prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: The term child nutrition programs refers to several U S  Department of Agriculture Food and Nutrition Service (USDA-FNS) programs that provide food to children in institutional settings  The largest are the National School Lunch Program (NSLP) and School Breakfast Program (SBP), which subsidize free, reduced-price, and full-price meals in participating schools  Also operating in schools, the Fresh Fruit and Vegetable Program provides funding for fruit and vegetable snacks in participating elementary schools, and the Special Milk Program provides support for milk in schools that do not participate in NSLP or SBP  Other child nutrition programs include the Child and Adult Care Food Program, which provides meals and snacks in child care and after-school settings, and the Summer Food Service Program, which provides food during the summer months  The child nutrition programs were last reauthorized by the Healthy, Hunger-Free Kids Act of 2010 (HHFKA, P L  111-296 )  On September 30, 2015, some of the authorities created or extended by the HHFKA expired  However, these expirations had a minimal impact on program operations, as the child nutrition programs have continued with funding provided by annual appropriations acts  In the 114 th Congress, lawmakers began but did not complete child nutrition reauthorization, which refers to the process of reauthorizing and potentially making changes to multiple permanent statutes—the Richard B  Russell National School Lunch Act, the Child Nutrition Act, and sometimes Section 32 of the Act of August 24, 1935  Both committees of jurisdiction—the Senate Committee on Agriculture, Nutrition, and Forestry and the House Committee on Education and the Workforce—reported reauthorization legislation ( S  3136 and H R  5003 , respectively)  This legislation died at the end of the 114 th Congress, as is the case for any bill that has not yet passed both chambers and been sent to the President at the end of a Congress  There were no significant child nutrition reauthorization efforts in the 115 th Congress; however, 2018 farm bill proposals and the final enacted bill included a few provisions related to child nutrition programs  The implementation of the HHFKA, child nutrition reauthorization efforts in the 114 th Congress, and the child nutrition-related topics raised during 2018 farm bill negotiations have raised issues that may be relevant for Congress in future reauthorization efforts or other policymaking opportunities  These issues often relate to the content and type of foods served in schools: for example, the nutritional quality of foods and whether foods are domestically sourced  Other issues relate to access, including alternatives to on-site consumption in summer meals and implementation of the Community Eligibility Provision, an option to provide free meals to all students in certain schools  Stakeholders in these issues commonly include school food authorities (SFAs; school food service departments that generally operate at the school district level), hunger and nutrition-focused advocacy organizations, and food industry organizations, among others  This report provides an overview of these and other current issues in the child nutrition programs  It does not cover every issue, but rather provides a high-level review of some recent issues raised by Congress and/or program stakeholders, drawing examples from legislative proposals in the 114 th and 115 th Congresses   References to CRS reports with more detailed information or analysis on specific issues are provided where applicable, including the following: For an overview of the structure and functions of the child nutrition programs, see CRS Report R43783, School Meals Programs and Other USDA Child Nutrition Programs: A Primer   For more information on the child nutrition reauthorization proposals in the 114 th Congress, see CRS Report R44373, Tracking the Next Child Nutrition Reauthorization: An Overview   For a summary of the HHFKA, see CRS Report R41354, Child Nutrition and WIC Reauthorization: P L  111-296   School meals must meet certain requirements to be eligible for federal reimbursement, including nutritional requirements  These nutrition standards were last updated following the enactment of the HHFKA, which required USDA to update the standards for school meals and create new nutrition standards for "competitive" foods (e g , foods sold in vending machines, a la carte lines, and snack bars) within a specified timeframe  Specifically, the law required USDA to issue proposed regulations for competitive foods nutrition standards within one year after enactment and for school meals nutrition standards within 18 months after enactment  The law also provided increased federal subsidies (6 cents per lunch) for schools meeting the new requirements and funding for technical assistance  The nutrition standards in the HHFKA were championed by a variety of organizations and stakeholders, including nutrition and public health advocacy organizations, food and beverage companies, school nutrition officials, retired military leaders, and then-First Lady Michelle Obama  The precise nutritional requirements were largely written in the subsequent regulations, not the HHFKA  USDA-FNS published the final rule for school meals in January 2012 and the final rule for competitive foods in July 2016  As required by law, the nutrition standards were based on the Dietary Guidelines for Americans and recommendations from the Institute of Medicine (now the Health and Medicine Division of the National Academies)  For school meals, the updated standards increased the amount of fruits, vegetables, and whole grains in school lunches and breakfasts  They also instituted limits on calories, sodium, whole grains, and proteins in meals and restricted milk to low-fat (unflavored) and fat-free (flavored or unflavored) varieties  Other requirements included a provision that senior high school students must select a half-serving of fruits or vegetables with a reimbursable meal  Similarly, the nutrition standards for competitive foods limited calories, sodium, and fat in foods sold outside of meals, among other requirements  The standards applied only to non-meal foods and beverages sold during the school day (defined as midnight until 30 minutes after dismissal) and include some exceptions for fundraisers  The meal standards began phasing in during school year (SY) 2012-2013, and the competitive foods standards took effect in SY2014-2015  However, sodium limits and certain whole grain requirements for school meals were scheduled to phase in over multiple school years  Some schools experienced challenges implementing the changes, reporting difficulty obtaining whole grain and low-sodium products, issues with student acceptance of foods, reduced participation, increased costs, and increased food waste  These accounts were shared in news stories and by the School Nutrition Association (SNA), a national, nonprofit professional and advocacy organization representing school nutrition professionals  Studies by the U S  Government Accountability Office and USDA confirmed that many of these issues were present in SY2012-2013 and SY2013-2014, the first two years of implementation  SNA advocated for certain changes to the standards, while other groups called for maintaining the standards, arguing that they were necessary for children's health and that implementation challenges were easing with time  In January 2014, USDA removed weekly limits on grains and protein  Then, in the FY2015, FY2016, and FY2017 appropriations laws, Congress enacted provisions that loosened the milk, whole grain, and/or sodium requirements from SY2015-2016 through SY2017-2018  USDA implemented similar changes for SY2018-2019 in an interim final rule  In December 2018, USDA published a final rule that indefinitely changes these three aspects of the standards starting in SY2019-2020  Specifically, the rule allows all SFAs to offer flavored, low-fat (1%) milk as part of school meals and as beverages sold in schools, and requires unflavored milk to be offered alongside flavored milk in school meals; requires SFAs to adhere to a 50% whole grain-rich requirement (the original regulations required 100% whole grain-rich starting in SY2014-2015); states may make exemptions to allow SFAs to offer nonwhole grain-rich products; and maintains Target 1 sodium limits from SY2019-2020 through SY2023-2024, implements Target 2 limits starting in SY2024-2025 and thereafter, and eliminates Target 3 limits (the strictest target)  Table 2 provides a timeline from the 2012 final rule to the 2018 final rule, showing the ways in which milk, whole grain, and sodium requirements have been modified over time  Apart from these changes, the nutrition standards for school meals remain largely intact  The changes to the milk requirements also affect other beverages sold in schools; otherwise, the nutrition standards for competitive foods have not been changed substantially  Legislative proposals related to the nutrition standards were considered in the 115 th Congress  For example, the House-passed version of 2018 farm bill (one version of H R  2 ) would have required USDA to review and revise the nutrition standards for school meals and competitive foods  According to the bill, the revisions would have had to ensure that the standards, particularly those related to milk, "(1) are based on research based on school-age children; (2) do not add costs in addition to the reimbursements required to carry out the school lunch program … and (3) maintain healthy meals for students " This provision was not included in the enacted bill  Child nutrition reauthorization proposals in the House and Senate during the 114 th Congress also would have altered the nutrition standards  The House committee's proposal ( H R  5003 ) would have required USDA to review the school meal standards at least once every three years and revise them as necessary, following certain criteria  In addition, under the proposal, fundraisers by student groups/organizations would no longer have had to meet the competitive food standards and any foods served as part of a federally reimbursable meal would have been allowed to be sold a la carte  The Senate committee's proposal ( S  3136 ) would have required USDA to revise the whole grain and sodium requirements for school meals within 90 days after enactment  Although not included in the proposal itself, negotiations between the Senate committee, the White House, USDA, and the School Nutrition Association resulted in an agreement that these revisions, if enacted, would have reduced the 100% whole grain-rich requirement to 80% and delayed the Target 2 sodium requirement for two years  Under current law, fruit and vegetable snacks served in FFVP must be fresh  According to USDA guidance, fresh refers to foods "in their natural state and without