prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: Concerned that the federal government was more focused on program activities and processes than the results to be achieved, Congress passed the Government Performance and Results Act of 1993 (GPRA)  GPRA sought to focus federal agencies on performance by requiring agencies to develop long-term and annual goals, and measure and report on progress towards those goals annually  Based on our analyses of the act’s implementation, we concluded in March 2004 that GPRA’s requirements had laid a solid foundation for results-oriented management  At that time, we found that performance planning and measurement had slowly yet increasingly become a part of agencies’ cultures  For example, managers reported having significantly more performance measures in 2003 than in 1997, when GPRA took effect government-wide  However, the benefit of collecting performance information is fully realized only when that information is actually used by managers to make decisions aimed at improving results  Although our 2003 survey found greater reported availability of performance information than in 1997, it also showed managers’ use of that information for various management activities generally had remained unchanged  Based on those results, and in response to a request from Congress, in September 2005, we developed a framework intended to help agencies better incorporate performance information into their decision making  As shown in figure 1, we identified five leading practices that can promote the use of performance information for policy and program decisions; and four ways agency managers can use performance information to make program decisions aimed at improving results  Our September 2005 report also highlighted examples of how agencies had used performance information to improve results  For example, we described how the Department of Transportation’s National Highway Traffic Safety Administration used performance information to identify, develop, and share effective strategies that increased national safety belt usage—which can decrease injuries and fatalities from traffic accidents— from 11 percent in 1985 to 80 percent in 2004  Subsequently, the GPRA Modernization Act of 2010 (GPRAMA) was enacted, which significantly expanded and enhanced the statutory framework for federal performance management  The Senate Committee on Homeland Security and Governmental Affairs report accompanying the bill that would become GPRAMA stated that agencies were not consistently using performance information to improve their management and results  The report cited the results of our 2007 survey of federal managers  That survey continued to show little change in managers’ use of performance information  The report further stated that provisions in GPRAMA are intended to address those findings and increase the use of performance information to improve performance and results  For example, GPRAMA requires certain agencies to designate a subset of their respective goals as their highest priorities—known as agency priority goals—and to measure and assess progress toward those goals at least quarterly through data-driven reviews  Our recent work and surveys suggest that data-driven reviews are having their intended effect  For example, in July 2015, we found that agencies reported that their reviews had positive effects on progress toward agency goals and efforts to improve the efficiency of operations, among other things  In addition, for those managers who were familiar with their agencies’ data-driven reviews, our 2013 and 2017 surveys showed that the more managers viewed their programs as being subject to a review, the more likely they were to report their agencies’ reviews were driving results and conducted in line with our leading practices  Recognizing the important role these reviews were playing in improving data-driven decision making, our management agenda for the presidential and congressional transition in 2017 included a key action to expand the use of data-driven reviews beyond agency priority goals to other agency goals  More broadly, our recent surveys of federal managers have continued to show that reported government-wide uses of performance information generally have not changed or in some cases have declined  As we found in September 2017, and as illustrated in figure 2, the 2017 update to our index suggests that government-wide use of performance information did not improve between 2013 and 2017  In addition, it is statistically significantly lower relative to our 2007 survey, when we created the index  Moreover, in looking at the government-wide results on the 11 individual survey questions that comprise the index, we found few statistically significant changes in 2017 when compared to (1) our 2013 survey or (2) the year each question was first introduced  For example, in comparing 2013 and 2017 results, two questions had results that were statistically significantly different: The percentage of managers who reported that employees who report to them pay attention to their agency’s use of performance information was statistically significantly higher (from 40 to 46 percent)  The percentage of managers who reported using performance information to adopt new program approaches or change work processes was statistically significantly lower (from 54 to 47 percent)  As we stated in our September 2017 report, the decline on the latter question was of particular concern as agencies were developing plans to improve their efficiency, effectiveness, and accountability, as called for by an April 2017 memorandum from OMB  In early 2017, the administration announced several efforts intended to improve government performance  OMB issued several memorandums detailing the administration’s plans to improve government performance by reorganizing the government, reducing the federal workforce, and reducing federal agency burden  As part of the reorganization efforts, OMB and agencies were to develop government-wide and agency reform plans, respectively, designed to leverage various GPRAMA provisions  For instance, the April 2017 memorandum mentioned above stated that OMB intends to monitor implementation of the reforms using, among other things, agency priority goals  While many agency-specific organizational improvements were included in the President’s fiscal year 2019 budget, released in February 2018, OMB published additional government-wide and agency reform proposals in June 2018  The President’s Management Agenda (PMA), released in March 2018, outlines a long-term vision for modernizing federal operations and improving the ability of agencies to achieve outcomes  To address the issues outlined in the PMA, the administration established a number of cross-agency priority (CAP) goals  CAP goals, required by GPRAMA, are to address issues in a limited number of policy areas requiring action across multiple agencies, or management improvements that are needed across the government  The PMA highlights several root causes for the challenges the federal government faces  Among them is that agencies do not consistently apply data-driven decision-making practices  The PMA states that smarter use of data and evidence is needed to orient decisions and accountability around service and results  To that end, in March 2018, the administration established the Leveraging Data as a Strategic Asset CAP goal to improve the use of data in decision making to increase the federal government’s effectiveness  Over the past 25 years, various organizations, roles, and responsibilities have been created by executive action or in law to provide leadership in federal performance management  At individual agencies and across the federal government, these organizations and officials have key responsibilities for improving performance, as outlined below  OMB: At least every four years, OMB is to coordinate with other agencies to develop CAP goals—such as the one described earlier on leveraging data as an asset—to improve the performance and management of the federal government  OMB is also required to coordinate with agencies to develop annual federal government performance plans to define, among other things, the level of performance to be achieved toward the CAP goals  Following GPRAMA’s enactment, OMB issued guidance for initial implementation, as required by the act, and continues to provide updated guidance in its annual Circular No  A-11, additional memorandums, and other means  Chief Operating Officer (COO): The deputy agency head, or equivalent, is designated as the COO, with overall responsibility for improving agency management and performance through, among other things, the use of performance information  President’s Management Council (PMC): The PMC is comprised of OMB’s Deputy Director for Management and the COOs of major departments and agencies, among other individuals  Its responsibilities include improving overall executive branch management and implementing the PMA  Performance Improvement Officer (PIO): Agency heads designate a senior executive as the PIO, who reports directly to the COO  The PIO is responsible for assisting the head of the agency and COO to ensure that agency goals are achieved through, among other things, the use of performance information  Performance Improvement Council (PIC): The PIC is charged with assisting OMB to improve the performance of the federal government  It is chaired by the Deputy Director for Management at OMB and includes PIOs from each of the 24 Chief Financial Officers Act agencies, as well as other PIOs and individuals designated by the chair  Among its responsibilities, the PIC is to work to resolve government-wide or cross-cutting performance issues, and facilitate the exchange among agencies of practices that have led to performance improvements  Previously, the General Service Administration’s (GSA) Office of Executive Councils provided analytical, management, and administrative support for the PIC, the PMC, and other government-wide management councils  In January 2018, the office was abolished and its functions, staff, and authorities, along with those of the Unified Shared Services Management Office, were reallocated to GSA’s newly created Shared Solutions and Performance Improvement Office  As at the government-wide level—where, as described earlier, the use of performance information did not change from 2013 to 2017—managers’ reported use of performance information at most agencies also did not improve since 2013 (illustrated in figure 3)  At the agency level, 3 of the 24 agencies had statistically significant changes in their index scores—1 increase (National Science Foundation) and 2 decreases (Social Security Administration and the Office of Personnel Management)  Also, in 2017, 6 agencies had results that were statistically significantly different—4 higher and 2 lower—than the government-wide average (see sidebar)  Throughout the report, we highlight two different types of statistically significant results—changes from our last survey in 2013 and differences from the 2017 government-wide average  The former indicates when an agency’s reported use of performance information or leading practices has measurably improved or declined  The latter indicates when it is statistically significantly higher or lower than the rest of government  These results suggest agencies have taken actions that led to improvements in their use of performance information  For example, when a result is a statistically significant increase since 2013, as with the National Science Foundation index score in 2017, this suggests that the agency has adopted practices that led to a measurable increase in the use of performance information by managers  When a result is statistically significantly higher than the government-wide average, like GSA’s 2017 index score, this suggests that the agency’s use of performance information is among the highest results when compared to the rest of government  These agencies could also have insights into practices that led to relatively high levels of performance information use  Finally, when a result is a statistically significant decrease since 2013, as with the Social Security Administration’s index score in 2017, or statistically significantly lower than the government-wide average, like the Department of Homeland Security’s 2017 index score, this suggests the agencies face challenges that are hampering their ability to use performance information  Appendix III provides each agency’s index scores from 2007, 2013, and 2017 to show changes between survey years  When we disaggregated the index and analyzed responses from the 11 questions that comprise the index—which could help pinpoint particular actions that improved the use of performance information—we similarly found relatively few changes in agencies’ recent results  Specifically, we identified 16 instances where agency responses on individual questions were statistically significantly different from 2013 to 2017—10 increases and 6 decreases  This represents about 6 percent of the total possible responses to the 11 survey questions from each of the agencies  In addition, we found 12 instances where an agency’s result on a question was statistically significantly higher (11) or lower (1) than the government-wide average in 2017  For example, the percentage of Social Security Administration (SSA) managers reporting that their peers use performance information to share effective approaches was statistically significantly higher than the government-wide average  Although SSA’s index score had a statistically significant decline in 2017 compared to 2013, the agency’s index score remains relatively high, as it has in prior years  The scope of our work has not allowed us to determine definitively what factors caused the decline in SSA’s index score and whether the decline is likely to continue, although its result on this particular question may indicate a continued strength  Each agency’s results on the 11 questions that comprise the index are presented in appendix I  The agencies’ respective statistically significant results are identified in figure 4  While some agencies had statistically significant improvements on individual questions, and could point to actions that led to improvements in their use of performance information, these improvements should be considered in relation to the range of agency results and the government- wide average  In figure 4, there are five agencies with statistically significant increases on responses to individual questions, where those results were not statistically significantly higher than the government-wide average (see arrows without plus signs for the Departments of Agriculture, Defense, and Justice; the Environmental Protection Agency; and the National Science Foundation)  While these represent improvements, they should be considered in relation to the range of agency results and the government-wide average (provided in detail in the agency summaries in appendix I)  For example, in 2017, the percentage of managers at the Department of Agriculture who reported that upper management use performance information to inform decisions about program changes was statistically significantly higher than in 2013  However, the department’s 2017 result (37 percent) was relatively lower when compared to the maximum agency result on that question (60 percent)  Appendix I presents the results on the index and the 11 questions that comprise it for each of the 24 agencies  When we compared government-wide and agency-level results on selected survey questions that reflect practices that promote the use of performance information, we found that results between 2013 and 2017 generally remained unchanged  As described earlier, there are 10 survey questions that both reflect the five leading practices identified in our past work and had statistically significant associations with higher index scores  As shown in figure 5, government-wide results on 2 of the 10 questions were statistically significantly different, both increases, from 2013 to 2017  Despite these two increases, the overall results suggest these practices are not widely followed government-wide  On most of the 10 questions, only about half (or fewer) of the managers reported their agencies were following them to a “great” or “very great” extent  When we analyzed agency-level responses to these 10 questions, we also found relatively few changes in recent results  Specifically, our