figures” section of the Combined Statement, Treasury describes that outlays are stated net of collections representing reimbursements as authorized by law, which include offsetting collections  With the description provided in the Combined Statement, the user can understand that fees, fines, and penalties that are offsetting collections are not identifiable in the data  OMB reports receipts and budget authority—which include collections from fees, fines, and penalties—in separate spreadsheets of the Public Budget Database  Similar to outlays reported in Treasury’s Combined Statement, the Budget Authority spreadsheet reports the net budget authority of accounts after agencies have credited offsetting collections from fees, fines, penalties, or other collections  For example, the National Park Service reported net budget authority of $2 425 billion for the Operation of the National Park System account in fiscal year 2017 in both the Budget Appendix and the Public Budget Database, both of which present data compiled in OMB MAX  The Budget Appendix presents additional information, reporting offsetting collections that are at least partially derived from fees of $35 million, and gross budget authority of $2 46 billion, as shown in figure 4  The Public Budget Database, on the other hand, does not identify the amount of offsetting collections in the account or gross budget authority  OMB does not describe this presentation of the data in the Public Budget Database User’s Guide  As shown in table 1, data that are clear and accessible are presented with descriptions of the data  The User’s Guide directs users who may not be familiar with federal budget concepts to Analytical Perspectives and OMB Circular No  A-11  However, OMB does not describe, either in the User’s Guide or in the Budget Authority spreadsheet of the Public Budget Database, that this source reports budget authority net of offsetting collections, such as collections of fees, fines, and penalties  OMB staff said they do not describe the presentation because it is explained in Analytical Perspectives  However, the Public Budget Database is available for download separate from Analytical Perspectives, and the User’s Guide specific to the Public Budget Database includes other information describing the data in the spreadsheets  Describing the presentation of the data in the User’s Guide would help ensure that users of the Public Budget Database can correctly interpret the information and not underestimate agencies’ fee, fine, or penalty collections  No source of government-wide data consistently reports data elements related to fees, fines, and penalties that could help inform congressional oversight of agencies and programs, such as the amount collected annually, account balances, and whether the collection is a fee, fine, or penalty  See figure 5 for the extent to which data elements are included in the Budget Appendix, Public Budget Database, and Combined Statement  See appendix I for more detailed information on the data elements that are useful for congressional oversight  To a limited extent there are some cases where government-wide reports included data elements useful for the purpose of congressional oversight of fees, fines, and penalties  In some cases the Budget Appendix includes information on the fund type receiving collections and the extent to which the collections from fees may be appropriated to the agency collecting the fee  The Budget Appendix, for example, reports that collections for the Agricultural Quarantine Inspection (AQI) fee are recorded under “Special and Trust Fund Receipts,” as shown previously in figure 3  The user can also identify the appropriation of collections from the AQI fee under “Program and Financing, Budgetary resources,” as shown below in figure 6  As discussed previously, the other five fees the Animal and Plant Health Inspection Service(APHIS) collects are not individually identifiable in the Budget Appendix, but fall under offsetting collections  OMB and Treasury reports, and the systems that support them, are designed for budget and financial information and not for an inventory of fees, fines, and penalties that includes the data elements that Congress may use in oversight  OMB staff said the agency does not have a requirement to prioritize reporting fee, fine, and penalty data over more detailed information on other types of funds  OMB staff said while they generally agree that additional data elements would be useful for oversight, there are trade-offs between transparency and the burden of collecting and reporting additional information  According to OMB staff and officials from Treasury, the Congressional Research Service, and external organizations with expertise in federal budget issues and data transparency, there are two primary benefits to government-wide reporting of fee, fine, and penalty data: increased transparency and better information for congressional oversight and decision-making  Generally, all congressional staff we spoke with said making additional government-wide data on fees, fines, and penalties, such as those data elements described previously, without additional outreach to agencies, would be useful and increase transparency  While some congressional staff said such data elements are available through direct outreach to agencies, other congressional staff told us they could not always obtain the information they wanted  For example, staff from a congressional committee said that one of the most critical data elements for the purpose of congressional oversight is information on agency reporting of obligations and expenditures