additives " In recent years, some have advocated for the inclusion of frozen, dried, canned, and other types of fruits and vegetables in the program, while others have advocated for continuing to maintain only fresh products  Stakeholders on both sides include agricultural producers and processors  The 2014 farm bill (Section 4214 of P L  113-79 ) funded a pilot project that incorporated canned, dried, and frozen (CDF) fruits and vegetables in FFVP in a limited number of states  USDA selected schools in four states (Alaska, Delaware, Kansas, and Maine) that reported difficulty obtaining, storing, and/or preparing fresh fruits and vegetables  According to the final (2017) evaluation, 56% of the pilot schools chose to incorporate CDF fruits and vegetables during an average week of the demonstration  Schools most often introduced dried and canned fruits, which resulted in decreased vegetable offerings and increased fruit offerings in the FFVP  However, there was no significant impact on students' vegetable consumption, while fruit consumption declined on FFVP snack days (likely because students consumed a smaller quantity of fruit when it was dried or canned)  There was also no significant impact on student participation  Student satisfaction with FFVP decreased slightly during the pilot, parents' responses to the pilot were mixed, and school administrators (who opted into the pilot) generally favored the changes  Legislative proposals to change FFVP offerings on a more permanent basis have also been considered  For example, in the 115 th Congress, the House version of H R  2 would have allowed CDF and puréed forms of fruits and vegetables in FFVP and removed "fresh" from the program name  This provision was not included in the enacted bill  In the 114 th Congress, child nutrition reauthorization legislation in the House ( H R  5003 ) included a similar proposal to allow participating schools to serve "all forms" of fruits and vegetables as well as tree nuts  The Senate committee's proposal ( S  3136 ) would have provided temporary hardship exemptions for schools with limited storage and preparation facilities or limited access to fresh fruits and vegetables that would have allowed them to serve CDF fruits and vegetables in FFVP  Such schools would have to transition to 100% fresh products over time  Schools participating in the National School Lunch Program (NSLP) and/or School Breakfast Program (SBP) must comply with federal requirements related to sourcing foods domestically  These requirements are outlined in the school meals programs' authorizing laws and clarified in USDA guidance  Under the Buy American requirements, schools participating in the NSLP and/or SBP in the 48 contiguous states must purchase "domestic commodities or products … to the maximum extent practicable " Statute defines "domestic commodities or products" as those that are both produced and processed substantially in the United States  Accompanying conference report language elaborated that "processed substantially" means the product is processed in the United States and contains over 51% domestically grown ingredients, and this definition is also included in USDA guidance (discussed below)  USDA regulations essentially restate the statutory requirement  USDA has issued guidance on how SFAs and state agencies should implement the Buy American requirements  The most recent guidance (as of the date of this report) was published in a June 2017 memorandum  According to USDA-FNS guidance, the Buy American requirements apply to any foods purchased with funds from the nonprofit school food service account, whether or not they are federal funds (children's paid lunch fees, for example, also go into the nonprofit school food service account)  The guidance encourages SFAs to integrate Buy American into their procurement processes; for example, by monitoring the USDA catalog for appropriate products and placing Buy American language in solicitations, contracts, and other procurement documents  The guidance explains that SFAs are permitted to make exceptions to the Buy American requirements on a limited basis when a product "is not produced or manufactured in the U S  in sufficient and reasonably available quantities of a satisfactory quality" or when "competitive bids reveal the costs of a U S  product are significantly higher than the non-domestic product " SFAs must interpret when this is the case and document any exceptions they make  SFAs may also request a waiver from the requirements for a product that does not meet these criteria  State agencies must review SFAs' compliance with the Buy American requirements, including any exceptions an SFA has made, and take corrective action when necessary  The enacted 2018 farm bill (Section 4207 of P L  115-334 ) included a provision requiring USDA to "enforce full compliance" with the Buy American requirements and "ensure that States and school food authorities fully understand their responsibilities" within 180 days of enactment  In addition, the bill requires USDA to submit a report to Congress by the 180-day deadline on actions taken and plans to comply with the provision  The provision clarifies the definition of domestic products for the purposes of USDA's enforcement, stating that domestic products are those that are "processed in the United States and substantially contain … meats, vegetables, fruits, and other agricultural commodities" produced in the United States, the District of Columbia, Puerto Rico, or any territory or possession of the United States, or "fish harvested" in the Exclusive Economic Zone or by a U S -flagged vessel  The provision in the enacted bill amended a related provision in the Senate-passed version of the farm bill  Proponents of stricter requirements have cited economic and food safety reasons for domestic sourcing and expressed particular concern over sourcing from China  Others have argued for maintaining or increasing schools' discretion in food procurement, arguing that high-quality domestic options are not always available or cost-effective  Under current law, summer meals are generally provided in "congregate" or group settings where children come to eat while supervised  These meals are provided through the Summer Food Service Program (SFSP) and the National School Lunch Program's Summer Seamless Option (SSO)  In recent years, policymakers have weighed different proposals and tested alternatives to congregate meals in SFSP and SSO  Some of these alternatives focus on rural areas, which may face particular barriers to onsite consumption of summer meals  According to a May 2018 study by the U S  Government Accountability Office, states commonly reported that reaching children in rural areas was "very" or "extremely" challenging in SFSP  The 2010 Agriculture Appropriations Act (Section 749(g) of P L  111-80 ) provided $85 million in discretionary funding for "demonstration projects to develop and test methods of providing access to food for children in urban and rural areas during the summer months " One of these is the Summer Electronic Benefit Transfer for Children (SEBTC or Summer EBT) project, which began in summer 2011 and has continued each summer since (as of the date of this report) in a limited number of states and Indian Tribal Organizations  The project provides electronic food benefits to households with children eligible for free or reduced-price school meals  Depending on the site and year, either $30 or $60 per month is provided on an electronic benefits transfer (EBT) card for the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) or Supplemental Nutrition Assistance Program (SNAP)  Participants in jurisdictions providing benefits through SNAP can redeem benefits for SNAP-eligible foods at any SNAP-authorized retailer, while participants in the WIC EBT jurisdictions are limited to the smaller set of WIC-eligible foods at WIC-authorized retailers  An evaluation of Summer EBT was conducted from FY2011 through FY2013  The study, which used a random assignment design, found a significant decline in the prevalence of very low food security among participants (9 5% of control group children experienced very low food security compared to 6 4% in the Summer EBT group)  It also showed improvements in children's consumption of fruits, vegetables, and whole grains  Both the WIC and SNAP models showed increased consumption, but increases were greater at sites operating the WIC model  Congress has provided subsequent funding for Summer EBT projects (see Table 3 )  Most recently, the third FY2019 Consolidated Appropriations Act ( P L  116-6 ) provided $28 million for the Summer EBT demonstration  Awardees for summer 2017 were Connecticut, Delaware, Michigan, Missouri, Nevada, Oregon, Virginia, and the Chickasaw and Cherokee nations  For summer 2018, USDA also awarded grants to Tennessee and Texas  Many of these jurisdictions participated in Summer EBT in previous summers as well  In October 2018, USDA-FNS announced a new strategy for determining grant recipients in FY2019, stating that the agency will prioritize new states that have not participated before, statewide projects, and projects that can operate in the summers of 2019 through 2021  There were proposals in the 114 th and 115 th Congresses to expand Summer EBT  For example, the Senate committee's child nutrition reauthorization proposal in the 114 th Congress ( S  3136 ) would have allowed a portion of SFSP's mandatory funding to cover Summer EBT and authorized up to $50 million in discretionary funding for the program  In addition, in its FY2017 budget proposal, the Obama Administration recommended expansion of Summer EBT nationwide with a phase-in over 10 years  Freestanding bills in the 114 th and 115 th Congresses had similar objectives  Funding from the 2010 Agriculture Appropriations Act (Section 749(g) of P L  111-80 ) was also used for other demonstration projects  One of these, the Enhanced Summer Food Service Program (eSFSP), took place during the summers of 2010 through 2012 in eight states  It included four initiatives: (1) incentives for SFSP sites to lengthen operations to 40 or more days, (2) funding to add recreational or educational activities at meal sites, (3) meal delivery for children in rural areas, and (4) food backpacks that children could take home on weekends and holidays  Evaluations of eSFSP were published from 2011 to 2014  Summer meal participation rates rose during the demonstration periods for all four initiatives  In addition, children in the meal delivery and backpack demonstrations had consistent rates of food insecurity from summer to fall (this was not measured for the other initiatives)  However, the results from these evaluations should be interpreted with caution due to a small sample size, the lack of a comparison group, and potential confounding factors  Another demonstration project, also operating under authority provided by the 2010 