analysis found 20 instances—16 increases and 4 decreases—where agencies’ responses on individual questions were statistically significantly different from 2013 to 2017  This represents about 8 percent of the total possible responses to the 10 survey questions from each of the agencies  In addition, we found 10 instances where an agency’s result on a question was statistically significantly higher (8) or lower (2) than the government-wide average in 2017  Each agency’s results on these 10 questions are presented in appendix I, and the statistically significant results are identified in figure 6  Those agencies with results on individual questions that are either statistically significantly higher than 2013, higher than the 2017 government-wide average, or both may have taken actions in line with our leading practices for promoting the use of performance information  For example, the National Science Foundation had both types of statistically significant results on a question about having sufficient information on the validity of their performance data  Here, the agency’s result increased 27 percentage points from 2013 to 2017  While the scope of our review does not allow us to definitively determine the reasons for the National Science Foundation’s higher results, they suggest the agency has taken recent actions that greatly improved the availability and accessibility of information on the validity of performance data  In both 2013 and 2017, our analyses found this particular question to be the strongest predictor of higher performance information use when we tested for associations between the questions that reflect leading practices and our index  Our 2017 survey results show that managers who reported their programs were subject to data-driven reviews also were more likely to report using performance information in decision making to a greater extent (see figure 7)  For the 35 percent of managers who reported being familiar with data-driven reviews, those who reported their programs had been subject to data-driven reviews to a “great” or “very great” extent had index scores that were statistically significantly higher than those whose programs were subject to these reviews to a lesser extent  Similarly, we found that being subject to data-driven reviews to a greater extent was also related to greater reporting of agencies following practices that can promote the use of performance information  As figure 8 shows, managers who reported their programs were subject to these reviews to a “great” or “very great” extent more frequently reported that their agencies followed the five leading practices that promote the use of performance information, as measured by the 10 related survey questions associated with higher scores on the index  For example, of the estimated 48 percent of managers who reported their programs were subject to data-driven reviews to a “great” or “very great” extent, 72 percent also reported that managers at their level (peers) effectively communicate performance information on a routine basis to a “great” or “very great” extent  Conversely, for the 24 percent of managers who reported their programs were subject to data-driven reviews to a “small” or “no” extent, only 30 percent reported that managers at their level do this to a “great” or “very great” extent  Our past work has found that the Executive Branch has taken steps to improve the use of performance information in decision making by senior leaders at federal agencies  However, our survey results indicate those steps have not led to similar improvements in use by managers at lower levels  Through its guidance to implement GPRAMA, OMB developed a framework for performance management in the federal government that involves agencies setting goals and priorities, measuring performance, and regularly reviewing and reporting on progress  This includes expectations for how agency senior leaders should use performance information to assess progress towards achieving agency priority goals through data-driven reviews, and strategic objectives through strategic reviews  For example, GPRAMA requires, and OMB’s guidance reinforces, that data-driven reviews should involve the agency head, Chief Operating Officer, Performance Improvement Officer, and other senior officials responsible for leading efforts to achieve each goal  OMB’s guidance also identifies ways in which agency leaders should use the results of those reviews to inform various decision-making activities, such as revising strategies, formulating budgets, and managing risks  Our past work also found that agencies made progress in implementing these reviews and using performance information  In July 2015, we found that agencies generally were conducting their data-driven reviews in line with GPRAMA requirements and our related leading practices, including that agency leaders used the reviews to drive performance improvement  In addition, in September 2017, we reported on selected agencies’ experiences in implementing strategic reviews and found that the reviews helped direct leadership attention to progress on strategic objectives  Despite those findings, our survey results continue to show that the reported use of performance information by federal managers has generally not improved, and actually declined at some agencies  This could be because of the two different groups of agency officials covered by our work  GPRAMA’s requirements, and the federal performance management framework established by OMB’s guidance, apply at the agency-wide level and generally involve senior leaders  Our past work reviewing implementation of the act therefore focused on improvements in the use of performance information by senior leaders at the agency- wide level  In contrast, our surveys covered random samples of mid- and upper-level managers within those agencies, including at lower organizational levels such as component agencies  Their responses indicate that the use of performance information more broadly within agencies—at lower organizational levels—generally has not improved over time  The exception to this was managers whose programs were subject to the data-driven reviews required by GPRAMA  As described above, those managers were more likely to report greater use of performance information in their agencies  This reinforces the value of the processes and practices put in place by GPRAMA  Our survey results suggest that limited actions have been taken to diffuse processes and practices related to the use of performance information to lower levels within federal agencies, where mid-level and senior managers make decisions about managing programs and operations  Although OMB staff agreed that diffusing processes and practices to lower levels could lead to improved use of performance information, they told us they have not directed agencies to do so for a few reasons  First, OMB staff expressed concerns about potentially imposing a “one-size-fits- all” approach on agencies  They stated that agencies are best positioned to improve their managers’ use of performance information, given their individual and unique missions and cultures, and the environments in which they operate  We agree that it makes sense for agencies to be able to tailor their approaches for those reasons  OMB’s existing guidance provides an overarching framework that recognizes the need for flexibility and for agencies to tailor their approaches  Moreover, given the long- standing and cross-cutting nature of this challenge, a government-wide approach also would provide a consistent focus on improving the use of performance information more extensively within agencies  OMB staff also told us that they believed it would go beyond their mandate to direct agencies to extend GPRAMA requirements to lower levels  GPRAMA requires OMB to provide guidance to agencies to implement its requirements, which only apply at the agency-wide level  As noted earlier, however, GPRAMA also requires OMB to develop cross- agency priority (CAP) goals to improve the performance and management of the federal government  The President’s Management Agenda established a CAP goal to leverage data as a strategic asset, in part, to improve the use of data for decision making and accountability throughout the federal government  This new CAP goal presents an opportunity for OMB and agencies to identify actions to expand the use of performance information in decision making throughout agencies  As of June 2018, the action plan for implementing the Leveraging Data as a Strategic Asset CAP goal is limited  According to the President’s Management Agenda and initial CAP goal action plan, the goal primarily focuses on developing and implementing a long-term, enterprise-wide federal data strategy to better govern and leverage the federal government’s data  It is through this strategy that, among other things, the administration intends to improve the use of data for decision making and accountability  However, the strategy is under development and not expected to be released until January 2019, with a related plan to implement it expected in April 2019  The existing action plan, released in March 2018 and updated in June 2018, does not yet include specific steps needed to improve the use of data—including performance information—more extensively within agencies  According to the action plan for the goal, potential actions currently under consideration focus on establishing agency “learning agendas” that prioritize the development and use of data and other evidence for decision-making; building agency capacity to use data and other evidence; and improving the timeliness of performance information and other data, and making that information available to decision makers and the public  Although developing learning agendas and building capacity could help improve the use of performance information in agencies, improving availability of data may be less effective  For example, as our past survey results have shown, increasing the availability of performance information has not resulted in corresponding increases in its use in decision making  We recognize that the CAP goal was created in March 2018  Nonetheless, it is important that OMB and its fellow goal leaders develop the action plan and related federal data strategy consistent with all key requirements to better ensure successful implementation  The action plan does not yet include complete information related to the following GPRAMA requirements: performance goals that define the level of performance to be achieved each year for the CAP goal; the various federal agencies, organizations, programs, and other activities that contribute to the CAP goal; performance measures to assess overall progress towards the goal as well as the progress of each agency, program, and other activity contributing to the goal; and clearly defined quarterly targets  Consistent with GPRAMA, Standards for Internal Control in the Federal Government identifies information that agencies are required to include in their plans to help ensure they achieve their goals  The standards state that objectives—such as improving the use of data in decision making— should be clearly defined to enable the identification of risks  Objectives are to be defined in specific terms so they can be understood at all levels of the entity—in this case, government-wide as well as within individual agencies  This involves defining what is to be achieved, who is to achieve it, how it will be achieved, and the time frames for achievement  Ensuring that future updates to the new CAP goal’s action plan includes all required elements is particularly important, as our previous work has found that some past CAP goal teams did not meet all planning and reporting requirements  For example, in May 2016 we found that most of the CAP goal teams we reviewed had not established targets for all performance measures they were tracking  This limited the transparency of their efforts and the ability to track progress toward established goals  We recommended that OMB, working with the Performance Information Council (PIC), report on actions that CAP goal teams are taking, or plan to take, to develop such targets and performance measures  OMB staff generally agreed and, in July 2017, told us they were working, where possible, to assist the development of measures for CAP goals  However, the recommendation has not been addressed and OMB staff said the next opportunity to address it would be when the administration established new CAP goals (which took place in March 2018)  Following the initial release of the new CAP goals, CAP goal teams are to more fully develop the related action plans through quarterly updates  Given the ongoing importance of meeting these planning and reporting requirements, we will continue to monitor the status of actions to address this recommendation as implementation of the new CAP goals proceeds  While the PIC, which is chaired by OMB, has contributed to efforts to enhance the use of performance information, our survey results identify additional opportunities to further those efforts  The PIC’s past efforts have included hosting various working groups and learning events for agency officials to provide performance management guidance, and developing resources with relevant practices  For example, the PIC created a working group focused on agency performance reviews, which was used to share recommendations for how agencies can implement reviews, along with a guide with practices for effectively implementing strategic reviews  In January 2018, staff supporting the PIC joined with staff from another GSA office to create a new group called Fed2Fed Solutions  This group consults with agencies and provides tailored support, such as data analysis and performance management training for agency officials, to help them address specific challenges related to organizational transformation, data-driven decision making, and other management improvement efforts  Our survey results identify useful information related to potential promising practices and challenges that OMB and the PIC could use to inform efforts to enhance the use of performance information more extensively within agencies (e g , at lower levels)  As was previously described, the PIC has responsibilities to (1) facilitate the exchange among agencies of proven practices, and (2) work to resolve government- wide or cross-cutting performance issues, such as challenges  Our analyses of 2017 survey results identified instances where agencies may have found effective ways to enhance the use of performance information by agency leaders and managers in decision making, as well as instances where agencies (and their managers) face challenges in doing so  Specifically, based on analyses of our survey responses, we identified 14 agencies that may have insights into specific practices that led to recent improvements in managers’ use of performance information, or ways that they maintain relatively high levels of use by their managers when compared to the rest of the government  Figure 9 summarizes the agencies identified earlier in the report that had statistically significant increases, or results higher than the government-wide average, on our index or individual survey questions  As the figure shows, several agencies had statistically significant results across all three sets of analyses and therefore may have greater insights to offer: the General Services Administration, National Aeronautics and Space Administration, and the National Science Foundation  In addition, our analyses identified nine agencies where results suggest managers face challenges that have hampered their ability to use performance information  Figure 10 summarizes the agencies identified earlier in the report that had statistically significant decreases, or results lower than the government-wide average, on our index or individual survey questions  As the figure shows, the Office of Personnel Management had statistically significant decreases in all three sets of analyses  Four agencies—the Departments of the Treasury and Veterans Affairs, the Nuclear Regulatory Commission, and the Social Security Administration—were common to both of the figures above  That is, they had results that indicate they may have insights on some aspects of using performance information and face challenges in other aspects  As was mentioned earlier, to provide proper context, these results should be considered in relation to the range