because, in their view, currently many agencies do not adequately report this information and some agencies do not report this information at all  These data would provide Congress a more complete picture of individual agencies’ activities and any potential overlap or duplication in multiple agencies’ activities  Congressional staff also said having government-wide data on collections of fees could inform efforts that are crosscutting in nature  For example, APHIS and Customs and Border Protection jointly implement the AQI program to help prevent the introduction of harmful agricultural pests and diseases into the United States, and AQI fee collections are divided between the two agencies  Publicly available data on government-wide collections of fines and penalties could inform the public on agency enforcement activities and compliance of regulated parties, such as those related to health or safety  Some officials from external organizations and congressional staff said that it would be useful to have government-wide data on individual fines and penalties levied by agencies  For example, the Environmental Protection Agency publishes an online database on its compliance and enforcement actions, Enforcement and Compliance History Online (ECHO)  According to the website, the data available on ECHO allows the public to monitor environmental compliance in communities, corporations to monitor compliance across facilities they own, and investors to more easily factor environmental performance into decisions  Further, an official from an external organization with expertise in data transparency stated that, ideally, a user would be able to link fine and penalty data to spending data on USAspending gov to increase transparency in instances where an organization receiving a federal grant or contract has also had a fine or penalty levied against it  Last, publicly available government-wide data on collections could inform the public, specifically payers of fees, fines, and penalties, and facilitate their participation in public comment opportunities  For example, OMB staff said government-wide data could provide the public with clear, transparent information across agencies on fee collections and allow the public to analyze differences in fee programs among agencies  Payers of fees may be able to make more informed comments on proposed changes to a fee program if they had information on how it relates to other fee programs across the federal government  Government-wide fee, fine, and penalty data would provide more information to facilitate congressional oversight  These data could help Congress identify trends in collections and significant changes that could be an indication of an agency’s performance  For example, staff of a Congressional committee stated that fine and penalty data can be used to examine enforcement actions on a particular issue or to identify potential trends over time as an indicator of stronger or weaker enforcement actions by an agency  Congress could also use these data to identify variations in enforcement action among geographic regions or as an indicator of the frequency of violations  Additionally, data on review and reporting requirements can inform congressional oversight of fees, fines, and penalties  We previously reported that regular comprehensive reviews of fees provide opportunities for agencies and Congress to make improvements to a fee’s design which, if left unaddressed, could contribute to inefficient use of government resources  For example, fee reviews could help ensure that fees are properly set to cover the total costs of those activities which are intended to be fully fee-funded  Fee reviews may also allow agencies and Congress to identify where similar activities are funded differently; for example, one by fees and one by appropriations  One such example is the export control system, in which the State Department charges fees for the export of items on the U S  Munitions List, while the Commerce Department does not charge fees for those items exported under its jurisdiction  Government-wide reporting of fee, fine, and penalty data could also inform Congress’s funding decisions by providing a clearer picture of agencies’ total resources  Congressional staff stated that knowing the statutory authority to collect and obligate funding from fees, fines, and penalties—along with any appropriation an agency may have received from an annual appropriation act, which are currently available to congressional staff—would provide a more complete picture of an agency’s total annual funding, including the portion attributed to the taxpayer and the portion attributed to payers of specific fees, fines, and penalties  For example, staff from congressional committees we spoke with said it would be useful to have data to show programs that receive appropriations from both offsetting collections and appropriations not derived from offsetting collections to inform decisions on how the program is funded  Congressional staff also said this would provide more opportunities to track the flow of money in and out of the government  Overall funding decisions may be affected if an agency has an increase in fee collections, for example  Congressional committee staff also said it would be useful to have government-wide data on specific fees, fines, and penalties that are offsetting collections because these collections are available for obligation without going through the annual appropriations process  Our prior work has shown that it is important to consider how the agencies and entities with this authority facilitate oversight to ensure effective