Agriculture Appropriations Act, provided exemptions from the congregate feeding requirement to SFSP and SSO outdoor meal sites experiencing excessive heat each summer since 2015 (as of the date of this report)  Exempted sites must continue to serve children in congregate settings on days when heat is not excessive, and provide meals in another form (e g , a take-home form) on days of excessive heat  USDA also offers exemptions on a case-by-case basis for other extreme weather conditions  This demonstration has not been evaluated  There were other proposals and hearings related to congregate feeding in SFSP in recent years  For example, in the 114 th Congress, committee-reported child nutrition reauthorization proposals in the Senate and the House ( S  3136 and H R  5003 , respectively) would have enabled some rural meal sites to provide SFSP meals for consumption offsite  Specifically, both proposals would have allowed offsite consumption for children (1) in rural areas ( H R  5003 to a more limited extent than S  3136 ) and (2) in nonrural areas in which more than 80% of students are certified as eligible for free or reduced-price meals  The bills would have also permitted congregate feeding sites to provide meals to be consumed offsite episodically under certain conditions such as extreme weather or public safety concerns  The HHFKA created the Community Eligibility Provision (CEP), an option to provide free meals (lunches and breakfasts) to all students in schools with high proportions of students who automatically qualify for free or reduced-price lunches  CEP became available to schools nationwide starting in SY2014-2015, and participation has increased since then  As of SY2016-2017, more than 20,700 schools participated in CEP, according to data from the Food Research and Action Center (FRAC), a nonprofit advocacy organization  This is roughly 22% of NSLP schools  Several groups have expressed support for CEP during its implementation, arguing that the provision improves access to meals, reduces stigma associated with receiving free or reduced-price meals, and reduces schools' administrative costs  Others have sought to change the option  For example, in the 114 th Congress, the House's committee-reported child nutrition reauthorization bill ( H R  5003 ) would have restricted schools' eligibility for CEP, which the committee majority argued was "to better target resources to those students in need, while also ensuring all students who are eligible for assistance continue to receive assistance " One secondary effect of CEP is that it has created data issues for other nonnutrition federal and state programs  Many programs, most notably the federal Title I-A program (the primary source of federal funding for elementary and secondary schools), use free and reduced-price lunch data to determine eligibility and/or funding allocations  These data come from school meal applications, which are no longer collected under CEP's automatic eligibility determination process  For more information on this issue, see CRS Report R44568, Overview of ESEA Title I-A and the School Meals' Community Eligibility Provision   Students may qualify for free meals, or they may have to pay for reduced-price or full-price meals  In recent years, the issue of students owing and not paying their meal costs, and schools' responses to such situations, has received increased attention  In many cases, schools serve students a regular meal, charging the unpaid meal cost and creating a debt that they may try to collect later from the family  In other cases, schools respond with what some have called "lunch shaming" practices—most commonly, taking or throwing away a student's selected hot foods and providing an alternative cold meal or, less commonly, barring children from participation in school events until debt is repaid or having children wear a visual indicator of meal debt (e g , a stamp or sticker)  Lunch shaming instances have largely been reported in news articles from different states, and there are limited national data available on the prevalence of such practices (available data are discussed in the text box below)  Many school districts report that unpaid meal costs create a financial burden on their meal programs (see text box below for more detail)  In addition to federal funds, student payments for full and reduced-price meals are a primary source of revenue for school food programs  Schools have an interest in collecting this revenue to help fund operations  Also, according to federal regulations, if schools are unable to recover unpaid meal funds, the money becomes "bad debt" and the school or school district must use other nonfederal funding sources to cover the costs  Starting in 2010, Congress and USDA have taken actions to address the issue of unpaid meal costs  Section 143 of the HHFKA required USDA to examine states' and school districts' policies and practices regarding unpaid meal charges  As part of the review, the law required USDA to "prepare a report on the feasibility of establishing national standards for meal charges and the provision of alternate meals" and, if applicable, make recommendations related to the implementation of the standards  The law also permitted USDA to take follow-up actions based on the findings from the report  USDA's subsequent Report to Congress in June 2016 ultimately did not recommend national standards, but instead recommended "clarifying and updating policy guidance on specific national policies impacting unpaid meal charges and facilitating the development and distribution of best practices to support decision making by States and localities " USDA-FNS followed up with a memorandum requiring SFAs to institute and communicate, by July 1, 2017, a written meal charge policy, which was to include instructions on how to address situations in which a child does not pay for a meal  USDA-FNS also provided clarification through webinars, other memoranda, and a best practice guide  In the Report to Congress, USDA stated that its recommendation was based on findings from a study published by USDA-FNS in March 2014 and a Request for Information (RFI) on "Unpaid Meal Charges" published by USDA-FNS in October 2014  The findings from both the study and the RFI—which garnered 462 comments—showed that meal charge policies were largely determined at the school and school district levels rather than the state level  The responses to the RFI also indicated that such policies ranged in formality, with varying degrees of review (e g , some required school board approval while others did not) and enforcement  In the RFI comments, school and district officials generally expressed a preference for local control of meal charge policies, while national advocacy groups generally favored national standards  The topics of lunch shaming and unpaid meal costs also surfaced in the 115 th Congress  For example, a provision in the FY2018 appropriations law stated that funds appropriated in the law could not be used in ways that result in discrimination against children eligible for free or reduced-price meals, including the practices of segregating children and overtly identifying children by special tokens or tickets (note that this does not pertain to children paying for full-price meals)  Legislative proposals in the 115 th Congress included the Anti-Lunch Shaming Act of 2017 ( H R  2401 / S  1064 ), which sought to establish national standards for how schools treat children unable to pay for a meal  Unpaid meal costs and lunch shaming have also been active topics at the state level  In recent years, a number of states have enacted legislation aimed at addressing these issues  For example, in 2018, Illinois passed legislation that requires schools to serve a regular (reimbursable) meal to students who do not pay and allows school districts to request an offset from the state for debts exceeding $500  The HHFKA created new requirements related to schools' pricing of paid lunches (sometimes referred to as "paid lunch equity" requirements)  Specifically, the law required all NSLP-participating SFAs to review their average price of paid lunches and, if necessary, gradually increase prices based on a formula  The law also gave SFAs the option to meet the requirements with specified nonfederal funding sources instead of raising prices  According to the Senate committee report on the HHFKA, the requirements were intended "to ensure that children receiving free and reduced price lunches receive the full value of federal funds " Prior to the paid lunch equity requirements, a USDA study found that federal subsidies for free and reduced-price lunches were cross-subsidizing other aspects of the meals programs, likely including paid lunches  This can occur because federal reimbursements for free, reduced-price, and paid lunches are all mixed into the same SFA-run "nonprofit school food service account" (NSFSA)  Some observers argue, however, that raising prices may reduce participation in paid lunches  Under the paid lunch equity formula, the price per paid lunch must eventually match or exceed the difference between the federal reimbursements for free and paid lunches  If this is not the case, schools must increase prices over time until they make up the difference  For example, the federal reimbursement was $3 37 for free lunches and $0 37 for paid lunches SY2018-2019 for some schools  Under the requirements, if schools were not charging at least $3 00 per paid lunch, they would be required to increase the price of a paid lunch gradually, based on a formula, until they closed the gap (see Figure 1 )  Schools cannot be required to raise the price by more than 10 cents annually, but they may choose to do so  The HHFKA also included related requirements for revenue from "nonprogram" (i e , competitive) foods  The law required that any revenue from nonprogram foods accrue to the SFA-run NSFSA  In practice, this prevents revenue from competitive foods from being used for other school purposes outside of food service  The law also required that, broadly speaking, revenue from nonprogram foods equal or exceed the costs of obtaining nonprogram foods (see the regulations for a specific formula)  In June 2011, USDA-FNS published an interim final rule implementing the requirements starting in SY2011-2012, offering some flexibility for that first year  USDA subsequently provided certain exemptions through agency guidance for SY2013-2014 through SY2017-2018 for SFAs "in strong financial standing," as determined by state agencies based on different criteria  For SY2018-2019, the enacted FY2018 appropriation (Section 775 of P L  115-141 ) expanded the exemptions, requiring only SFAs with a negative balance in the NSFSA as of January 31, 2018, potentially to have to raise prices for paid meals  Other legislative proposals related to the paid lunch equity requirements were considered in recent Congresses  For example, the House committee's child nutrition reauthorization proposal in the 114 th Congress would have eliminated the requirements  The Senate committee's proposal would have replaced the requirements with a broader "non-federal revenue target," which could have come from household payments for full-price lunches or other state and local contributions  CACFP: Child and Adult Care Food Program CDF: Canned, dried, or frozen CEP: Community Eligibility Provision eSFSP: Enhanced Summer Food Service Program FFVP: Fresh Fruit and Vegetable Program HHFKA: Healthy, Hunger-Free Kids Act NSFSA: Nonprofit school food service account NSLP: National School Lunch Program SBP: School Breakfast Program SFA: School food authority SFSP : Summer Food Service Program SMP: Special Milk Program SSO: Summer Seamless Option Summer EBT or SEBTC : Summer Electronic Benefit Transfer for Children SY: school year USDA-FNS: U S  Department of Agriculture Food and Nutrition Service