of agency results and the government- wide average (provided in detail in the agency summaries in appendix I)  Given the prioritization of other activities, such as the recent creation of the Fed2Fed Solutions program, the PIC has not yet undertaken a systematic approach that could improve the use of performance information by managers at lower levels within agencies  Such an approach would involve identifying and sharing practices that have led to improved use, as well as identifying common or cross-cutting challenges that have hampered such use  The results of our analyses could help the PIC do so, and in a more targeted manner  By identifying and sharing proven practices, the PIC could further ensure that agency leaders and managers are aware of effective or proven ways they can use performance information to inform their decisions across the spectrum of activities they manage within their agencies  Those proven practices also may help agency leaders and managers resolve any identified challenges  Furthermore, in September 2017, we found that, for the estimated 35 percent of managers who reported familiarity with data-driven reviews, the more they viewed their programs being subject to a review, the more likely they were to report the reviews were driving results and were conducted in line with our leading practices for using performance information  Despite the reported benefits of and results achieved through data-driven reviews, they were not necessarily widespread  As noted above, GPRAMA requires agencies to conduct such reviews for agency priority goals, which represent a small subset of goals, and they are required at the departmental level  These reasons may explain why most managers reported they were not familiar with the reviews  As a result, we recommended that OMB should work with the PIC to identify and share among agencies practices for expanding the use of data-driven reviews  OMB staff agreed with our recommendation but have yet to address it  In June 2018, OMB updated its annual guidance to agencies to explicitly encourage them to expand data-driven reviews to include other goals, priorities, and management areas as applicable to improve organizational performance  However, as of June 2018, OMB and the PIC have yet to take any steps to identify and share practices for expanding the use of these reviews in line with our recommendation  Given the additional analyses we conducted for this report—which show that being subject to data-driven reviews is related to greater reported use of performance information and leading practices that promote such use—we continue to believe these further actions would help agencies implement these reviews more extensively  We reiterate the importance of the September 2017 recommendation and will continue to monitor OMB’s progress to address it  For more than 20 years, our work has highlighted weaknesses in the use of performance information in federal decision making  While the Executive Branch has taken some actions in recent years, such as establishing a framework for performance management across the federal government, our survey results underscore that more needs to be done to improve the use of performance information more extensively within agencies and government-wide  The President’s Management Agenda and its related CAP goal to leverage data as a strategic asset present an opportunity to do so, as it aims to improve data-driven decision making  As OMB and its fellow goal leaders more fully develop the action plan for achieving this goal, providing additional details for its plans to improve data-driven decision making would help provide assurance that it can be achieved  As part of those initiatives, our survey results could provide a useful guide for targeting efforts  Officials at each agency could use these results to identify areas for additional analysis and potential actions that could help improve the use of performance information across the agency and at lower levels  Similarly, OMB and the PIC could use the results to identify broader issues in need of government-wide attention  It will also be important, however, for OMB and the PIC to go beyond this analysis and work with agencies to identify and share proven practices for increasing the use of performance information at lower levels within agencies, as well as challenges that may be hampering agencies’ ability to do so  We are making the following two recommendations to OMB: The Director of OMB should direct the leaders of the Leveraging Data as a Strategic Asset CAP Goal to ensure future updates to the action plan, and the resulting federal data strategy, provide additional details on improving the use of data, including performance information, more extensively within federal agencies  The action plan should identify performance goals; contributing agencies, organizations, programs, and other activities; those responsible for leading implementation within these contributors; planned actions; time frames; and means to assess progress  (Recommendation 1) The Director of OMB, in coordination with the PIC, should prioritize efforts to identify and share among agencies proven practices for increasing, and challenges that hamper, the use of performance information in decision making more extensively within agencies
Report 2:  However, as discussed later in this report, Congress has abrogated Watters 's holding that states may not examine or regulate the activities of national bank subsidiaries  While the Court adopted a broad view of preemption in Watters , it cabined the preemptive effect of the relevant NBA provision two years later in Cuomo v  C learing House Association, LLC  In that decision, the Court held that this NBA provision did not preempt an information request that the New York Attorney General (NYAG) sent to several national banks  Specifically, the NYAG had sent letters to several national banks requesting nonpublic information about their lending practices in order to determine whether the banks had violated state fair lending laws  In response, a banking trade group and the OCC argued that the relevant NBA provision—together with an OCC regulation interpreting that provision to mean that "[s]tate officials may not       prosecut[e] enforcement actions" against national banks, "except in limited circumstances authorized by federal law"—preempted the information request  The Supreme Court rejected this interpretation of the NBA's visitorial powers provision, drawing a distinction between (1) "supervision," or "the right to oversee corporate affairs," which qualify as "visitorial powers," and (2) "law enforcement " Because the Court concluded that the NYAG had issued the information requests in his "law enforcement" capacity—as opposed to "acting in the role of sovereign-as-supervisor"—it held that the NBA did not preempt the requests  As the above discussion makes clear, OCC regulations have figured prominently in litigation over the preemptive scope of federal banking law  While some commentators have contended that the NBA's text and legislature history implicitly provides the OCC with the authority to promulgate preemption rules, Congress formally recognized that the OCC has such authority in the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (Riegle-Neal Act)  Specifically, Section 114 of the Riegle-Neal Act provides that "[b]efore issuing any opinion letter or interpretive rule       that concludes that Federal law preempts the application to a national bank of any State law" concerning certain specified subjects, the OCC must give the public notice and an opportunity submit written comments  In the 1990s and early 2000s, the OCC exercised this authority in a number of interpretive letters and legal opinions  In these documents, the OCC took the position that federal law preempted state laws that limited the ability of national banks to: advertise; operate offices within a certain distance from state-chartered bank home offices; operate ATM machines; engage in fiduciary activities; finance automobile purchases; sell annuities; sell repossessed automobiles without an automobile dealer license; and conduct Internet auctions of certificates of deposit  In 2004, the OCC expanded upon these interpretive letters and legal opinions by issuing what one commentator has described as "sweeping" preemption rules  The OCC's 2004 preemption rules articulated a general preemption standard according to which "state laws that obstruct, impair, or condition a national bank's ability to fully exercise" its federally authorized powers "are not applicable to national banks" except "where made applicable by Federal law " This general standard accordingly expanded on Barnett Bank 's "significant interference" test in two ways  First, the OCC's 2004 standard omitted the intensifying phrase "significantly" from the Barnett Bank test  Second, the 2004 standard by its terms required that national banks be able to "fully" exercise their authorized powers—a phrase that does not appear in Barnett Bank   However, despite these facial differences with the Barnett Bank test, the OCC explained that it intended the phrase "obstruct, impair, or condition" to function "as the distillation of the various preemption constructs articulated by the Supreme Court, as recognized in Hines [ v  Davidowitz ] and Barnett Bank , and not as a replacement construct that is in any way inconsistent with those standards " Beyond this general preemption standard, the OCC's 2004 rules concluded that the NBA preempted certain categories of state laws  First, the rules provided that national banks "may make real estate loans       without regard to state law limitations concerning": licensing and registration (except for purposes of service of process); "[t]he ability of a creditor to require or obtain private mortgage insurance, insurance for other collateral, or other credit enhancements or risk mitigants, in furtherance of safe and sound banking practices"; loan-to-value ratios; terms of credit; "[t]he aggregate amount of funds that may be loaned upon the security of real estate"; escrow accounts; security property; access to and use of credit reports; disclosure and advertising; processing, origination, servicing, sale or purchase of, or investment or participation in, mortgages; disbursements and repayments; rates of interest on loans; due-on-sale clauses, with certain exceptions; and "[c]ovenants and restrictions that must be contained in a lease to qualify the leasehold as acceptable security for a real estate loan " Second, the rules provided that national banks "may make non-real estate loans without regard to state law limitations concerning" many of the same matters identified in the regulation concerning real estate lending  Finally, the rules provided that national banks "may exercise [their] deposit-taking powers without regard to state law limitations concerning": (1) abandoned and dormant accounts, (2) checking accounts, (3) disclosure requirements, (3) funds availability, (4) savings account orders of withdrawal, (5) state licensing or registration requirements (except for purposes of service of process), and (6) special purpose savings services  The OCC's 2004 rules also identified general categories of state law that the agency interpreted as surviving preemption  Specifically, the rules provided that the NBA does not preempt state laws that are consistent with federal law and involve (1) contracts, (2) torts, (3) criminal law, (4) rights to collect debts, (5) the acquisition and transfer of property, (5) taxation, (6) zoning, and, with respect to real estate lending, (7) certain homestead laws  According to the OCC's 2004 rules, such laws survive preemption so long as they "do not regulate the manner, content or extent of the activities authorized for national banks under federal law " The OCC's 2004 preemption rules proved controversial  In 2008, the United States experienced a financial crisis caused in part by reckless subprime mortgage lending and a collapse in the real estate market  In the wake of the crisis, commentators debated the role that federal preemption of state predatory lending laws played in generating the pre-2008 housing bubble  Some commentators contended that national banks played a significant role in the predatory lending that preceded the crisis, and that federal preemption "effectively gut[ted] states' ability to legislate against predatory lending practices " By contrast, others rejected the contention that preemption played a significant role in causing the crisis, arguing that national banks and their subsidiaries accounted for only a small share of subprime mortgage lending  In 2010, Congress responded to concerns over federal preemption of state consumer protection laws in Section 1044 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank)  Section 1044 provides that federal law preempts such laws only if: (A) application of a State consumer financial law would have a discriminatory effect on national banks, in comparison with the effect of the law on a bank chartered by that State; (B) in accordance with the legal standard for preemption in the decision of the Supreme Court of the United States in [ Barnett Bank ], the State consumer financial law prevents or significantly interferes with the exercise by the national bank of its powers; and any preemption determination under this subparagraph may be made by a court, or by regulation or order of the Comptroller of the Currency on a case-by-case basis, in accordance with applicable law; or (C) the State consumer financial law is preempted by a provision of Federal law other than title 62 of the Revised Statutes  Beyond this general preemption standard, Section 1044 contains a number of other provisions narrowing the OCC's preemption authority  First, Section 1044 provides that courts reviewing OCC preemption determinations should accord those determinations only Skidmore deference, under which courts assess an agency's interpretation of a statute "depending upon the thoroughness evident in the consideration of the agency, the validity of the reasoning of the agency, the consistency with other valid determinations made by the agency, and other factors which the court finds persuasive and relevant to its decision " Before the enactment of Dodd-Frank, certain courts had afforded OCC preemption determinations a more permissive form of deference known as Chevron deference, according to which courts defer to agency interpretations as long as they are reasonable  Section 1044 accordingly requires that courts take a less deferential posture toward OCC preemption determinations  Second, Section 1044 provides that no OCC preemption determination "shall be interpreted or applied so as to invalidate, or otherwise declare inapplicable to a national bank, the provision of the State consumer financial law, unless substantial evidence, made on the record of the proceeding, supports the specific finding regarding the preemption of such provision in accordance with the legal standard" established by Barnett Bank   This "substantial evidence" standard is often used in cases involving the Administrative Procedure Act, which provides that courts shall hold unlawful an agency's formal rules and other determinations made on the basis of a formal hearing when they are "unsupported by substantial evidence " The Supreme Court has explained that "substantial evidence" entails "more than a mere scintilla" of evidence, and requires "such relevant evidence as a reasonable mind might accept as adequate to support a conclusion " Third, Section 1044 provides that the OCC shall (1) "periodically conduct a review, through public notice and comment, of each determination that a provision of Federal law preempts a State consumer financial law," (2) "conduct such review within the 5-year period after prescribing or otherwise issuing such determination, and at least once during each 5-year period thereafter," and (3) "[a]fter conducting the review of, and inspecting the comments made on, the determination,       publish a notice in the Federal Register announcing the decision to continue or rescind the determination or a proposal to amend the determination " Fourth, Section 1044 provides that the OCC must submit to Congress a report addressing its decision to continue, rescind, or propose an amendment to any preemption determination  Finally, Section 1044 abrogated the Supreme Court's decision in Watters , providing that "State consumer financial laws" apply to the subsidiaries and affiliates of national banks "to the same extent" that they apply "to any person, corporation, or other entity subject to such State law " After Dodd-Frank's enactment, commentators debated the meaning of Section 1044's general preemption standard  As discussed, Section 1044's preemption standard provides that federal law preempts "State consumer financial laws" that "prevent[] or significantly interfere[]" with the powers of national banks "in accordance with the legal standard for preemption in the decision of the Supreme Court of the United States in [ Barnett Bank ] " Some commentators have argued that this language simply codifies the Barnett Bank standard and was not intended to significantly modify pre-existing law  However, others have argued that Section 1044 was intended to pare back the OCC's 2004 preemption rules, which interpreted the NBA as preempting state laws that "obstruct, impair, or condition" the powers of national banks  According to this latter group of commentators, the OCC's "obstruct, impair, or condition" standard was more expansive than Barnett Bank 's "significant interference" test, meaning that a codification of that test would modify pre-existing law  In 2011, the OCC responded to the enactment of Section 1044 by issuing a notice of proposed rulemaking that reaffirmed its pre-Dodd-Frank preemption decisions while deleting the "obstruct, impair, or condition" language from its preemption rules  While the OCC acknowledged that this language "created ambiguities and misunderstandings regarding the preemption standard that it was intended to convey," it maintained that the specific preemption determinations reflected in its 2004 rules were nevertheless consistent with Barnett Bank   The OCC accordingly proposed reaffirming the specific preemption determinations in its 2004 rules while removing the "obstruct, impair, or condition" standard  The OCC's proposal quickly generated controversy  After the OCC issued the notice, the Treasury Department's General Counsel wrote a letter to the Comptroller of the Currency arguing that the OCC's proposed rule was "inconsistent with the plain language of [Dodd-Frank] and its legislative history " Specifically, the Treasury Department argued that interpreting Section 1044 as making no significant changes to existing preemption law conflicted with "basic canons of statutory construction" and legislative history indicating that the provision was intended to "revise[]" the OCC's preemption standard  Senator Carl Levin also expressed disagreement with the proposed rules in a letter to the Comptroller, arguing that "[i]f [Congress] had wanted to leave the OCC's purported federal preemptive powers unchanged, [it] could have engaged in a very simple exercise—do nothing " Other Senators expressed support for the OCC's proposed rules  Senators Tom Carper and Mark Warner criticized the Treasury Department's letter for "ignor[ing] the clear legislative history indicating that [Section 1044] is intended to codify the Barnett case " In responding to the Treasury Department's argument that Section 1044 was intended to "revise" the OCC's preemption standards, Senators Carper and Warner argued that the OCC's proposed rules would effectuate the contemplated revision by removing the potentially troublesome "obstruct, impair, or condition" language from the agency's 2004 rules  The OCC ultimately agreed with Senators Carper and Warner  In July 2011, the OCC published a final regulation revising its preemption rules  In the final rule, the OCC concluded that "the Dodd-Frank Act does not create a new, stand-alone 'prevents or significantly interferes' preemption standard, but, rather, incorporates the conflict preemption legal standard and the reasoning that supports it in the Supreme Court's Barnett decision " The OCC's 2011 rule also deleted the phrase "obstruct, impair, or condition" from the relevant preemption standard, noting that preemption determinations based "exclusively" on that language "would need to be reexamined to ascertain whether the determination is consistent with the Barnett conflict preemption analysis " However, the rule indicated that the OCC had not identified any preemption determinations that in fact relied "exclusively" on the relevant language  The final rule also noted that all future OCC preemption determinations would be subject to Section 1044's requirement concerning "case-by-case" determinations  Since the enactment of Dodd-Frank, a number of courts have interpreted Section 1044 as codifying the Barnett Bank standard  Some courts have accordingly concluded that Barnett Bank demarcates the boundaries of the OCC's 2011 preemption rules, reasoning that those rules do not preempt any state laws that would survive preemption under the Barnett Bank test  One court has also addressed the appropriate level of judicial deference towards the OCC's 2011 preemption determinations  As discussed, Section 1044 provides that courts "shall" assess OCC preemption determinations "depending upon the thoroughness evident in the consideration of the agency, the validity of the reasoning of the agency, the consistency with other valid determinations made by the agency, and other factors which the court finds persuasive and relevant to its decision"—a standard commonly known as " Skidmore deference " In 2018, the Ninth Circuit concluded that the OCC's 2011 preemption determinations are "entitled to little, if any, deference" under Skidmore   Specifically, the Ninth Circuit reasoned that because the OCC's 2011 preemption determinations represent the agency's "articulation of its legal analysis" under Barnett Bank (as opposed to being grounded in expert factual findings), those determinations would not warrant significant deference even in the absence of Section 1044  Whether other federal circuit courts will follow the Ninth Circuit in affording minimal deference to the OCC's 2011 preemption rules remains to be seen  As the debates over Section 1044 of Dodd-Frank make clear, a number of banking preemption issues remain the subject of active debate  This final section of the report discusses three additional current issues involving banking preemption and related federalism questions  A number of recent judicial decisions have generated debate over the circumstances in which non-bank financial companies can benefit from banks' ability to "export" the maximum interest rates of their "home" states  As discussed, the Supreme Court has held that national banks may charge any interest rate allowable under the laws of their home states even when lending to borrowers in other states with stricter usury laws  After this decision, Congress extended the power to export maximum interest rates to federally insured state banks  Recently, courts have grappled with whether this exportation power extends to non-bank financial companies and debt collectors that purchase loans originated by federally insured banks  That is, courts have addressed the circumstances in which loans originated by federally insured banks remain subject to the usury laws of the banks' home states even when the loans are (1) made to borrowers in other states with stricter usury laws, and (2) subsequently purchased by non-banks, which do not possess the exportation power when they originate loans themselves  A number of courts have concluded that in certain contexts, a loan that is non-usurious when originated remains non-usurious irrespective of the identity of its subsequent purchasers—a principle that some commentators have labeled the "valid when made" doctrine  However, in 2015, the Second Circuit rejected the application of this rule in Madden v  Midland Funding , holding that non-bank debt collectors that had purchased debt originated by a national bank could not benefit from the bank's exportation power  In Madden , a New York resident brought a putative class action under New York usury law against debt collectors that had purchased her credit card debt from a Delaware-based national bank  In response, the debt collectors argued that federal law preempted the New York usury claims because the credit card debt had been originated by a Delaware-based national bank and was not usurious under Delaware law  The Second Circuit rejected this argument, reasoning that the application of New York usury law to the debt collectors did not "significantly interfere" with the national bank's powers under Barnett Bank   Specifically, the court reasoned that because the debt collectors were not national banks and were not acting "on behalf of" a national bank, the New York usury claims did not interfere with the national bank's power to export the maximum interest rates of its home state  The Second Circuit's decision in Madden has generated significant debate  In an amicus brief supporting the debt collectors' petition for re-hearing before the Second Circuit, industry groups argued that the decision threatened to seriously disrupt lending markets  Specifically, these groups argued that the court's decision would "significantly impair" banks' ability to manage their risk by selling loans in secondary credit markets—a result that would ultimately inhibit their capacity to originate loans  Similarly, in an amicus brief submitted to the Supreme Court, the OCC and the Office of the Solicitor General (OSG) argued that the Second Circuit's decision was "incorrect," reasoning that "[a] national bank's federal right to charge interest up to the rate allowed by [the NBA] would be significantly impaired if [a] national bank's assignee could not continue to charge that rate " In response, the plaintiff in Madden argued that the Second Circuit's decision is unlikely to significantly affect credit markets  Specifically, the Madden plaintiff argued that the court's decision will not disrupt credit markets because non-banks that purchase loans originated by banks retain the right to collect the balances of those loans within applicable state law usury limits  While the Second Circuit ultimately denied the debt collectors' petition for re-hearing and the Supreme Court denied their petition for a writ of certiorari, the Madden decision has attracted congressional interest  The Financial CHOICE Act—comprehensive regulatory reform legislation that passed the House of Representatives in June 2017 but did not become law—would have codified the "valid when made" doctrine and abrogated Madden   A more limited bill directed solely at codifying the "valid when made" doctrine ( H R  3299 ) also passed the House in February 2018 but did not become law  Echoing the arguments made by industry groups, the bill's sponsor contended that the Second Circuit's decision will harm credit markets and impede financial innovation  By contrast, the bill's critics argued that it would facilitate predatory lending by allowing non-banks to evade state usury laws  These proposals have not been re-introduced in the 116th Congress  In a number of cases involving the scope of the exportation doctrine, non-bank financial companies have played a more active role in the origination process than the debt collectors in Madden   Specifically, a number of these cases have involved arrangements in which a non-bank financial company solicits borrowers, directs a partner bank to originate a high-interest loan, and purchases the loan from the bank shortly after origination in order to benefit from the bank's exportation power  Some courts have held that non-banks employing these so-called "rent-a-charter" schemes are not eligible for federal preemption, reasoning that preemption depends on a transaction's economic realities rather than its formal characteristics  Specifically, these courts have concluded that non-banks do not assume their partner banks' exportation power when the economic realities surrounding a transaction indicate that the non-banks are the "true lenders " According to this "true lender" doctrine, non-banks that have established these types of relationships qualify as the "true lenders" when they possess the "predominant economic interest" in the relevant loans when the loans are originated  In these circumstances, some courts have concluded that the non-banks are not entitled to the benefits of federal preemption  Like the Second Circuit's decision in Madden , these "true lender" decisions have attracted Congress's attention  In the 115th Congress, H R  4439 would have abrogated this line of decisions by making clear that a loan's originator is always the "true lender" for purposes of the exportation doctrine  The bill's supporters argued that the "true lender" decisions threaten to undermine partnerships between banks and FinTech companies —a broad category of businesses offering digital financial products that some commentators have hailed for their innovative potential  The bill's opponents, by contrast, contended that the legislation would allow non-banks to circumvent state usury laws and questioned the value of bank-FinTech partnerships designed with that purpose in mind  H R  4439 was referred to the House Committee on Financial Services during the 115th Congress but has not been re-introduced in the 116th Congress  Congress is not alone in considering whether to extend the benefits of federal preemption to FinTech companies  In July 2018, the OCC issued a Policy Statement announcing that it will begin accepting applications for "special purpose national bank charters" (SPNB charters) from FinTech companies that are engaged in "the business of banking" but do not take deposits  In the Policy Statement, the OCC explained that the NBA provides it "broad authority" to grant national bank charters to institutions that engage in the "business of banking"—a category that includes paying checks and lending money  The OCC accordingly concluded that it has the statutory authority to grant national bank charters to FinTech companies that engage in these core banking activities  According to the OCC, SPNB charters will help foster responsible innovation and promote regulatory consistency between FinTech companies and traditional banks  The OCC further explained that it will use its existing chartering standards and procedures to evaluate applications for SPNB charters, and that FinTech companies that receive such charters "will be supervised like similarly situated national banks, including with respect to capital, liquidity, and risk management " While the OCC touted the ability of SPNB charters to "level the playing field with regulated institutions" without explicitly mentioning federal preemption, commentators have observed that preemption represents "the central benefit" offered by such charters  The OCC's decision to accept applications for national bank charters from FinTech companies has generated debate  Critics of the policy have contended that FinTech companies' interest in such charters "is virtually entirely about avoiding state consumer protection laws," and that "[f]ederal chartering should not be a move to eviscerate" such laws  State regulators have also filed lawsuits challenging the OCC's authority to charter non-depository FinTech companies  In the spring of 2017, the Conference of State Bank Supervisors (CSBS) and the New York Department of Financial Services (NYDFS) responded to an early OCC proposal to charter FinTech companies by filing suits in the U S  District Court for the District of Columbia and the U S  District Court for the Southern District of New York, respectively  The CSBS and NYDFS made substantially similar claims, arguing that (1) the NBA does not give the OCC the authority to charter non-depository institutions, (2) the Administrative Procedure Act requires the OCC to follow notice-and-comment rulemaking procedures before issuing SPNBs, (3) the OCC's decision was arbitrary and capricious, and (4) the OCC's decision violated the Tenth Amendment by invading states' sovereign powers  Both district courts dismissed the lawsuits on jurisdictional grounds, reasoning that the organizations failed to identify any imminent injuries to their members and that the case was not ripe for resolution because the OCC had not issued any SPNBs  However, after the OCC issued its Policy Statement in July 2018, both organizations filed new lawsuits that remain pending  Policymakers have also turned their attention to how federal law affects traditional banks' responses to changes in state law—namely, state-level efforts to legalize