management, transparency, and public accountability  Some committee staff said they can request data directly from agencies when they need more disaggregated information on fees, fines, and penalties, and reported different levels of responsiveness from agencies  Publicly available data could reduce potentially overlapping or duplicative requests from staff to agencies  According to officials from agencies and external organizations, there are potential challenges to defining the government-wide data standard or definition of fee, fine, and penalty programs by which agencies could report  Because there is no statutory requirement for government-wide reporting of fee, fine, and penalty data, agencies collect and use these data for their own purposes, and are not using government-wide data elements and standards that are consistent and comparable between agencies  First, an agency may define a fee program as a single fee or a set of related fees  For example, the U S  Citizenship and Immigration Services charges more than 40 immigration and naturalization fees to applicants and petitioners that could be grouped together as related fees or split into up to 40 different fee programs  Second, officials from external organizations said there are also challenges in defining data standards the level of detail to report  For example, an official from an external organization said, for large financial penalties, it may be useful for oversight for the data to identify each instance of the penalty, including the fined party  However, that level of detail could raise privacy sensitivities  For example, reporting every individual that paid an entrance fee at a national park could present privacy concerns  Finally, for elements that are useful for congressional oversight, one challenge could be the timing of when funds are collected compared to when they are available for obligation  The amount of funds collected in a year does not necessarily equal the amount available to the agency that year  For example, collections of Harbor Maintenance Fees are deposited to the Harbor Maintenance Trust Fund and are not available for obligation without appropriation  Funds collected in one year may not be necessarily appropriated and obligated until a subsequent year  Our prior work on the Digital Accountability and Transparency Act of 2014 (DATA Act) implementation underscores the importance of standardized and clearly defined data elements  We found inconsistent and potentially confusing instructions from OMB regarding the Primary Place of Performance data elements that resulted in inconsistent reporting among agencies  The standard established by OMB and Treasury defines Primary Place of Performance as “where the predominant performance of the award will be accomplished” while other instructions define it as “the location of the principal plant or place of business where the items will be produced, supplied from stock, or where the service will be performed ” We found some agencies used the first definition and some used the second  In one case, the Departments of Labor and Health and Human Services issued contracts to the same company for similar office printers, but one reported the primary place of performance as California, the location of the office where the printers were delivered and used  The other agency reported the primary place of performance as New Jersey, the location of the company that supplied the printers  As a result, the data were not comparable between agencies or across the federal government, limiting the usefulness for congressional oversight  We previously recommended that OMB and Treasury provide additional instruction to agencies on how to report Primary Place of Performance to ensure the definitions are clear and the data standards are implemented consistently by agencies  Staff from one congressional committee cautioned that attempts to present information on budget authorities for fees, fines, and penalties in a simple and accessible database create an unacceptable risk of confusion and legislative error  The staff said an accurate description of the nature of the spending–-including whether there is authority to obligate without further appropriation–-would be labor intensive and require significant legal analysis and research  Government-wide reporting of fees, fines, and penalties could increase transparency and facilitate oversight and decision-making, but would require time and resources to develop given that there is currently no government-wide system or requirements for agencies to collect and report detailed fee, fine, and penalty data  The level of federal investment would vary depending on factors, such as the number of data elements included and the level of detail reported  Developing a comprehensive and accessible data source would provide greater benefits, but would likely be resource intensive  We have reported on other federal transparency efforts that could provide strategies for reporting government-wide fee, fine, and penalty data  For example, to create a clear and accessible government-wide data source that includes the data elements we identified that would be useful for congressional oversight, Treasury officials said the process would be similar to the implementation of the DATA Act for spending data  To implement the DATA Act, OMB and Treasury led an intensive effort starting in May 2014 through May 2017 when the first government-wide data were reported under the DATA Act’s new standards  Data Standards: OMB, in coordination with Treasury, established 57 standardized data element definitions and approximately 400 