Report 2:  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 

ground_truth: Federal agencies are exploring ways to use telework as a tool to reduce the federal footprint and use space more efficiently. GAO was asked to examine the effects of telework on agencies' space-planning efforts. In this report, GAO reviewed: (1) how the 23 civilian CFO Act agencies reported using telework in office space planning; (2) the specific ways selected agencies and GSA used telework in their office space planning; and (3) any challenges the civilian CFO Act agencies faced in using telework in office space planning. GAO surveyed all 23 civilian CFO Act agencies, analyzed each agency's space-planning documents, and Real Property Efficiency Plans . GAO reviewed four agencies in greater detail based on analysis of telework data and other factors. For those four agencies GAO conducted site visits, interviewed officials, and analyzed agency documents. GAO also identified challenges agencies faced in using telework in space planning, based on survey results, agency documents, and interviews. The 23 civilian Chief Financial Officer (CFO) Act agencies reported various ways of considering and using telework as a space-planning tool, by, for example, implementing desk-sharing for employees who telework in order to relinquish leased space, or increasing the number of staff working in an existing space without increasing its size. All of the 23 agencies discussed telework in the context of space planning and achieving greater space efficiencies in either their space-planning documents or Real Property Efficiency Plans . The agencies that used telework as a space-planning tool generally reported implementing smaller or unassigned workstations. Three of the four agencies GAO reviewed in greater detail––the General Services Administration (GSA); the Office of Justice Programs at the Department of Justice; the Centers for Disease Control at the Department of Health and Human Services; and the Bureau of the Fiscal Service at the Department of the Treasury––leveraged telework to reduce or use office space more efficiently. For example, GSA and the Office of Justice Programs used telework to accommodate more employees in a smaller office space as illustrated in figure 1 below. The Centers for Disease Control used telework to accommodate more employees in the same amount of space. The Bureau of the Fiscal Service reduced space without telework by reducing the size of individual workstations. The 23 civilian CFO Act agencies reported several challenges in using telework to reduce space including human capital issues, mission suitability, and measuring cost savings attributable to telework. About two-thirds of the agencies said they would find it helpful to have additional information, assistance, or resources in using telework as a space-planning tool. GSA provides guidance to improve space utilization. However, GAO found that GSA last developed relevant formal guidance in 2006. This information, and that on GSA's telework and space-planning websites, was neither specific nor detailed and therefore of limited assistance to agencies that would like to use telework as a space-planning tool. Additionally, GSA's space-planning tool—the Workplace Investment and Feasibility Tool, intended to help agencies quantify the benefits and costs of telework––remains under development after more than 4 years, and GSA officials have not decided whether to make the tool available to other federal agencies. As such, agencies reported that they lack adequate guidance to determine how best to reduce space or use it more efficiently, and how to assess the benefits and costs of using telework in space planning. GSA concurred with recommendations that GSA should: (1) develop guidance on how agencies can use telework as a strategic space-planning tool and make this guidance readily available and (2) complete and make the Workplace Investment and Feasibility Tool available to federal agencies for use in assessing the benefits and costs of telework.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Implementing Telework: The Telework Enhancement Act of 2010 (the Act) establishes telework implementation requirements for agencies, including, for example, that each agency designate a Telework Managing Officer and that each agency incorporate telework into its continuity of operations plans  The Act does not mention telework specifically in the context of space planning  The Act also requires the Office of Personnel Management (OPM) to assess whether agencies have met agency- established telework outcome goals such as real estate savings  It also requires OPM to submit reports that include executive agencies’ goals for increasing telework participation to the extent practicable, assist each agency with developing qualitative- and quantitative- teleworking measures and goals, and track telework eligibility and participation rates across the government  According to OPM telework information from fiscal year 2012 through fiscal year 2015, the percentage of federal workers eligible to telework remained stable at about 45 percent, on average  However, during the same period, the percentage of eligible employees who participated in telework increased from 29 percent to 46 percent  Figure 1 shows the frequency of telework across the federal government from fiscal years 2012 through 2015 by type of telework  Reducing Space: OMB issued the National Strategy for the Efficient Use of Real Property and the Reduce the Footprint policy in 2015, which require all CFO Act agencies to improve the efficiency of real property use, control costs, and reduce holdings  These OMB initiatives also required agencies to develop Five-Year Real Property Efficiency Plans annually; develop office space standards that specify maximum square footage identify reduction targets for office space in square feet; and freeze the footprint (i e , not increase square footage of office space)  OMB’s National Strategy noted that employee telework has changed the dynamic of the federal real property portfolio and resulted in a need for less space  OMB’s Reduce the Footprint guidance memo states that agencies’ 5-year plans should include an explanation of actions the agency is taking to increase space efficiency, including cost-effective alternatives to acquisition of additional office space, such as consolidation, colocation, teleworking, and “hoteling ” Federal statute also requires that agencies consider whether space needs can be met using alternative workplace arrangements when deciding whether to acquire new space  GSA defines mobility as an overarching term describing the ability of employees, enabled by information technology (IT) and workplace policies to perform work both within and outside the agency worksite  Under this definition, mobility includes telework, desk-sharing, site work, and travel  Agencies can strategically use telework—one form of mobility—combined with desk-sharing and hoteling to reduce space needs and increase efficiency  This allows agencies to plan for fewer workstations than the number of employees  Other space efficiency strategies such as smaller workstations (e g , reduced space standards), reconfigured office space (e g , open-office plans instead of private offices), and mobile technology (e g , laptops, Wi-Fi throughout the office, and smart phones) can be combined with telework and used as planning tools to reduce office space, use space more efficiently, and potentially cut costs  GSA, in a 2010 publication, described a continuum of three different scenarios for the ways agencies may use mobility, including telework  These scenarios range from limited mobility not leveraged for space planning to extensive mobility leveraged for space planning to reduce and use office space more efficiently: (1) No space changes: Some employees telework at least 2 scheduled days per week but retain assigned workstations with no changes to the existing space configuration  (2) No space reduction but different space allocation: Most employees telework at least 2 scheduled days per week and keep assigned workstations  Workstations are smaller and more densely organized; and space freed up by smaller workstations can be used for collaborative work spaces  (3) Space reduction and different space allocation: Nearly all employees telework at least 3 scheduled days per week and participate in hoteling (i e , unassigned workstations), and workstations are also smaller and more densely organized  In this scenario, according to GSA, an agency can redesign its office and potentially reduce space by up to 30 percent  The key factors in distinguishing these scenarios illustrated in figure 2 below include the: level of employee participation in telework; changes to physical office spaces (e g , smaller and more densely organized workstations and more emphasis on collaborative workspaces); and extent to which employees have assigned workstations or participate in desk-sharing  Under federal statute, GSA has a role in promulgating rules and developing guidance promoting the efficient use of real property  For example, the GSA Administrator may provide guidance, assistance, and oversight to client agencies regarding the establishment and operation of alternative workplace arrangements, which include leveraging telework to reduce space needs  GSA also directly assists client agencies with identifying and prioritizing opportunities to improve and implement real- property efficiency measures  In reviewing planning documents, policies, and survey data, we found that the 23 civilian CFO Act agencies reported using telework to reduce or use space more efficiently  Specifically, our analysis of (1) agency-wide space-planning policies and procedures and (2) Real Property Efficiency Plans found that all of the agencies discussed telework in the context of space planning and achieving greater space efficiencies  Agencies also provided examples in survey responses of