marijuana  While a number of states have legalized marijuana for medical or recreational use, federal law criminalizes the drug's sale, distribution, and possession, in addition to the aiding and abetting of such activities  Federal law also criminalizes money laundering, making it unlawful to: conduct a financial transaction involving the proceeds of a specified unlawful activity —a category that includes the sale or distribution of marijuana—"knowing that the transaction is designed       to conceal or disguise the nature, the location, the source, the ownership or the control of the proceeds       or to avoid a transaction reporting requirement under State or Federal law"; or knowingly engage in a monetary transaction in criminally derived property of a value greater than $10,000 that is derived from specified unlawful activity   Finally, the Bank Secrecy Act (BSA) and associated regulations require that financial institutions report illegal and suspicious activities to the Financial Crimes Enforcement Network (FinCEN) and maintain programs designed to prevent money laundering  Federal banking regulators have broad powers to discipline banks for violations of these laws  The Federal Reserve regularly conducts examinations of member banks that include evaluations of BSA compliance, and the FDIC has the authority to terminate a bank's deposit insurance for violations of law  Because of marijuana's status under federal law, many banks have refused to serve marijuana businesses even when those businesses operate in compliance with state law  While some small banks have offered accounts to marijuana businesses, an estimated 70 percent of marijuana businesses remain unbanked  Because of this inability to access the banking system, many marijuana businesses reportedly operate entirely in cash, raising concerns about tax collection and public safety  These perceived problems have attracted congressional interest  In March 2019, the House Committee on Financial Services approved legislation intended to minimize the legal risks associated with banking the marijuana industry  The proposed bill— H R  1595 , the SAFE Banking Act of 2019—would create a "safe harbor" under which federal banking regulators could not take various adverse actions against depository institutions for serving marijuana businesses that comply with applicable state laws ("cannabis-related legitimate businesses")  The legislation would also provide that for purposes of federal anti-money laundering law, the proceeds from transactions conducted by cannabis-related legitimate businesses shall not qualify as the proceeds of unlawful activity "solely because the transaction[s] [were] conducted by a cannabis-related legitimate business " Finally, H R  1595 would require FinCEN to issue guidance concerning the preparation of suspicious activity reports for cannabis-related legitimate businesses that is "consistent with the purpose and intent" of the bill and "does not significantly inhibit the provision of financial services" to cannabis-related legitimate businesses  Variations on some of the SAFE Banking Act's provisions have been incorporated into broader marijuana-related legislation  The Responsibly Addressing Marijuana Policy Gap Act of 2019 ( S  421 and H R  1119 ) would eliminate federal criminal penalties for persons who engage in various marijuana-related activities in compliance with state law and create a "safe harbor" from adverse regulatory action for depository institutions that serve marijuana businesses  Another Senate bill— S  1028 , the STATES Act—would provide that the Controlled Substances Act's (CSA's) marijuana-related provisions do not apply to persons acting in compliance with state marijuana regulation s, subject to certain exceptions  While the bill does not have the type of "safe harbor" for depository institutions in H R  1595 , S  421 , or H R  1119 , it contains a "Rule of Construction" clarifying that conduct in compliance with the legislation shall not serve as the basis for federal money laundering charges or criminal forfeiture under the CSA 

ground_truth: Federal agencies and the nation's critical infrastructures—such as energy, transportation systems, communications, and financial services—are dependent on information technology systems to carry out operations. The security of these systems and the data they use is vital to public confidence and national security, prosperity, and well-being. The risks to these systems are increasing as security threats evolve and become more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015. This report provides an update to the information security high-risk area. To do so, GAO identified the actions the federal government and other entities need to take to address cybersecurity challenges. GAO primarily reviewed prior work issued since the start of fiscal year 2016 related to privacy, critical federal functions, and cybersecurity incidents, among other areas. GAO also reviewed recent cybersecurity policy and strategy documents, as well as information security industry reports of recent cyberattacks and security breaches. GAO has identified four major cybersecurity challenges and 10 critical actions that the federal government and other entities need to take to address them. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities. GAO has made over 3,000 recommendations to agencies aimed at addressing cybersecurity shortcomings in each of these action areas, including protecting cyber critical infrastructure, managing the cybersecurity workforce, and responding to cybersecurity incidents. Although many recommendations have been addressed, about 1,000 have not yet been implemented. Until these shortcomings are addressed, federal agencies' information and systems will be increasingly susceptible to the multitude of cyber-related threats that exist. GAO has made over 3,000 recommendations to agencies since 2010 aimed at addressing cybersecurity shortcomings. As of August 2018, about 1,000 still needed to be implemented.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: IT systems supporting federal agencies and our nation’s critical infrastructures are inherently at risk  These systems are highly complex and dynamic, technologically diverse, and often geographically dispersed  This complexity increases the difficulty in identifying, managing, and protecting the numerous operating systems, applications, and devices comprising the systems and networks  Compounding the risk, federal systems and networks are also often interconnected with other internal and external systems and networks, including the Internet  This increases the number of avenues of attack and expands their attack surface  As systems become more integrated, cyber threats will pose an increasing risk to national security, economic well-being, and public health and safety  Advancements in technology, such as data analytics software for searching and collecting information, have also made it easier for individuals and organizations to correlate data (including PII) and track it across large and numerous databases  For example, social media has been used as a mass communication tool where PII can be gathered in vast amounts  In addition, ubiquitous Internet and cellular connectivity makes it easier to track individuals by allowing easy access to information pinpointing their locations  These advances—combined with the increasing sophistication of hackers and others with malicious intent, and the extent to which both federal agencies and private companies collect sensitive information about individuals—have increased the risk of PII being exposed and compromised  Cybersecurity incidents continue to impact entities across various critical infrastructure sectors  For example, in its 2018 annual data breach investigations report, Verizon reported that 53,308 security incidents and 2,216 data breaches were identified across 65 countries in the 12 months since its prior report  Further, the report noted that cybercriminals can often compromise a system in just a matter of minutes—or even seconds, but that it can take an organization significantly longer to discover the breach  Specifically, the report stated nearly 90 percent of the reported breaches occurred within minutes, while nearly 70 percent went undiscovered for months  These concerns are further highlighted by the number of information security incidents reported by federal executive branch civilian agencies to DHS’s U S  Computer Emergency Readiness Team (US-CERT)  For fiscal year 2017, 35,277 such incidents were reported by the Office of Management and Budget (OMB) in its 2018 annual report to Congress, as mandated by the Federal Information Security Modernization Act (FISMA)  These incidents include, for example, web-based attacks, phishing, and the loss or theft of computing equipment  Different types of incidents merit different response strategies  However, if an agency cannot identify the threat vector (or avenue of attack), it could be difficult for that agency to define more specific handling procedures to respond to the incident and take actions to minimize similar future attacks  In this regard, incidents with a threat vector categorized as “other” (which includes avenues of attacks that are unidentified) made up 31 percent of the various incidents reported to US-CERT  Figure 1 shows the percentage of the different types of incidents reported across each of the nine threat vector categories for fiscal year 2017, as reported by OMB  These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security  The following examples highlight the impact of such incidents: In March 2018, the Mayor of Atlanta, Georgia, reported that the city was victimized by a ransomware cyberattack  As a result, city government officials stated that customers were not able to access multiple applications that are used to pay bills or access court related information  In response to the attack, the officials noted that they were working with numerous private and governmental partners, including DHS, to assess what occurred and determine how best to protect the city from future attacks  In March 2018, the Department of Justice reported that it had indicted nine Iranians for conducting a massive cybersecurity theft campaign on behalf of the Islamic Revolutionary Guard Corps  According to the department, the nine Iranians allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 U S  companies, and five federal government agencies, among other entities  In March 2018, a joint alert from DHS and the Federal Bureau of Investigation (FBI) stated that, since at least March 2016, Russian government actors had targeted the systems of multiple U S  government entities and critical infrastructure sectors  Specifically, the alert stated that Russian government actors had affected multiple organizations in the energy, nuclear, water, aviation, construction, and critical manufacturing sectors  In July 2017, a breach at Equifax resulted in the loss of PII for an estimated 148 million U S  consumers  According to Equifax, the hackers accessed people’s names, Social Security numbers (SSN), birth dates, addresses and, in some instances, driver’s license numbers  In April 2017, the Commissioner of the Internal Revenue Service (IRS) testified that the IRS had disabled its data retrieval tool in early March 2017 after becoming concerned about the misuse of taxpayer data  Specifically, the agency suspected that PII obtained outside the agency’s tax system was used to access the agency’s online federal student aid application in an attempt to secure tax information through the data retrieval tool  In April 2017, the agency began notifying taxpayers who could have been affected by the breach  In June 2015, OPM reported that an intrusion into its systems had affected the personnel records of about 4 2 million current and former federal employees  Then, in July 2015, the agency reported that a separate, but related, incident had compromised its systems and the files related to background investigations for 21 5 million individuals  In total, OPM estimated 22 1 million individuals had some form of PII stolen, with 3 6 million being a victim of both breaches  Safeguarding federal IT systems and the systems that support critical infrastructures has been a long-standing concern of GAO  Due to increasing cyber-based threats and the persistent nature of information security vulnerabilities, we have designated information security as a government-wide high-risk area since 1997  In 2003, we expanded the information security high-risk area to include the protection of critical cyber infrastructure  At that time, we highlighted the need to manage critical infrastructure protection activities that enhance the security of the cyber and physical public and private infrastructures that are essential to national security, national economic security, and/or national public health and safety  We further expanded the information security high-risk area in 2015 to include protecting the privacy of PII  Since then, advances in technology have enhanced the ability of government and private sector entities to collect and process extensive amounts of PII, which has posed challenges to ensuring the privacy of such information  In addition, high- profile PII breaches at commercial entities, such as Equifax, heightened concerns that personal privacy is not being adequately protected  Our experience has shown that the key elements needed to make progress toward being removed from the High-Risk List are top-level attention by the administration and agency leaders grounded in the five criteria for removal, as well as any needed congressional action  The five criteria for removal that we identified in November 2000 are as follows: Leadership Commitment  Demonstrated strong commitment and top leadership support  Capacity  The agency has the capacity (i e , people and resources) to resolve the risk(s)  Action Plan  A corrective action plan exists that defines the root cause, solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended  Monitoring  A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures  Demonstrated Progress  Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area  These five criteria form a road map for efforts to improve and ultimately address high-risk issues  Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list  Figure 2 shows the five criteria and illustrative actions taken by agencies to address the criteria  Importantly, the actions listed are not “stand alone” efforts taken in isolation from other actions to address high- risk issues  That is, actions taken under one criterion may be important to meeting other criteria as well  For example, top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress—actions which are also vital to monitoring criteria  As we reported in the February 2017 high-risk report, the federal government’s efforts to address information security deficiencies had fully met one of the five criteria for removal from the High-Risk List— leadership commitment—and partially met the other four, as shown in figure 3  We plan to update our assessment of this high-risk area against the five criteria in February 2019  Based on our prior work, we have identified four major cybersecurity challenges: (1) establishing a comprehensive cybersecurity strategy and performing effective oversight, (2) securing federal systems and information, (3) protecting cyber critical infrastructure, and (4) protecting privacy and sensitive data  To address these challenges, we have identified 10 critical actions that the federal government and other entities need to take (see figure 4)  The four challenges and the 10 actions needed to address them are summarized following the table  In addition, we also discuss in more detail each of the 10 actions in appendices II through XI  The federal government has been challenged in establishing a comprehensive cybersecurity strategy and in performing effective oversight as called for by federal law and policy  Specifically, we have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  We have also reported on challenges in performing oversight, including monitoring the global supply chain, ensuring a highly skilled cyber workforce, and addressing risks associated with emerging technologies  The federal government can take four key actions to improve the nation’s strategic approach to, and oversight of, cybersecurity  Develop and execute a