associated sub-elements for reporting federal spending information  OMB and Treasury created opportunities for non-federal stakeholders to provide input into the development of data standards, including publishing a Federal Register notice seeking public comment on the establishment of financial data standards; presenting periodic updates on the status of DATA Act implementation to federal and non-federal stakeholders at meetings and conferences; soliciting public comment on data standards using an online collaboration space; and collaborating with federal agencies on the development of data standards and the technical schema through MAX gov, an OMB- supported website  Technical Process for Reporting: Treasury developed the initial DATA Act Information Model Schema, which provided information on how to standardize the way financial assistance awards, contracts, and other financial and nonfinancial data would be collected and reported under the DATA Act  System to Collect and Validate Data: Treasury developed a system that collects and validates agency data (the DATA Act Broker), which operationalizes the reporting framework laid out in the schema  In addition, Treasury employed online software development tools to provide responses to stakeholder questions and comments related to the development and revision of the broker  Public Reporting: Treasury created and updated the new USAspending gov website to display certified agency data submitted under the DATA Act  Agencies also took steps to prepare to report spending data  They reviewed data elements OMB identified, participated in standardizing the definitions, performed an inventory of their existing data and associated business processes, and updated their systems and processes to report data to Treasury  OMB and Treasury issued policy directions to help agencies meet their reporting requirements under the act  They also conducted a series of meetings with participating agencies to obtain information on any challenges that could impede effective implementation and assess agencies’ readiness to report required spending data  Although the steps to developing comprehensive, detailed reporting on government-wide collections of fees, fines, and penalties might be similar to the DATA Act efforts, the dollar amounts of collections would be smaller than those of federal spending  In fiscal year 2017, federal spending was $3 98 trillion compared to about $350 billion in collections of fees, fines, penalties, and forfeitures reported by OMB  On the other hand, defining data elements and standards for fee, fine, and penalty data could be more resource intensive than developing data standards for DATA Act implementation because the DATA Act built on earlier reporting requirements  The DATA Act amended the Federal Funding Accountability and Transparency Act of 2006 (FFATA), which required OMB to establish the website USAspending gov to report data on federal awards, including contracts, grants, and loans  The DATA Act required OMB and Treasury to standardize data required to be reported by FFATA  For fee, fine, and penalty data, OMB and Treasury would be starting without the benefit of some data elements already defined  Further, we have previously reported that effective implementation of provisions to make federal data publicly available, including the DATA Act and GPRAMA’s program inventory, especially the ability to crosswalk spending data to individual programs, could provide vital information to assist federal decision makers in addressing significant challenges the government faces  Incorporating a small number of data elements that Congress identifies as most useful for oversight into ongoing government-wide agency reporting efforts could incrementally improve transparency and information for oversight and decision-making, with fewer resources  For example, Congress required agencies to add selected data elements to their annual financial reports on civil monetary penalties  Specifically, the Federal Civil Penalties Adjustment Act Improvements Act of 2015 requires agencies to include information about the civil monetary penalties within the agencies’ jurisdiction, including catch-up inflation adjustment of the civil monetary penalty amounts, in annual agency financial reports or performance and accountability reports  As shown in figure 7, to facilitate agencies’ reporting, OMB provided a table to define the data elements required in the act in its annual instructions, OMB Circular No  A-136, Financial Reporting Requirements  Agencies started reporting these data in their agency financial reports in fiscal year 2016  In July 2018, we reported that 40 of 45 required agencies reported in their fiscal year 2017 agency financial report information on civil monetary penalties as directed by the OMB instructions  Similarly, if Congress sought additional fine and penalty data elements, such as amounts collected and authority to spend collections, OMB could expand this table in Circular No  A-136 to include those data elements  Circular No  A-136 also outlines that agencies may include the results of biennial reviews of fees and other collections in their agency financial reports  OMB could also update this portion of the circular to require agencies to report specific data elements that are useful for oversight, such as review and reporting requirements  While this information reported in agency financial reports would be disaggregated in portable document format, or PDF, documents, it would provide some transparency on agencies’ activities that Congress could use to prioritize its oversight efforts  In another