how they have used telework to increase operational effectiveness while optimizing their use of space  Fifteen agencies’ space-planning policies and procedures included provisions for using telework and other mobility strategies, such as hoteling and desk-sharing, as a strategic space-planning tool  Three of the agencies mentioned these strategies only in the context of space planning, and five agencies did not mention them at all (see table 1)  For the fifteen agencies with space planning policies that incorporated telework, the documents either expressly directed agency planners to include telework, hoteling, or desk-sharing in space planning; provided instructions and guidance for using these in space planning; or issued space allocation standards for their implementation  Several agency-wide space plans identify space reduction goals based on using telework strategically  For example, the Department of Transportation (DOT) documents identify a goal of at least a 10 percent workspace reduction in new acquisitions as a result of compressed work schedules and telework, and specifically state that employees who telework six or more days per pay period should not have a permanent workspace  Agency-wide space planning documents from three civilian CFO Act agencies mentioned telework, hoteling or desk-sharing as strategies in the context of space planning  For example, DOJ’s agency-wide policy notes that telework and hoteling could increase the efficient use of space and directs each sub-agency to maintain its own space design guidelines within agency-wide policy office space standards  The other two agencies, the Department of State and the Nuclear Regulatory Commission, either had a short provisional agency-wide space planning document that laid out space standards or mentioned telework, hoteling and desk-sharing as a tool for creating sustainable space  Five agencies’ space planning documents made no reference to telework; however, one agency, OPM, developed a maximum office space utilization rate and criteria for determining which positions require a private office  As noted above, OMB’s Reduce the Footprint policy (2015) requires agencies to establish Real Property Efficiency Plans  In our analysis of the agencies’ fiscal year 2016 or 2017 plans, we found that 19 of the 23 civilian CFO Act agencies discussed telework in the context of space planning  A few agencies’ Real Property Efficiency Plans explicitly stated that the agency reduced space as a result of telework  For example, GSA used telework to reduce space in its Heartland, Rocky Mountain, and National Capital Region offices  Some (5 of 23) Real Property Efficiency Plans discussed the telework pilot programs agencies have initiated  For example, the Department of Education’s plans reported using a pilot program to acclimate employees to teleworking and desk-sharing; as a result, the agency intends to incorporate hoteling or space-sharing opportunities into proposed space designs in future projects  The Social Security Administration (SSA) plans also reported initiating a pilot program to experiment with smaller “hoteling” workspaces  Similarly, the Nuclear Regulatory Commission’s plan reported conducting a pilot program at its headquarters offices to identify challenges, better understand telework, and evaluate the potential of shared workspaces  In response to our survey, about three-quarters of agencies reported space-planning policies that use telework to reduce office space, lower real estate costs, or reduce the size of individual workstations  Agencies reported accomplishing this by using desk-sharing and hoteling for employees who have relinquished permanent workspaces  For example, several agencies discussed strategies to reduce space in their responses to our survey  The Department of Labor reported using telework to close some small offices resulting in overall space reductions of about 16,000 square feet  OPM reported that it both reduced space and created space efficiencies by transitioning staff in its Eastern Management Development Center to full-time telework and terminating the lease, resulting in a space reduction of about 32,000 square feet  OPM’s Human Resource Solutions Program also achieved a 47 percent space reduction when it instituted desk-sharing and freed the vacated space for use by another program office  The Department of the Treasury reported that its sub-agency, the Internal Revenue Service, has aggressively used telework to help reduce its real property portfolio, while other Treasury units have leveraged telework to achieve significant space reductions  At the end of fiscal year 2016, Treasury reported agency-wide reductions of about 484,000 square feet at a cost savings of about $10 million  Two agencies––Department of Homeland Security, and the National Science Foundation––reported using telework to increase the efficiency of existing office space in sub-agencies by increasing staff without increasing the size of offices, for example: The Department of Homeland Security reported that one of its sub- agencies used telework in the planning and design of a new office, resulting in both a space reduction and more efficient use of the space  The new office is 57,573 square feet smaller than the prior office while personnel assigned to the office increased from 315 to 394  The National Science Foundation reported that it used teleworking, among other workspace strategies such as new space standards and virtual technologies, to increase staff numbers without increasing its real estate footprint  Among the agencies we reviewed in detail—GSA, OJP, CDC, and the Fiscal Service—the use of telework in office space planning varied from emerging consideration to extensive implementation  GSA and OJP have used telework extensively to both reduce space and increase space efficiency in their office spaces  CDC has leveraged telework to reduce space or use space more efficiently in more limited cases while the Fiscal Service has begun to consider telework in future space planning  Appendix II provides additional details on office spaces where these agencies reduced space or used space more efficiently, including the role of telework, if any  GSA has leveraged telework to reduce space by implementing unassigned workstations in nearly all of its regional and headquarters offices, along with other forms of “employee mobility,” complementary IT, and smaller space standards  GSA adopted telework as early as 1999 and by fiscal year 2015, more than 90 percent of all eligible GSA employees teleworked, and nearly half of all employees teleworked 3 or more days per pay period, according to OPM data  GSA’s space policy cites desk-sharing (e g , hoteling, “hot-desking,” or other arrangements) as one strategy to help meet its space standard of 136 useable square feet (USF) per person  GSA employees may telework full-time, but may be required to give up dedicated workstations if they are on site 2 or fewer days per week  GSA has gradually transitioned to unassigned workstations at headquarters and in its regional offices, allowing the agency to implement desk-sharing and calculate space needs at less than one desk per employee  The agency also assigned laptops and mobile or soft phones to employees to further maximize mobility  The three GSA sites we visited used space-planning strategies to achieve, or nearly achieve, GSA’s space standard of 136 USF per person  For example, at its Philadelphia Regional Office, GSA leveraged existing telework levels to meet reduced space standards and move to a smaller leased space by accommodating about 600 employees in fewer than 500 workstations  According to GSA, this allowed the office to achieve a utilization rate of 139 USF per person and realize a reported annual rent cost savings of about $2 million  Similarly, at its New York Regional Office, GSA also leveraged existing telework levels to meet reduced space standards and move to a smaller leased space  This step allowed the office to achieve a utilization rate of 119 USF per person and realize a reported total rent cost savings of nearly $11 million  GSA also leveraged telework as part of its headquarters consolidation  GSA reports that it was able to move approximately 1,000 additional employees to the headquarters building by implementing a hoteling system and planning for less than one workstation per employee  This allowed GSA to achieve a utilization rate of 138 USF per person at its headquarters and realize a reported annual rent-cost savings of approximately $24 million  Similar to GSA, OJP used telework, along with complementary tools, to reduce space and use space more efficiently at its consolidated office  More than 90 percent of eligible employees teleworked in fiscal year 2015, and nearly half of all employees teleworked 3 or more days per pay period, according to OPM data  More recently, OJP reported that around 70 percent of its employees teleworked in August 2017, with just less than 40 percent doing so three or more days per pay period  At the departmental level, DOJ’s plans to improve space utilization include reduced space requirements, and, in some cases, alternative workplace strategies  DOJ’s space utilization policy mentions telework with hoteling as one way to increase efficient use of space, and DOJ’s telework policy mentions the potential of telework to create cost savings by decreasing space needs  While most OJP employees are eligible to telework, a few federal staff occupying administrative positions are not eligible  OJP took the opportunity to examine and improve its space use as three of its leases approached expiration in 2013  It leased space in two adjacent buildings under three separate leases  OJP worked with GSA to analyze space-planning options, contracting a study of the office that recommended ways to improve space utilization  This study included a survey of all employees, a complete physical space survey, and interviews with leadership  The results of this study not only indicated OJP employees’ openness to more mobility but also that they had concerns such as loss of privacy and social connectedness  For example, more than 80 percent of survey respondents said they could work off-site more often with proper tools and support, and almost half said they would give up dedicated space to work remotely more often  Furthermore, interviews with the leadership of several OJP units indicated a willingness to support increased mobility but also a need to maintain privacy and improve mobile IT  According to OJP, it alleviated these concerns by encouraging participation in the planning process, highlighting opportunities for positive changes, and maintaining open communication (e g , communicating changes and expected benefits)  Based on the analysis of space-planning options, OJP retained one of the three previous leases and leveraged telework to accommodate all employees into less space overall in one