more comprehensive federal strategy for national cybersecurity and global cyberspace  In February 2013 we reported that the government had issued a variety of strategy- related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  In October 2015, in response to our recommendation to develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy, the Director of OMB and the Federal Chief Information Officer issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  For example, a May 2017 presidential executive order required federal agencies to take a variety of actions, including better manage their cybersecurity risks and coordinate to meet reporting requirements related to cybersecurity of federal networks, critical infrastructure, and the nation  Additionally, the December 2017 National Security Strategy cites cybersecurity as a national priority and identifies related needed actions, such as including identifying and prioritizing risk, and building defensible government networks  Further, DHS issued a cybersecurity strategy in May 2018, which articulated seven goals the department plans to accomplish in support of its mission related to managing national cybersecurity risks  The strategy is intended to provide DHS with a framework to execute its cybersecurity responsibilities during the next 5 years to keep pace with the evolving cyber risk landscape by reducing vulnerabilities and building resilience; countering malicious actors in cyberspace; responding to incidents; and making the cyber ecosystem more secure and resilient  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we have previously recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically, the documents generally did not include milestones and performance measures to gauge results, nor did they describe the resources needed to carry out the goals and objective  Further, most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, the Department of Defense (DOD), and OMB, who contribute substantially to the nation’s cybersecurity programs  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  For more information on this action area, see appendix II  Mitigate global supply chain risks  The global, geographically disperse nature of the producers and suppliers of IT products is a growing concern  We have previously reported on potential issues associated with IT supply chain and risks originating from foreign- manufactured equipment  For example, in July 2017, we reported that the Department of State had relied on certain device manufacturers, software developers, and contractor support which had suppliers that were reported to be headquartered in a cyber-threat nation (e g , China and Russia)  We further pointed out that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  In July 2018, we testified that if such global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  These factors highlight the importance and urgency of federal agencies appropriately assessing, managing, and monitoring IT supply chain risk as part of their agency-wide information security programs  For more information on this action area, see appendix III  Address cybersecurity workforce management challenges  The federal government faces challenges in ensuring that the nation’s cybersecurity workforce has the appropriate skills  For example, in June 2018, we reported on federal efforts to implement the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015  We determined that most of the Chief Financial Officers (CFO) Act agencies had not fully implemented all statutory requirements, such as developing procedures for assigning codes to cybersecurity positions  Further, we have previously reported that DHS and DOD had not addressed cybersecurity workforce management requirements set forth in federal laws  In addition, we have reported in the last 2 years that federal agencies (1) had not identified and closed cybersecurity skills gaps, (2) had been challenged with recruiting and retaining qualified staff, and (3) had difficulty navigating the federal hiring process  A recent executive branch report also discussed challenges associated with the cybersecurity workforce  Specifically, in response to Executive Order 13800, the Department of Commerce and DHS led an interagency working group exploring how to support the growth and sustainment of future cybersecurity employees in the public and private sectors  In May 2018, the departments issued a report that identified key findings, including: the U S  cybersecurity workforce needs immediate and sustained improvements; the pool of cybersecurity candidates needs to be expanded through retraining and by increasing the participation of women, minorities, and veterans; a shortage exists of cybersecurity teachers at the primary and secondary levels, faculty in higher education, and training instructors; and comprehensive and reliable data about cybersecurity workforce position needs and education and training programs are lacking  The report also included recommendations and proposed actions to address the findings, including that private and public sectors should (1) align education and training with employers’ cybersecurity workforce needs by applying the National Initiative for Cybersecurity Education Cybersecurity Workforce Framework; (2) develop cybersecurity career model paths; and (3) establish a clearinghouse of information on cybersecurity workforce development education, training, and workforce development programs and initiatives  In addition, in June 2018, the executive branch issued a government reform plan and reorganization recommendations that included, among other things, proposals for solving the federal cybersecurity workforce shortage  In particular, the plan notes that the administration intends to prioritize and accelerate ongoing efforts to reform the way that the federal government recruits, evaluates, selects, pays, and places cyber talent across the enterprise  The plan further states that, by the end of the first quarter of fiscal year 2019, all CFO Act agencies, in coordination with DHS and OMB, are to develop a critical list of vacancies across their organizations  Subsequently, OMB and DHS are to analyze these lists and work with OPM to develop a government-wide approach to identifying or recruiting new employees or reskilling existing employees  Regarding cybersecurity training, the plan notes that OMB is to consult with DHS to standardize training for cybersecurity employees, and should work to develop an enterprise-wide training process for government cybersecurity employees  For more information on this action area, see appendix IV  Ensure the security of emerging technologies  As the devices used in daily life become increasingly integrated with technology, the risk to sensitive data and PII also grows  Over the last several years, we have reported on weaknesses in addressing vulnerabilities associated with emerging technologies, including: IoT devices, such as fitness trackers, cameras, and thermostats, that continuously collect and process information are potentially vulnerable to cyber-attacks; IoT devices, such as those acquired and used by DOD employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department; vehicles that are potentially susceptible to cyber-attack through technology, such as Bluetooth; the unknown impact of artificial intelligence cybersecurity; and advances in cryptocurrencies and blockchain technologies  Executive branch agencies have also highlighted the challenges associated with ensuring the security of emerging technologies  Specifically, in a May 2018 report issued in response to Executive Order 13800, the Department of Commerce and DHS issued a report on the opportunities and challenges in reducing the botnet threat  The opportunities and challenges are centered on six principal themes, including the global nature of automated, distributed attacks; effective tools; and awareness and education  The report also provides recommended actions, including that federal agencies should increase their understanding of what software components have been incorporated into acquired products and establish a public campaign to support awareness of IoT security  For more information on this action area, see appendix V  In our previously discussed reports related to this cybersecurity challenge, we made a total of 50 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 48 recommendations had not been implemented  These outstanding recommendations include 8 priority recommendations, meaning that we believe that they warrant priority attention from heads of key departments and agencies  These priority recommendations include addressing weaknesses associated with, among other things, agency-specific cybersecurity workforce challenges and agency responsibilities for supporting mitigation of vehicle network attacks  Until our recommendations are fully implemented, federal agencies may be limited in their ability to provide effective oversight of critical government-wide initiatives, address challenges with cybersecurity workforce management, and better ensure the security of emerging technologies  In addition to our prior work related to the federal government’s efforts to establish key strategy documents and implement effective oversight, we also have several ongoing reviews related to this challenge  These include reviews of: the CFO Act agencies’ efforts to submit complete and reliable baseline assessment reports of their cybersecurity workforces; the extent to which DOD has established training standards for cyber mission force personnel, and efforts the department has made to achieve its goal of a trained cyber mission force; and selected agencies’ ability to implement cloud service technologies and notable benefits this might have on agencies  The federal government has been challenged in securing federal systems and information  Specifically, we have reported that federal agencies have experienced challenges in implementing government-wide cybersecurity initiatives, addressing weaknesses in their information systems and responding to cyber incidents on their systems  This is particularly concerning given that the emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security  As such, it is important that federal agencies take appropriate steps to better ensure they have effectively implemented programs to protect their information and systems  We have identified three actions that the agencies can take  Improve implementation of government-wide cybersecurity initiatives  Specifically, in January 2016, we reported that DHS had not ensured that the National Cybersecurity Protection System (NCPS) had fully satisfied all intended system objectives related to intrusion detection and prevention, information sharing, and analytics  In addition, in February 2017, we reported that the DHS National Cybersecurity and Communications Integration Center’s (NCCIC) functions were not being performed in adherence with the principles set forth in federal laws  We noted that, although NCCIC was sharing information about cyber threats in the way it should, the center did not have metrics to measure that the information was timely, relevant and actionable, as prescribed by law  For more information on this action area, see appendix VI  Address weaknesses in federal information security programs  We have previously identified a number of weaknesses in agencies’ protection of their information and information systems  For example, over the past 2 years, we have reported that: most of the 24 agencies covered by the CFO Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management); three agencies—the Securities Exchange Commission, the Federal Deposit Insurance Corporation, and the Food and Drug Administration—had not effectively implemented aspects of their information security programs, which resulted in weaknesses in these agencies’ security controls; information security weaknesses in selected high-impact systems at four agencies—the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veterans Affairs—were cited as a key reason that the agencies had not effectively implemented elements of their information security programs; DOD’s process for monitoring the implementation of cybersecurity guidance had weaknesses and resulted in the closure of certain tasks (such as completing cyber risk assessments) before they were fully implemented; and agencies had not fully defined the role of their Chief Information Security Officers, as required by FISMA  We also recently testified that, although the government had acted to protect federal information systems, additional work was needed to improve agency security programs and cyber capabilities  In particular, we noted that further efforts were needed by agencies to implement our prior recommendations in order to strengthen their information security programs and technical controls over their computer networks and systems  For more information on this action area, see appendix VII  Enhance the federal response to cyber incidents  We have reported that certain agencies have had weaknesses in responding to cyber incidents  For example, as of August 2017, OPM had not fully implemented controls to address deficiencies identified as a result of its 2015 cyber incidents; DOD had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises; as of April 2016, DOD had not identified, clarified, or implemented all components of its support of civil authorities during cyber incidents; and as of January 2016, DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  For more information on this action area, see appendix VIII  In the public versions of the reports previously discussed for this challenge area, we made a total of 101 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 61 recommendations had not been implemented  These outstanding recommendations include 14 priority recommendations to address weaknesses associated with, among other things, the information security programs at the National Aeronautics and Space Administration, OPM, and the Security Exchange Commission  Until these recommendations are implemented, these federal agencies will be limited in their ability to ensure the effectiveness of their programs for protecting information and systems  In addition to our prior work, we also have several ongoing reviews related to the federal government’s efforts to protect its information and systems  These include reviews of: Federal Risk and Authorization Management Program (FedRAMP) implementation, including an assessment of the implementation of the program’s authorization process for protecting federal data in cloud environments; the Equifax data breach, including an assessment of federal oversight of credit reporting agencies’ collection, use, and protection of consumer PII; the Federal Communication Commission’s Electronic Comment Filing System security, to include a review of the agency’s detection of and response to a May 2017 incident that reportedly impacted the system; DOD’s efforts to improve the cybersecurity of its major weapon DOD’s whistleblower program, including an assessment of the policies, procedures, and controls related to the access and storage of sensitive and classified information needed for the program; IRS’s efforts to (1) implement security controls and the agency’s information security program, (2) authenticate taxpayers, and (3) secure tax information; and the federal approach and strategy to securing agency information systems, to include federal intrusion detection and prevention capabilities and the intrusion assessment plan  The federal government has been challenged in working with the private sector to protect critical infrastructure  This infrastructure includes both public and private systems vital to national security and other efforts, such as providing the essential services that underpin American society  As the cybersecurity threat to these systems continues to grow, federal agencies have millions of sensitive records that must be protected  Specifically, this critical infrastructure threat could have national security implications and more efforts should be made to ensure that it is not breached  To help address this issue, the National Institute of Standards and Technology (NIST) developed the cybersecurity framework—a voluntary set of cybersecurity standards and procedures for industry to adopt as a means of taking a risk-based approach to managing cybersecurity  