example, if OMB implements the federal program inventory as required by GPRAMA, it could include a data element on whether a program has a fee, fine, or penalty  We previously reported that the principles and practices of information architecture—a discipline focused on organizing and structuring information—offer an approach for developing such an inventory to support a variety of uses, including increased transparency for federal programs  A program inventory creates the potential to aggregate, disaggregate, sort, and filter information across multiple program facets  For example, from a user’s perspective, a program could be tagged to highlight whether it includes activities to collect fees, fines, or penalties  Then, a user interested in this data facet could select a tag (e g , fees) that could generate a list of programs that also have fees, fines, or penalties  While the program inventory is broader than agency collections of fees, fines, and penalties and would include programmatic descriptions, it would increase transparency by enabling Congress and the public to identify and isolate all programs that include, as a source of funding or a key data element, a fee, fine, or penalty to inform oversight and target additional requests for information to agencies  Federal agencies are authorized to collect hundreds of billions of dollars from fees, fines, and penalties each year that fund a wide variety of programs, but Congress and the American public do not have government-wide data on these collections that would provide increased transparency and facilitate oversight  OMB’s MAX database contains some disaggregated data labeled as fees, fines, and penalties, but OMB does not make these data publicly available  Without more disaggregated, government-wide, accessible data on collections of fees, fines, and penalties, such as by agency, Congress and the public do not have a complete and accurate picture of federal finances, the sources of federal funds, and the resources available to fund federal programs  In addition, improving the data OMB currently reports related to fees, fines, and penalties could help the user better understand the data and the potential limitations  First, until OMB describes how it identifies accounts with fees including that the government-wide totals of fees it reports in Analytical Perspectives may include collections that are not fees and exclude some fee collections, some users will likely be unaware that reported totals could be over- or under-estimates  Second, without OMB instruction to agencies to regularly review and update implementation of the criteria for designating accounts that contain fees, accounts could be designated incorrectly if the makeup of the collections changes  Therefore, OMB cannot provide reasonable assurance that the total amount of fees it reports is accurate  Third, until OMB describes in the User’s Guide that its Public Budget Database reports budget authority net of offsetting collections, including collections of fees, fines, and penalties, users could misinterpret the information and underestimate collections in some cases  OMB and Treasury do not collect many of the data elements on fees, fines, and penalties that would be useful for congressional oversight, such as review and reporting requirements  There are trade-offs between the potential costs and the potential benefits  While reporting government- wide data on specific fees, fines, and penalties would improve transparency and information for decision-making, more data elements would require greater investment of resources from OMB, Treasury, and agencies  Any new reporting of fee, fine, and penalty data would be most useful if it is designed to be compatible with other transparency efforts— the DATA Act reporting and the federal program inventory  Regardless of the approach taken, linkage of data on fees, fines, and penalties with other government-wide data reporting, such as USASpending gov, would enhance transparency and facilitate congressional oversight  We are making the following four recommendations to OMB: The Director of OMB should make available more disaggregated data on fees, fines, and penalties that it maintains in its OMB MAX database  For example, OMB could report data on fee collections by agency in Analytical Perspectives  (Recommendation 1) The Director of OMB should present, in Analytical Perspectives, the data limitations related to the government-wide fee totals by describing the 50- percent criteria OMB uses to identify accounts with fees or by directing users to the relevant sections of OMB Circular No  A-11  (Recommendation 2) The Director of OMB should instruct agencies to regularly review the application of the user fee designation in the OMB MAX data and update the designation, as needed, to meet the criteria in OMB Circular No  A-11  (Recommendation 3) The Director of OMB should describe in the Public Budget Database User’s Guide that budget authority is reported net of any offsetting collections, such as collections of fees, fines, and penalties  (Recommendation 4) We provided a draft of this report to Treasury and OMB for review and comment on December 10, 2018  Treasury informed us that they had no comments  As of March 4, 2019, OMB did not provide comments  We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of the Treasury, and the Director of the Office of Management and Budget  In addition, the report is available at no charge on GAO’s website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-6806 or nguyentt@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix II  This report examines: (1) the