building  OJP achieved this objective by targeting 25 percent employee mobility and implementing hoteling  Concurrently, OJP officials explained that they introduced smaller workstations and used tenant-improvement allowance funds to reconfigure space for more flexible use  Physical reconfigurations included changing hard-walled office spaces with dedicated workstations to a primarily open office with few walls or dedicated workstations  According to OJP, it complemented these changes with investments in mobile IT for individual employees, improved IT capabilities in conference rooms and other collaborative spaces, and an emphasis on training employees to work well in a mobile office environment  For example, OJP officials said they installed Wi-Fi throughout the space, issued laptops and smart phones to employees, upgraded video-conferencing capabilities in conference rooms and collaborative spaces, and expanded tools for informal employee communication  According to OJP officials, through the consolidation, they said they achieved a utilization rate of 190 USF per person—a decrease of 30 USF per person from the prior 220 utilization rate  This rate remained higher than DOJ’s overall target and housed the same total number of employees—about 1,000—in about 50,000 fewer USF  OJP reports that the consolidation resulted in an estimated $3 million annual lease- cost savings  OJP also estimates additional savings from reduced transit subsidies, carbon emissions, and continuity of operations  Relative to GSA and OJP, CDC has made more limited use of telework in office space-planning  CDC officials told us that they have leveraged telework as a space-planning tool in many locations, but they have only documented doing so in one case  HHS expects each sub-agency to comply with its 170 USF per-person utilization-rate policy, and this policy suggests that planned space reductions should take telework into account  As a component of HHS, CDC has its own space policy, which states that telework, desk-sharing, and hoteling can help CDC’s units meet HHS’s utilization rate policy of 170 USF per person  CDC’s telework policy requires employees who telework frequently to agree to participate in desk-sharing, but according to CDC officials, how and to what extent this portion of the broader policy is implemented is up to the discretion of management  CDC officials cited two limitations to further implementing space sharing techniques: (1) the large number of employees’ who may be unable to telework on certain days based upon their job responsibilities and (2) the voluntary nature of telework  Some CDC employees cannot work off-site at least some of the time due to confidential data or lab-based work  Approximately 60 percent of eligible CDC employees teleworked in fiscal year 2015 and about one-quarter of all employees teleworked 3 or more days per pay period, according to OPM data  CDC officials told us that telework participation ranges from 49 to 86 percent across CDC units  CDC’s National Center for Chronic Disease Prevention and Health Promotion’s office in Chamblee, GA, provides the most clearly documented case of CDC’s leveraging telework for space efficiency  According to CDC officials, this unit accommodated more than 300 additional employees within its existing space by implementing hoteling for employees who telework 4 or more days per pay period, and it continues to use hoteling as part of its space management strategy  In contrast, CDC’s National Center for Health Statistics’ (NCHS) office in Hyattsville, MD, reduced space without leveraging telework by reconfiguring the space with smaller, soft-walled workstations  CDC officials told us that NCHS reduced its office space from seven floors to three and three-quarters floors, resulting in a reported space reduction of more than 40 percent and allowing it to achieve a 170 USF per person utilization rate  CDC officials reported that this space reduction resulted in annual rent cost savings of approximately $1 million  Hoteling was not feasible at this location because work on confidential data limits the ability of employees to work off-site, and NCHS employees also prefer dedicated workstations  CDC officials said that there is limited documentation of any additional cases of CDC’s leveraging telework as a space- planning tool because, prior to our review, there had been no formal request to connect telework and space utilization data  In contrast to GSA, OJP, and CDC, telework as a space-planning tool is an emerging consideration at the Fiscal Service  At the departmental level, Treasury has space standards that aim for efficient and effective offices that use increased telework and shared workstations to minimize the number of dedicated workstations  Similarly, objectives of the Fiscal Service telework policy include cost savings from reduced office space needs  Treasury’s space standards specify a planned maximum utilization rate of 200 USF per person for facilities with general office space, and the Fiscal Service reported that its average office space-utilization rate was 183 USF per person at the time of our review  Treasury policy also recommends hoteling for employees who are out of the office 80 or more hours per month, but the Fiscal Service told us that it would like to conduct additional desk-sharing pilots to assess their impact before negotiating broader desk-sharing with the union  At the Fiscal Service, approximately 80 percent of eligible employees teleworked in fiscal year 2015, and about one-quarter of all employees teleworked 3 or more days per pay period, according to OPM data  The Fiscal Service reported that approximately 80 percent of Fiscal Service employees telework at its Washington, D C , Maryland, and West Virginia locations  At the time of our review, the Fiscal Service officials said the agency had reduced space without leveraging telework or implementing hoteling, instead relying on smaller space standards (i e , fewer square feet per workstation) to lease smaller offices  For example, the Fiscal Service reduced space by giving up several floors at its Hyattsville, MD, office starting in 2012  According to Fiscal Service officials, they accomplished these reductions by consolidating data centers to other locations, conducting targeted buyouts of employees, and, most recently, by implementing a new space standard of 183 USF per person through smaller workstations  The officials said that the most recent space reduction at this location resulted in savings in annual rent costs not attributable to telework  Looking forward, the Fiscal Service reported that it has started taking preliminary steps to promote efficient space utilization through telework  These steps have included: creating an Executive Space Management Council that discussed incorporating telework and desk-sharing into space management guidelines; implementing a voluntary, informal desk-sharing pilot in one program area for employees who already telework 50 percent or more of the time; and seeking information from GSA, including discussing and visiting GSA offices that have implemented hoteling as part of their space planning model  In addition, the Fiscal Service officials told us that the agency plans to negotiate the impact and implementation of desk-sharing and hoteling for telework employees with its union, but the Fiscal Service has not yet begun this effort  Our analysis of the survey responses from the 23 civilian CFO Act agencies identified three major planning challenges agencies face with using telework to reduce space: human capital issues such as negotiating workspace changes with collective bargaining units and managing organizational change; the suitability of telework to mission work requirements; and difficulty measuring cost savings that might result from space reductions attributable to telework  This measuring difficulty may include both gross savings as well as savings net of costs, such as for renovations or IT investments  See table 3 for examples of space-planning challenges related to telework reported by the 23 agencies  To address these challenges, nearly two thirds of the agencies we surveyed reported they would like guidance on using telework programs or other alternatives to meet the federal goals of reducing space or using space more efficiently  Our review of agency survey responses, Real Property Efficiency Plans, and other agency space-planning documents, found that human capital challenges to using telework in space planning generally fell into two categories: (1) requirements to negotiate space allocation changes with collective-bargaining units; and (2) managing department workforces in adapting to new workspace designs and altered workspace allocations  Collective-bargaining challenges: Of the 23 civilian CFO Act agencies, 7 of 23 noted that changes to telework policy or workspace arrangements required negotiation with collective bargaining units, for example, The Small Business Administration (SBA) reported its greatest challenge to incorporating telework in office space planning has been with negotiating and securing agreement from all parties, including management and its union, on establishing space standards  HUD reported that it could not implement hoteling or desk-sharing as its collective-bargaining agreements require that each employee retain an assigned workstation regardless of an employee’s type of telework agreement  SSA reported that changing floor plans required negotiation with its three collective-bargaining units, which could extend the time needed for construction and relocation  DOT reported that collective-bargaining agreements posed a challenge to incorporating workforce mobility options, including telework  In addition, the collective-bargaining agreements we reviewed from the four agencies we reviewed in detail––GSA, OJP, CDC and Fiscal Service––required negotiations or the opportunity to negotiate changes to matters relating to workspace arrangements and in some cases, to telework policy  Managing change: Using telework as a strategic space-planning tool, particularly in conjunction with complementary space-saving efforts such as desk-sharing, hoteling, or open-space designs, generally involves a cultural change  Nine of the 23 agencies we surveyed reported challenges associated with managing change  For example, three agencies reported employees’ discomfort or apprehension about desk-sharing and hoteling  In 2013, we reported that organizations may also encounter concerns from agency leaders, managers, employees, or employee organizations when introducing physical space changes associated with increased workforce mobility (telework)  More recently, we reported that management concerns remain the most frequently reported barrier to expanding telework  Two private sector experts we met with underscored the importance of management “buy-in” saying it was imperative that senior executives fully support