However, additional action is needed to strengthen the federal role in protecting the critical infrastructure  Specifically, we have reported on other critical infrastructure protection issues that need to be addressed  For example: DHS did not track vulnerability reduction from the implementation and verification of planned security measures at the high-risk chemical facilities that engage with the department, as a basis for assessing performance  Entities within the 16 critical infrastructure sectors reported encountering four challenges to adopting the cybersecurity framework, such as being limited in their ability to commit necessary resources towards framework adoption and not having the necessary knowledge and skills to effectively implement the framework  DOD and the Federal Aviation Administration identified a variety of operations and physical security risks that could adversely affect DOD missions  Major challenges existed to securing the electricity grid against cyber threats  These challenges included monitoring implementation of cybersecurity standards, ensuring security features are built into smart grid systems, and establishing metrics for cybersecurity  DHS and other agencies needed to enhance cybersecurity in the maritime environment  Specifically, DHS did not include cyber risks in its risk assessments that were already in place nor did it address cyber risks in guidance for port security plans  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  For more information on this action area, see appendix IX  We made a total of 21 recommendations to federal agencies to address these weaknesses and others  These recommendations include, for example, a total of 9 recommendations to 9 sector-specific agencies to develop methods to determine the level and type of cybersecurity framework adoption across their respective sectors  As of August 2018, all 21 recommendations had not been implemented  Until these recommendations are implemented, the federal government will continue to be challenged in fulfilling its role in protecting the nation’s critical infrastructure  In addition to our prior work related to the federal government’s efforts to protect critical infrastructure, we also have several ongoing reviews focusing on: the physical and cybersecurity risks to pipelines across the country responsible for transmitting oil, natural gas, and other hazardous liquids; the cybersecurity risks to the electric grid; and the privatization of utilities at DOD installations  The federal government has been challenged in protecting privacy and sensitive data  Advances in technology, including powerful search technology and data analytics software, have made it easy to correlate information about individuals across large and numerous databases, which have become very inexpensive to maintain  In addition, ubiquitous Internet connectivity has facilitated sophisticated tracking of individuals and their activities through mobile devices such as smartphones and fitness trackers  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of PII maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  Federal agencies should take two types of actions to address this challenge area  In addition, we have previously proposed two matters for congressional consideration aimed toward better protecting PII  Improve federal efforts to protect privacy and sensitive data  We have issued several reports noting that agencies had deficiencies in protecting privacy and sensitive data that needed to be addressed  For example: The Department of Health and Human Services’ (HHS) Centers for Medicare and Medicaid Services (CMS) and external entities were at risk of compromising Medicare Beneficiary Data due to a lack of guidance and proper oversight  The Department of Education’s Office of Federal Student Aid had not properly overseen its school partners’ records or information security programs  HHS had not fully addressed key security elements in its guidance for protecting the security and privacy of electronic health information  CMS had not fully protected the privacy of users’ data on state- based marketplaces  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives aimed at eliminating the unnecessary collection, use, and display of SSNs  For more information on this action area, see appendix X  Appropriately limit the collection and use of personal information and ensure that it is obtained with appropriate knowledge or consent  We have issued a series of reports that highlight a number of the key concerns in this area  For example: The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent; Federal laws for smartphone tracking applications have not generally been well enforced; The FBI has not fully ensured privacy and accuracy related to the use of face recognition technology  For more information on this action area, see appendix XI  We have previously suggested that Congress consider amending laws, such as the Privacy Act of 1974 and the E-Government Act of 2002, because they may not consistently protect PII  Specifically, we found that while these laws and guidance set minimum requirements for agencies, they may not consistently protect PII in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles  However, revisions to the Privacy Act and the E-Government Act have not yet been enacted  Further, we also suggested that Congress consider strengthening the consumer privacy framework and review issues such as the adequacy of consumers’ ability to access, correct, and control their personal information; and privacy controls related to new technologies such as web tracking and mobile devices  However, these suggested changes have not yet been enacted  We also made a total of 29 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 28 recommendations had not been implemented  These outstanding recommendations include 6 priority recommendations to address weaknesses associated with, among other things, publishing privacy impact assessments and improving the accuracy of the FBI’s face recognition services  Until these recommendations are implemented, federal agencies will be challenged in their ability to protect privacy and sensitive data and ensure that its collection and use is appropriately limited  In addition to our prior work, we have several ongoing reviews related to protecting privacy and sensitive data  These include reviews of: IRS’s taxpayer authentication efforts, including what steps the agency is taking to monitor and improve its authentication methods; the extent to which the Department of Education’s Office of Federal Student Aid’s policies and procedures for overseeing non-school partners’ protection of federal student aid data align with federal requirements and guidance; data security issues related to credit reporting agencies, including a review of the causes and impacts of the August 2017 Equifax data breach; the extent to which Equifax assessed, responded to, and recovered from its August 2017 data breach; federal agencies’ efforts to remove PII from shared cyber threat indicators; and how the federal government has overseen Internet privacy, including the roles of the Federal Communications Commission and the Federal Trade Commission, and strengths and weaknesses of the current oversight authorities  In conclusion, since 2010, we have made over 3,000 recommendations to agencies aimed at addressing the four cybersecurity challenges  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  Of the roughly 3,000 recommendations made since 2010, nearly 1,000 had not been implemented as of August 2018  We have also designated 35 as priority recommendations, and as of August 2018, 31 had not been implemented  The federal government and the nation’s critical infrastructure are dependent on IT systems and electronic data, which make them highly vulnerable to a wide and evolving array of cyber-based threats  Securing these systems and data is vital to the nation’s security, prosperity, and well-being  Nevertheless, the security over these systems and data is inconsistent and urgent actions are needed to address ongoing cybersecurity and privacy challenges  Specifically, the federal government needs to implement a more comprehensive cybersecurity strategy and improve its oversight, including maintaining a qualified cybersecurity workforce; address security weaknesses in federal systems and information and enhance cyber incident response efforts; bolster the protection of cyber critical infrastructure; and prioritize efforts to protect individual’s privacy and PII  Until our recommendations are addressed and actions are taken to address the four challenges we identified, the federal government, the national critical infrastructure, and the personal information of U S  citizens will be increasingly susceptible to the multitude of cyber-related threats that exist  We are sending copies of this report to the appropriate congressional committees  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Nick Marinos at (202) 512-9342 or marinosn@gao gov or Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix XII  Critical Infrastructure Protection: DHS Should Take Actions to Measure Reduction in Chemical Facility Vulnerability and Share Information with First Responders  GAO-18-538  Washington, D C : August 8, 2018  High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation  GAO-18-645T  Washington, D C : July 25, 2018  Information Security: Supply Chain Risks Affecting Federal Agencies  GAO-18-667T  Washington, D C : July 12, 2018  Information Technology: Continued Implementation of High-Risk Recommendations Is Needed to Better Manage Acquisitions, Operations, and Cybersecurity  GAO-18-566T  Washington, D C : May 23, 2018  Cybersecurity: DHS Needs to Enhance Efforts to Improve and Promote the Security of Federal and Private-Sector Networks, GAO-18-520T  Washington, D C : April 24, 2018  Electronic Health Information: CMS Oversight of Medicare Beneficiary Data Security Needs Improvement  GAO-18-210  Washington, D C : March 6, 2018  Technology Assessment: Artificial Intelligence, Emerging Opportunities, Challenges, and Implications  GAO-18-142SP  Washington, D C : March 28, 2018  GAO Strategic Plan 2018-2023: Trends Affecting Government and Society  GAO-18-396SP  Washington, D C : February 22, 2018  Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption  GAO-18-211  Washington, D C : February 15, 2018  Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements  GAO-18-175  Washington, D C : February 6, 2018  Homeland Defense: Urgent Need for DOD and FAA to Address Risks and Improve Planning for Technology That Tracks Military Aircraft  GAO-18-177  Washington, D C : January 18, 2018  Federal Student Aid: Better Program Management and Oversight of Postsecondary Schools Needed to Protect Student Information  GAO-18-121  Washington, D C : December 15, 2017  Defense Civil Support: DOD Needs to Address Cyber Incident Training Requirements  GAO-18-47  Washington, D C : November 30, 2017  Federal Information Security: Weaknesses Continue to Indicate Need for Effective Implementation of Policies and Practices  GAO-17-549  Washington, D C : September 28, 2017  Information Security: OPM Has Improved Controls, but Further Efforts Are Needed  GAO-17-614  Washington, D C : August 3, 2017  Defense Cybersecurity: DOD’s Monitoring of Progress in Implementing Cyber Strategies Can Be Strengthened  GAO-17-512  Washington, D C : August 1, 2017  State Department Telecommunications: Information on Vendors and Cyber-Threat Nations  GAO-17-688R  Washington, D C : July 27, 2017  Internet of Things: Enhanced Assessments and Guidance Are Needed to Address Security Risks in DOD  GAO-17-668  Washington, D C : July 27, 2017  Information Security: SEC Improved Control of Financial Systems but Needs to Take Additional Actions  GAO-17-469  Washington, D C : July 27, 2017  Information Security: Control Deficiencies Continue to Limit IRS’s Effectiveness in Protecting Sensitive Financial and Taxpayer Data  GAO-17-395  Washington, D C : July 26, 2017  Social Security Numbers: OMB Actions Needed to Strengthen Federal Efforts to Limit Identity Theft Risks by Reducing Collection, Use, and Display  GAO-17-553  Washington, D C : July 25, 2017  Information Security: FDIC Needs to Improve Controls over Financial Systems and Information  GAO-17-436  Washington, D C : May 31, 2017  Technology Assessment: Internet of Things: Status and implications of an increasingly connected world  GAO-17-75  Washington, D C : May 15, 2017  Cybersecurity: DHS’s National Integration Center Generally Performs Required Functions but Needs to Evaluate Its Activities More Completely  GAO-17-163  Washington, D C : February 1, 2017  High-Risk Series: An Update  GAO-17-317  Washington, D C : February 2017  IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; Selected Departments Need to Assess Skill Gaps  GAO-17-8  Washington, D C : November 30, 2016  Electronic Health Information: HHS Needs to Strengthen Security and Privacy Guidance and Oversight  GAO-16-771  Washington, D C : September 26, 2016  Defense Civil Support: DOD Needs to Identify National Guard’s Cyber Capabilities and Address Challenges in Its Exercises  GAO-16-574  Washington, D C : September 6, 2016  Information Security: FDA Needs to Rectify Control Weaknesses That Place Industry and Public Health Data at Risk  GAO-16-513  Washington, D C : August 30, 2016  Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority  GAO-16-686  Washington, D C : August 26, 2016  Federal Hiring: OPM Needs to Improve Management and Oversight of Hiring Authorities  GAO-16-521  Washington, D C : August 2, 2016  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 


Report 2:  At a minimum, this effort should involve the agencies that our survey suggests may offer such insights  (Recommendation 2) We provided a draft of this report to the Director of the Office of Management and Budget for review and comment  We also provided a draft of the report to the heads of each of the 24 federal agencies covered by our survey  OMB had no comments, and informed us that it would assess our recommendations and consider how best to respond  We are sending copies of this report to congressional requesters, the Director of the Office of Management and Budget, the heads of each of the 24 agencies, and other interested parties  This report will also be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-6806 or mcneilt@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of our report  Key contributors to this report are listed in appendix IV  (USDA) (Goverment-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Commerce) (Goverment-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Goverment-wide) (DOD) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Education) (Goverment-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (Energy) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (HHS) (Goverment-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (DHS) (Goverment-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (HUD) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Interior) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (DOJ) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (DOL) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (State) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (DOT) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Treasury) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (VA) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Goverment-wide) (USAID) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (EPA) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (GSA) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (NASA) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (NSF) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (NRC) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (OPM) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (SBA) (Government-wide) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” (Government-wide) (SSA) 10  The individual I report to 11  Employees that report to me 0 Percent of managers reporting “Great” or “Very Great” This report responds to a request that we analyze agency-level results from our 2017 survey of federal managers at the 24 agencies covered by the Chief Financial Officers (CFO) Act of 1990, as amended, to determine the extent agencies are using performance information  This report assesses the extent to