extent to which government-wide data on collections of fees, fines, and penalties are publicly available and useful for the purpose of congressional oversight, and (2) the benefits and challenges to government-wide reporting of specific fees, fines, and penalties including data elements that facilitate congressional oversight  To assess the extent and usefulness of publicly available data, we developed criteria for the availability and usefulness for the purpose of congressional oversight of data on collections of fees, fines, and penalties reported in government-wide sources (see table 3)  The first three criteria—clear and accessible presentation, complete, and accurate—address the availability of the data and the final criterion, useful for the purpose of congressional oversight, addresses content of the data specific to congressional oversight needs  These criteria are based on: Standards for Internal Control in the Federal Government related to Digital Accountability and Transparency Act of 2014 (DATA Act) government-wide instruction from the Office of Management and Budget (OMB) on public access to data and open government, our prior work on user fees, fines, and penalties, and input from staff of congressional committees on appropriations, budget, and oversight  Using a standard list of semistructured interview questions, we interviewed congressional staff that were available to meet with us on or before November 1, 2018  We shared the criteria with OMB staff and Department of the Treasury (Treasury) officials, and they agreed the criteria are relevant and reasonable  To identify publicly available government-wide sources of data with information on collections of fees, fines, and penalties, we reviewed our prior work on user fees, fines, penalties, and permanent funding authorities, conducted general background research including reviewing Congressional Budget Office (CBO) and Congressional Research Service (CRS) reports, and interviewed staff from OMB, and officials from Treasury, CBO, and CRS  We identified the Budget of the U S  Government—including Analytical Perspectives, the Budget Appendix, and the Public Budget Database—produced annually by OMB; the Financial Report of the U S  Government (Financial Report), the Daily Treasury Statement, the Monthly Treasury Statement, the Combined Statement of Receipts, Outlays, and Balances, and USAspending gov produced by Treasury; and CBO products, such as its budget projections and historical budget tables as containing government-wide federal budget or financial data  Of the sources we identified, we included Analytical Perspectives, the Budget Appendix, the Public Budget Database, and the Combined Statement of Receipts, Outlays, and Balances in our study because they contain government-wide information on collections of fees, fines, and penalties  We excluded the Treasury’s Daily Treasury Statement, Monthly Treasury Statement, Financial Report, and USAspending gov from this review because we determined that the information presented did not differentiate between types of collections in a way that would allow us to separately identify fees, fines, and penalties  For example, Treasury’s Financial Report reports government-wide information in categories that are broader than fees, fines, and penalties  Specifically, it reports “earned revenue,” which includes collections of interest payments for federal loan programs  Such collections are not fees  The Financial Report also reports fines and penalties combined with interest and other revenues  We also reviewed and excluded CBO products because the data reported are not designed to differentiate between types of collections  We assessed Analytical Perspectives, the Budget Appendix, the Public Budget Database, and the Combined Statement of Receipts, Outlays, and Balances using the criteria we developed for clear and accessible presentation, accurate, and complete  We also assessed the Budget Appendix, the Public Budget Database, and the Combined Statement of Receipts, Outlays, and Balances using the criteria for useful for the purpose of congressional oversight  Further, we assessed relevant portions of OMB and Treasury instructions using Standards for Internal Control in the Federal Government  We also used OMB and Treasury data to identify and report government- wide totals for fees, fines, and penalties to the extent that they were reported  To assess the reliability of OMB’s MAX database data related to the collections of fees, fines, and penalties, we reviewed related documentation, interviewed knowledgeable agency officials, and conducted electronic data testing  To assess Treasury’s Bureau of the Fiscal Service data related to the collections of fees, fines, and penalties, we reviewed related documentation and interviewed knowledgeable agency officials  In both cases, we found the data to be reliable for our purposes  We did not examine whether agencies accurately report collections as fees, fines, and penalties to OMB and Treasury  In addition, we identified and reviewed other sources of data on fees, fines, and penalties that are specific to federal agencies, including annual financial reports and agency websites  We did not apply the criteria we developed for available and useful for the purpose of congressional oversight to these sources because they contain data for an individual agency rather than government-wide data  To determine the benefits and challenges to government-wide reporting of fees, fines, and penalties, we interviewed staff of congressional committees on appropriations, budget, and oversight, OMB staff and Treasury