the initiative to facilitate the necessary cultural change for agencies to use telework in space planning  One noted that management needed to make the business case to employees so that each layer of the organization could understand the importance of the initiative and its potential benefits  Another suggested a change management plan tailored to the work performed within a unit  This individual said that key components of such a plan might include studying existing work practices and program requirements, surveying employee preferences, and including employees in the planning process  Further, a GSA document circulated in response to the Telework Enhancement Act of 2010 mentions obtaining supervisory “buy-in” or support as key to facilitating change  According to survey responses, within agencies there are sub-agencies that have individual mission requirements that may or may not be suitable for telework  This makes it difficult for agencies to implement overarching telework and space planning policies that apply department-wide  Sub- agencies and units within sub-agencies must individually determine if telework is appropriate given their particular mission requirements  For example, the Veterans Administration reported that although it developed an agency-wide telework policy, each sub-agency and supervisor has the flexibility to implement telework based on operational needs  Moreover, because the agency’s core mission involves direct services to veterans, about 83 percent of agency staff positions are not suitable for telework  The Telework Enhancement Act of 2010 outlines two broad exceptions to telework participation for employees: (1) directly handling secure materials determined to be inappropriate for telework by the agency head and (2) on-site activity that cannot be handled remotely or at an alternative worksite  In cases where telework does not support an agency’s mission or where a particular mission may require increases or decreases in personnel, telework as a strategic space-planning tool may not work  About half (12 of 23) of the agencies we surveyed reported that office space reductions resulting from using telework in space planning led to real estate cost savings while the other half reported either that cost savings did not result or they did not know  GSA officials told us that calculating cost savings attributable to a particular aspect of space planning is complicated as several factors contribute to savings  In particular, in survey responses, the Departments of Education, Energy, and Agriculture reiterated this point  OMB’s National Strategy for the Efficient Use of Real Property and its Reduce the Footprint policy encourage agencies to increase and maximize efficiencies in office space by implementing cost-effective strategies such as telework  For example, the National Strategy outlines a framework that aims to measure real property costs and utilization to improve the efficient use of federal real property  The Reduce the Footprint policy requires agencies to measure cost savings that result from reducing space through disposals  However, neither document offers guidance or methodologies on how to measure the costs or savings that may result from using telework  We previously reported that GSA works with client agencies to develop tools to measure office space utilization and, in 2013, was developing an Excel-based tool to help agencies quantify the benefits and costs of using telework to achieve greater office space efficiencies  This tool—the Workplace Investment and Feasibility Tool—is aimed at helping agencies quantify the benefits and costs of increased telework participation and implementing other alternative-work arrangements  When completed, the tool will enable users to quickly develop rough estimates of cost and space impacts resulting from workplace changes, particularly relating to desk-sharing, workspace reconfiguration, and consolidation  Key features include the ability to compare up to three scenarios, which in turn may be used to inform a more detailed design program  As of January 2018, GSA had not yet completed the tool  GSA officials said mission needs, resource constraints, and developmental adjustments have contributed to delays in the time frame for completing the tool  They added that during this time, GSA has diverted resources to space calculation tools for individual agencies  For example, GSA worked with DHS on its Space Calculation Tool as a way to help determine workplace space requirements in a manner consistent with DHS space policies  In January 2018, GSA officials told us that they plan to make the Workplace Investment and Feasibility Tool available to GSA staff in March 2018 along with training on how to use it  However, GSA officials have not decided whether to make the tool available to other federal agencies to use as a space-planning tool  Instead, the officials plan to assess GSA’s use of the tool and then determine in late 2018 if and how it should be released to other agencies for independent use  Given the absence of a government-wide tool, in our review, we found that some agencies had used their own resources to purchase similar tools for their space-planning needs from the private sector  Without such a government-wide resource, agencies may not be able to determine how best to reduce space or use it more efficiently  In responses to our survey, nearly two-thirds of agencies reported that they would find it helpful to have additional information, assistance, or resources to assist them in using telework as a space-planning tool  As noted above, a key element of GSA’s mission is to provide guidance and services that enable agencies to improve space utilization, reduce costs, and better achieve their missions  Moreover, under federal statute, GSA may provide guidance to executive agencies on the implementation of alternative workplace arrangements, which includes telework  Federal standards for internal control also call for agencies to communicate necessary quality information such as guidance with external parties  In reviewing GSA’s websites, we found that GSA last developed formal guidance on alternative workplace arrangements in 2006 and maintains several separate informational websites on implementing telework and optimizing space utilization  Our review of this guidance and these websites found that they do not provide specific guidance for using telework as a strategic space-planning tool  For example, the 2006 guidance is generally limited to defining the factors agency heads must contemplate when considering alternative workplace arrangements along with the equipment and technical services agencies may provide for alternative worksites  However, this guidance does not address in detail the impact of such arrangements on agency office space and resulting planning issues  Similarly, our review of GSA’s teleworking and space- planning websites found that although they separately offered documented case studies along with information such as tips for implementing telework and managing a mobile workforce, GSA did not provide documents consolidating the concept of using telework as a strategic space-planning tool  For example, information on GSA’s Total Workplace Program website––intended to assist agencies in using workforce mobility (including telework) to increase space efficiencies––is generally limited  Although this website includes high-level information that describes the potential benefits of using telework with office space planning and design, it lacks a practical outline of the process agencies might use to achieve them  Because the information in the 2006 guidance and the telework and space-planning websites is neither specific nor detailed, it is of limited assistance for agencies that would like to use telework as a strategic space-planning tool to meet the goals of a more efficient use of space  While using telework to reduce space is not a new challenge, it has become more pressing with OMB’s requirement for federal agencies to explore alternatives to acquiring more office space  Most civilian CFO Act agencies reported having a telework program in place and some reported success with using it in space planning to reduce space or accommodate more employees without increasing space  However, many of the agencies continue to face challenges and do not believe that they have adequate information, assistance, or resources to assist them in using telework as a space-planning tool or assess its costs and benefits  Until agencies have access to detailed guidance and tools to help utilize various space-planning options, they may not be able to effectively identify opportunities to use telework toward the goal of reducing their real property footprint  We are making the following two recommendations to GSA: The Administrator of General Services should ensure that the appropriate GSA offices develop guidance including, but not limited to, how agencies can use telework as a strategic space-planning tool for reducing and optimizing office space efficiency and that the offices make the guidance readily available  (Recommendation 1) The Administrator of General Services should ensure the appropriate GSA offices complete the Workplace Investment and Feasibility Tool and make it available to federal agencies for use in assessing the benefits and costs of telework to achieve office space efficiencies  (Recommendation 2) We provided a draft of this report to GSA, the Department of Justice, the Department of Health and Human Services, and the Department of the Treasury  In its written comments, reproduced in Appendix III, GSA concurred with our recommendations and stated that it is developing a plan to address them  We received technical comments from the Department of Justice and the Department of Health and Human Services, which we incorporated where appropriate  The Department of the Treasury did not have comments on our draft report  We are sending copies of this report to the appropriate congressional committees; the Administrator of GSA; and the Secretaries of the Department of Health and Human Services and Department of the Treasury, and the Attorney General of the Department of Justice  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff has any questions concerning this report, please contact me at (202) 512-2834 or rectanusl@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff that made key contributions to this report is listed in appendix III  This report addresses: (1) how the 23 civilian Chief Financial Officer (CFO) Act agencies reported using telework in office space planning; (2) the specific ways selected agencies and GSA used telework in their office space planning; and (3) any challenges the 23 civilian CFO Act agencies faced in using telework in office space planning  To determine how the 23 civilian CFO Act agencies reported using telework in office space planning, we surveyed the agencies  