which: 1  the reported use of performance information and related leading practices at 24 agencies has changed compared to our prior survey in 2013; 2  being subject to data-driven reviews related to managers’ reported use of performance information and leading practices; and 3  the Executive Branch has taken actions to enhance agencies’ use of performance information in various decision-making activities  From November 2016 through March 2017, we administered our online survey to a stratified random sample of 4,395 individuals from a population of 153,779 mid- and upper-level civilian managers and supervisors at the 24 CFO Act agencies  The management levels covered general schedule (GS) or equivalent schedules at levels comparable to GS-13 through GS-15, and career Senior Executive Service (SES) or equivalent  We obtained the sample from the Office of Personnel Management’s Enterprise Human Resources Integration database as of September 30, 2015—the most recent fiscal year data available at the time  The sample was stratified by agency and whether the manager or supervisor was a member of the SES  To help determine the reliability and accuracy of the database elements used to draw our sample of federal managers for the 2017 survey, we checked the data for reasonableness and the presence of any obvious or potential errors in accuracy and completeness and reviewed our past analyses of the reliability of this database  We concluded in our September 2017 report that the data used to draw our sample were sufficiently reliable for the purpose of the survey  For the 2017 survey, we received usable questionnaires from about 67 percent of the eligible sample  The weighted response rate at each agency generally ranged from 57 percent to 82 percent, except the Department of Justice, which had a weighted response rate of 36 percent  The overall survey results are generalizable to the population of managers government-wide and at each individual agency  To assess the potential bias from agencies with lower response rates, we conducted a nonresponse bias analysis using information from the survey and sampling frame as available  The analysis confirmed discrepancies in the tendency to respond to the survey related to agency and SES status  The analysis also revealed some differences in response propensity by age and GS level; however, the direction and magnitude of the differences on these factors were not consistent across agencies or strata  Our data may be subject to bias from unmeasured sources for which we cannot control  Results, and in particular estimates from agencies with low response rates such as the Department of Justice, should be interpreted with caution  However, the survey’s results are comparable to five previous surveys we conducted in 1997, 2000, 2003, 2007, and 2013  To address the first objective, we used data from our 2017 survey to update agency scores on our use of performance information index  This index, which was last updated using data from our 2013 survey, averages managers’ responses on 11 questions related to the use of performance information for various management activities and decision making  Using 2017 survey data, we conducted statistical analyses to ensure these 11 questions were still positively correlated  That analysis confirmed that no negative correlations existed and therefore no changes to the index were needed  Figure 11 shows the questions that comprise the index  After calculating agency index scores for 2017, we compared them to previous results from 2007 and 2013, and to the government-wide average for 2017, to identify any statistically significant differences  We focus on statistically significant results because these indicate that observed relationships between variables and differences between groups are likely to be valid, after accounting for the effects of sampling and other sources of survey error  For each of the 11 questions that comprise the index, we identified individual agency results, excluding missing and no basis to judge responses, and determined when they were statistically significantly different from (1) the agency’s results on the same question in 2013, or (2) the government-wide average results on the question in 2017  In this report, we analyzed and summarized the results of our 2017 survey of federal managers  Due to the limited scope of the engagement, we did not conduct additional audit work to determine what may have caused statistically significant changes between our 2017 and past survey results  To further address this objective we completed several statistical analyses that allowed us to assess the association between the index and 22 survey questions that we determined relate to leading practices we previously found promote the use of performance information  See figure 12 for the 22 specific questions related to these five practices that we included in the analysis  When we individually tested these 22 survey questions (bivariate regression), we found that each was statistically significantly and positively related to the index in 2017  This means that each question, when tested in isolation from other factors, was associated with higher scores on the index  However, when all 22 questions were tested together (multivariate regression), we found that 5 questions continued to be positively and significantly associated with the index in 2017, after controlling for other factors  To conduct this multivariate analysis, we began with a base model that treated differences in managers’ views of agency performance management use as a function of the agency where they worked  We found, however, that a model based on agency alone had little predictive power (R-squared of 0 04)  We next examined whether managers’ responses to these questions reflecting practices that promote the use of performance information related to their perceptions of agency use of performance information, independent of agency  The results of this analysis are presented in table 1 below  Each coefficient reflects the increase in our index associated with a one-unit increase in the value of a particular survey question  Our final multivariate regression model had an R-squared of 0 67, suggesting that the variables in this model explain approximately 67 percent of the variation in the use index  We also tested this model controlling for whether a respondent was a member of the SES and found similar results  As shown above in table 1, five questions related to three of the leading practices that promote agencies’ use of performance information were statistically significant in 2017  These results suggest that, when controlling for other factors, certain specific efforts to increase agency use of performance information—such as providing information on the validity of performance data—may have a higher return and lead to higher index scores  With respect to aligning agency-wide goals, objectives, and measures, we found that each increase in terms of the extent to which individuals felt that managers aligned performance measures with agencywide goals and objectives was associated with a 0 08 increase in their score on the use index  In terms of improving the usefulness of performance information, we found that having information on the validity of performance data for decision making was the strongest predictor in our model (0 18)  As measured here, taking steps to ensure the performance information is useful and appropriate was associated with almost as large a change in a managers’ index score (0 16)  In terms of developing agency capacity to use performance information, we found that having sufficient analytical tools to collect, analyze, and use performance information (0 07), and providing or paying for training that would help link their programs to achievement of agency strategic goals (0 10), were also statistically significantly related to a manager’s reported use of performance information  When we combined these results with what we previously found through a similar analysis of 2013 survey results in September 2014, we identified 10 questions that have had a statistically significant association with higher index scores  This reinforces the importance of the five leading practices to promote the use of performance information  For each of these questions, which are outlined in figure 13 below, we determined when agency results were statistically significantly different from 2013 results or the 2017 government-wide average  For the second objective, we examined, based on the extent they responded their programs had been subject to agency data-driven reviews, differences in managers’ use index scores and responses on questions related to practices that promote the use of performance information  We grouped managers based on the extent they reported their programs had been subject to these reviews, from “no extent” through “very great extent ” We then calculated the average index scores for the managers in each of those five categories  We also examined differences in how managers responded to the 10 questions reflecting practices that can promote the use of performance information based on the extent they reported their programs had been subject to data-driven reviews  We grouped managers into three categories based on the extent they reported their programs had been subject to these reviews (no-small extent, moderate extent, great-very great extent)  We then compared how these groups responded to the ten questions  For the third objective, we reviewed our past work that assessed Executive Branch activities to enhance the use of performance information; various resources (i e , guidance, guides, and playbooks) developed by the Office of Management and Budget (OMB) and the Performance Improvement Council (PIC) that could support agencies’ use of performance information; and the President’s Management Agenda, and related materials with information on cross-agency efforts to improve the use of data in federal decision making  Lastly, for the third objective we also interviewed OMB and PIC staff about any actions they have taken, or planned to take, to further support the use of performance information across the federal government  We conducted this performance audit from October 2017 to September 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the above contact, Benjamin T  Licht (Assistant Director) and Adam Miles (Analyst-in-Charge) supervised this review and the development of the resulting report  Arpita Chattopadhyay, Caitlin Cusati, Meredith Moles, Dae Park, Amanda Prichard, Steven Putansu, Alan Rozzi, Shane Spencer, and Khristi Wilkins also made key contributions  Robert Robinson developed the graphics for this report  Alexandra Edwards, Jeff DeMarco, Mark Kehoe, Ulyana Panchishin, and Daniel Webb verified the information presented in this report  Results of the Periodic Surveys on Organizational Performance and Management Issues Managing for Results: Further Progress Made in Implementing the GPRA Modernization Act, but Additional Actions Needed to Address Pressing Governance Challenges  GAO-17-775  Washington, D C : September 29, 2017  Supplemental Material for GAO-17-775: 2017 Survey of Federal Managers on Organizational Performance and Management Issues  GAO-17-776SP  Washington, D C : September 29, 2017  Program Evaluation: Annual Agency-wide Plans Could Enhance Leadership Support for Program Evaluations  GAO-17-743  Washington, D C : September 29, 2017  Managing for Results: Agencies’ Trends in the Use of Performance Information to Make Decisions  GAO-14-747  Washington, D C : September 26, 2014  Managing for Results: Executive Branch Should More Fully Implement the GPRA Modernization Act to Address Pressing Governance Challenges  GAO-13-518  Washington, D C : June 26, 2013  Managing for Results: 2013 Federal Managers Survey on Organizational Performance and Management Issues, an E-supplement to GAO-13-518  GAO-13-519SP  Washington, D C : June 26, 2013  Program Evaluation: Strategies to Facilitate Agencies’ Use of Evaluation in Program Management and Policy Making  GAO-13-570  Washington, D C : June 26, 2013  Government Performance: Lessons Learned for the Next Administration on Using Performance Information to Improve Results  GAO-08-1026T  Washington, D C : July 24, 2008  Government Performance: 2007 Federal Managers Survey on Performance and Management Issues, an E-supplement to GAO-08-1026T  GAO-08-1036SP  Washington, D C : July 24, 2008  Results-Oriented Government: GPRA Has Established a Solid Foundation for Achieving Greater Results  GAO-04-38  Washington, D C : March 10, 2004  Managing for Results: Federal Managers’ Views on Key Management Issues Vary Widely Across Agencies  GAO-01-592  Washington, D C : May 25, 2001  Managing for Results: Federal Managers’ Views Show Need for Ensuring Top Leadership Skills GAO-01-127  Washington, D C : October 20, 2000  The Government Performance and Results Act: 1997 Governmentwide Implementation Will Be Uneven  GAO/GGD-97-109  Washington, D C : June 2, 1997 

ground_truth: To reform the federal government and make it more efficient and effective, agencies need to use data about program performance. The benefit of collecting performance information is only fully realized when it is used by managers to make decisions aimed at improving results. GAO was asked to review agencies' use of performance information. This report assesses, among other things, the extent to which: (1) 24 agencies' reported use of performance information and related leading practices has changed since 2013 and (2) the Executive Branch has taken actions to enhance the use of performance information. To address the first objective, GAO analyzed results from its 2017 survey of federal managers, and compared them to 2013 results. The survey covered a stratified random sample of 4,395 managers from the 24 Chief Financial Officers Act agencies. The survey had a 67 percent response rate and results can be generalized to the population of managers government-wide and at each agency. For the second objective, GAO reviewed agency documents and interviewed staff from OMB and the PIC. Agencies' reported use of performance information to make decisions, and leading practices that can promote such use, generally has not improved since GAO's last survey of federal managers in 2013. However, GAO's survey results continue to point to certain practices that could help agencies improve managers' use of performance information. For example, as shown in the table below, GAO's survey found that managers whose programs were subject to data-driven reviews (regular reviews used to assess progress on select agency goals) to a greater extent reported statistically significantly greater use of performance information to make decisions. The Executive Branch has begun taking steps to improve the use of performance information within agencies and across the government. For example, In the President's Management Agenda and government-wide reform plan, released in March and June 2018 respectively, the administration acknowledged the need to do more, and announced a goal, among other actions, to improve the use of data in federal decision making. However, the Office of Management and Budget (OMB) and others responsible for this goal have yet to fully develop action plans to hold agencies accountable for achieving it. The Performance Improvement Council (PIC), which is chaired by OMB, has undertaken efforts to improve the use of performance information by, for example, creating a working group on agency performance reviews. But it has not yet taken a systematic approach to identify and share proven practices that led to, or challenges that may be hampering, increased use of performance information by managers. GAO's survey results identified agencies that may have insights into such practices and challenges. More fully developing action plans for the new goal, and identifying and sharing proven practices and challenges, could help ensure the Executive Branch takes further steps to improve the use of performance information by managers within agencies and across the federal government. To improve the use of performance information within agencies and across the federal government, GAO recommends that OMB work with (1) fellow goal leaders to more fully develop action plans for the new goal to improve the use of data and (2) the PIC to prioritize efforts to identify and share proven practices and challenges. OMB had no comments on this report.