officials, staff of CBO, and external organizations, including the Committee for a Responsible Federal Budget, the Data Coalition, the Data Foundation, the Project on Government Oversight, the Peter G  Peterson Foundation, and the Sunlight Foundation, on the potential benefits and challenges of government-wide reporting of fees, fines, and penalties  In addition, we reviewed our prior work on the DATA Act, federal program inventories, and federal fees, to identify and assess issues to consider in government-wide reporting  We conducted this performance audit from November 2017 to March 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the contact named above, Susan E  Murphy (Assistant Director), Barbara Lancaster (Analyst in Charge), Michael Bechetti, Jacqueline Chapin, Colleen Corcoran, Ann Marie Cortez, Lorraine Ettaro, John Mingus, and Rachel Stoiko made key contributions to this report 

ground_truth: Congress has authorized federal agencies to collect hundreds of billions of dollars annually in fees, fines, and penalties. These collections can fund a variety of programs, including programs related to national security, and the protection of natural resources. Data on collections are important for congressional oversight and to provide transparency in agencies' use of federal resources. GAO was asked to review the availability of government-wide data on fees, fines, and penalties. This report examines (1) the extent to which data on collections of fees, fines, and penalties are publically available and useful for the purpose of congressional oversight; and (2) the benefits and challenges to government-wide reporting of fees, fines, and penalties. GAO assessed government-wide fee, fine, and penalty data against criteria for availability and usefulness based on multiple sources, including prior GAO work and input from staff of selected congressional committees. GAO interviewed OMB staff, Treasury officials, and representatives of organizations with expertise in federal budget issues and reviewed prior GAO work to identify benefits and challenges of reporting these data. There are no comprehensive, government-wide data at the level of detail that identifies specific fees, fines, or penalties. The Office of Management and Budget (OMB) and the Department of the Treasury (Treasury) report data that include these collections at the budget account level, which generally covers a set of agency activities or programs. OMB and Treasury also report some summary data for budgeting and financial management purposes. In the Budget of the U.S. Government , for example, OMB data showed government-wide fees totaled just over $335 billion in fiscal year 2017. These reports, however, are not designed to inventory or analyze fee, fine, or penalty collections and have significant limitations for that purpose. Although OMB collects more disaggregated data on fees, fines, and penalties, it does not make the data publicly available. OMB uses the disaggregated data in its OMB MAX database—such as the agency and account—to compile reported totals, such as the government-wide fees total in the Budget of the U.S. Government . Until OMB makes more disaggregated data publicly available, Congress has limited information on collections by agency to inform oversight and decision-making. OMB's government-wide total of fees includes collections that are not fees and excludes some fee collections. The total includes all collections for accounts in which fees make up at least half of the account's collections and excludes all others. OMB does not direct agencies to regularly review and update the accounts included in the total. Therefore, if accounts' makeups change such that fee collections drop below, or rise above, the 50 percent threshold, accounts may have incorrect fee designations and the total may be inaccurate. Further, OMB does not disclose the limitation that the total may exclude some fees and include other collections that are not fees. As a result, some users of the data are likely unaware of the potential for the total fees to be overestimated or underestimated. Further, no source of government-wide data consistently reports data elements on fees, fines, and penalties that could help inform congressional oversight. Generally, congressional staff told us that additional data, such as amounts of specific penalties, would increase transparency and facilitate oversight. These data could help Congress identify trends in collections and significant changes that could be an indication of an agency's performance. While reporting government-wide fee, fine, and penalty data provides benefits, there are trade-offs in terms of the time and federal resources it would take to develop and implement a process for agencies to report these data. The level of federal investment would vary depending on factors, such as the number of data elements included and the level of detail reported. Developing a comprehensive and accessible data source would provide greater benefits, but would likely be resource intensive. Alternatively, incorporating a small number of data elements that Congress identifies as most useful for oversight into ongoing government-wide reporting efforts could incrementally improve transparency and information for oversight and decision-making, with fewer resources. GAO is making four recommendations to enhance OMB reporting on fees, fines, and penalties, including making disaggregated data publically available, updating instructions to federal agencies to review accounts designated as containing fees, and disclosing limitations in data reported. OMB did not provide comments.