The survey asked questions about agency-wide efforts to use telework in the human- capital and space-planning areas; whether agencies had achieved any cost savings as a result; the challenges agencies faced in using telework in space planning; and asked agencies to identify additional information, resources, or guidance that might be helpful  In addition to the survey questions, we asked each agency real property officer to provide copies of agency-wide space-planning documents and the Real Property Efficiency Plans agencies prepared for fiscal years 2016 and 2017 pursuant to the requirements of the Office of Management and Budget’s (OMB) Reduce the Footprint policy  We developed survey questions based on our review of the relevant literature, white papers from federal agencies and private sector entities, and past GAO reports  We pre- tested the survey instrument with three federal agencies to ascertain: (1) the clarity of survey questions; (2) the precision of language; and 3) the availability of information queried  As a result of the pre-tests we made changes to the content and format of the survey where appropriate  We received survey responses from each of the 23 civilian CFO Act agencies in addition to requested space-planning documents and Real Property Efficiency Plans, and thus achieved a 100 percent response rate  We analyzed survey results by calculating the frequency of responses to dichotomous questions (i e , questions requiring a “yes” or “no” answer)  We also conducted a content analysis on the open-ended, narrative-based questions by identifying common themes and tabulating results  We also conducted a content analysis to determine the extent to which agencies referenced telework in their agency-wide space-planning documents and in their Real Property Efficiency Plans  To accomplish these analyses, we developed separate coding schemes for each of the two types of documents  These were based on information obtained in our literature review, interviews with subject matter experts, and our professional judgment  We then identified relevant sections and common themes, and coded and tabulated the results  To validate the coding results, we used a second, independent coder  To determine the specific ways agencies include telework in their office space planning, we selected a non-generalizable sample of three CFO Act agency sub-agencies as illustrative case studies  To select sub- agencies, we analyzed data from the Office of Personnel Management’s (OPM) Public Use 2014-2015 Telework Data call  First, we applied two selection criteria: (1) agency-wide progress toward a stated goal of using telework to reduce real estate costs, and (2) agency-reported data indicating that more than 25 percent of sub-agency employees teleworked 3 or more days per pay period  Next, we considered variations in sub-agency size and percentage of employees eligible to telework  Finally, we excluded candidates that had recently been selected for related GAO work and we excluded sub-agencies related to agency administration such as Offices of Inspector General or Secretary-level offices  We assessed the reliability of the OPM’s data by interviews with knowledgeable officials and by reviewing prior assessments of the same data, and we found the data reliable for our purposes  As a result of this process, we selected (1) the Department of the Treasury’s Bureau of the Fiscal Service (Fiscal Service); (2) the Department of Health and Human Services’ (HHS) Centers for Disease Control and Prevention (CDC); and (3) the Department of Justice’s Office of Justice Programs (OJP)  For each of the selected agencies, we interviewed agency officials and reviewed their telework and space- planning documents  We also visited four sub-agency office locations to determine if and how telework played a role in any space reductions or efficiencies along with any associated cost savings  In addition to these three sub-agencies, we used the General Services Administration (GSA) as a comparative example since it is responsible for providing space- planning guidance to client agencies and has experience using telework in space planning  We interviewed GSA officials, reviewed relevant documents, and visited three GSA office locations with recent space reductions or efficiencies  In total, we conducted seven site visits including two Fiscal Service locations, one location each for CDC and OJP, and three GSA locations (National Headquarters, Region 2 Office, and Region 3 Office) in Washington, D C ; New York City; and Philadelphia, respectively  To identify any challenges the 23 civilian CFO Act agencies faced in using telework in office space planning, we analyzed results from survey questions addressed to challenges, interviewed sub-agency and GSA officials as detailed above, interviewed two private sector subject matter experts, and representatives from four private-sector entities that had reported using telework to reduce and use office space more efficiently  Statements made by knowledgeable federal officials, outside experts and private sector entities are not generalizable to the universe of civilian CFO Act agencies  We also analyzed the section of each of the 23 civilian CFO Act agencies’ Real Property Efficiency Plans devoted to challenges agency face in reducing space  We selected the two subject matter experts––representatives from Global Workplace Analytics and Fentress Facility Planning and Analytics––based on: (1) their experience working with federal agencies to incorporate telework programs into the space planning process; (2) information compiled in our literature review; (3) prior GAO reports; (4) internal GAO recommendations; and (5) industry recommendations  We selected the four private sector entities (AT&T, Deloitte, Adobe, and CapitalOne) based on our literature review, recommendations from industry experts, and reports of having achieved space efficiencies including space reduction, cost savings, or cost avoidance(s)  To identify what guidance or information on using telework as a space- planning tool GSA makes available through its website, we reviewed the contents of multiple GSA websites including Telework, Total Workplace, Alternative Work, and GSA Telework Resources  We followed links and reviewed webpage contents for information on how agencies might use telework as a strategic tool to reduce space or use space more efficiently  We compared GSA’s guidance and website information to relevant statutory requirements and federal internal controls standards related to external communication  We conducted this performance audit from January 2017 to March 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the contact named above, David J  Wise (Director); Amelia Bates Shachoy (Assistant Director); Lindsay Bach (Analyst-in-Charge); Geoff Hamilton; Malika Rice; Kelly Rubin; Shelia Thorpe; Elise Vaughan Winfrey; and Amelia Michelle Weathers made key contributions to this report 


Report 2:  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 

ground_truth: The term child nutrition programs refers to several U.S. Department of Agriculture Food and Nutrition Service (USDA-FNS) programs that provide food for children in institutional settings. These include the school meals programs—the National School Lunch Program and School Breakfast Program—as well as the Child and Adult Care Food Program, Summer Food Service Program, Special Milk Program, and Fresh Fruit and Vegetable Program. The most recent child nutrition reauthorization, the Healthy, Hunger-Free Kids Act of 2010 (HHFKA; P.L. 111-296), made a number of changes to the child nutrition programs. In some cases, these changes spurred debate during the law's implementation, particularly in regard to updated nutrition standards for school meals and snacks. On September 30, 2015, some of the authorities created by the HHFKA expired. Efforts to reauthorize the child nutrition programs in the 114th Congress, while not completed, considered several related issues and prompted further discussion about the programs. There were no substantial reauthorization attempts in the 115th Congress. Current issues discussed in this report include the following: Nutrition standards for school meals and snacks. The HHFKA required USDA to update the nutrition standards for school meals and other foods sold in schools. USDA issued final rules on these standards in 2012 and 2016, respectively. Some schools had difficulty implementing the nutrition standards, and USDA and Congress have taken actions to change certain parts of the standards related to whole grains, sodium, and milk. Offerings in the Fresh Fruit and Vegetable Program (FFVP). There have been debates recently over whether the FFVP should include processed and preserved fruits and vegetables, including canned, dried, and frozen items. Currently, statute permits only fresh offerings. "Buy American" requirements for school meals. The school meals programs' authorizing laws require schools to source foods domestically, with some exceptions, under Buy American requirements. Efforts both to tighten and loosen these requirements have been made in recent years. The enacted 2018 farm bill (P.L. 115-334) instructed USDA to "enforce full compliance" with the Buy American requirements and report to Congress within 180 days of enactment. Congregate feeding in summer meals. Under current law, children must consume summer meals on-site. This is known as the "congregate feeding" requirement. Starting in 2010, Congress funded demonstration projects, including the Summer Electronic Benefit Transfer (EBT) demonstration, to test alternatives to congregate feeding in summer meals. Congress has increased funding for Summer EBT in recent appropriations cycles and there have been discussions about whether to continue or expand the program. Implementation of the Community Eligibility Provision (CEP). The HHFKA created CEP, an option for qualifying schools, groups of schools, and school districts to offer free meals to all students. Because income-based applications for school meals are no longer required in schools adopting CEP, its implementation has created data issues for federal and state programs relying on free and reduced-price lunch eligibility data. Unpaid meal costs and "lunch shaming." The issue of students not paying for meals and schools' handling of these situations has received increasing attention. Some schools have adopted what some term as "lunch shaming" practices, including throwing away a student's selected hot meal and providing a cold meal alternative when a student does not pay. Congress and USDA have taken actions recently to reduce instances of student nonpayment and stigmatization. Paid lunch pricing. One result of new requirements in the HHFKA was price increases for paid (full price) lunches in many schools. Attempts have been made—some successfully—to loosen these "paid lunch equity" requirements in recent years.