prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: In accordance with the Improper Payments Information Act of 2002 (IPIA), as amended, and OMB guidance, CMS developed the PERM to estimate the national Medicaid improper payment rate  CMS has other mechanisms to review and assess program integrity risks in state Medicaid managed care programs, and it uses information from the PERM to target its program integrity activities and oversight of states’ Medicaid programs  IPIA requires federal executive branch agencies to, among other things, (1) identify programs and activities that may be susceptible to significant improper payments; and (2), on an annual basis, estimate the amount of improper payments for susceptible programs and activities  Agency heads must produce a statistically valid estimate or an estimate that is otherwise appropriate, using an OMB-approved alternate methodology  Those agencies with programs identified by OMB as being high priority for additional oversight and review are required to submit annual reports to their Inspectors General detailing the actions the agency plans to take to recover improper payments and prevent future improper payments  The Inspector General of each agency submitting such a report is required to review the quality of the improper payment estimates and methodology, among other things  OMB designated Medicaid as a high priority program  In addition, the Improper Payments Elimination and Recovery Act of 2010 requires the Inspector General of each agency to conduct a compliance review to report on the agency’s compliance with several criteria, one of which is that an agency has reported an improper payment rate of less than 10 percent for each program and activity  IPIA also directed OMB to issue guidance for agencies in implementing the IPIA improper payments requirements  Among other things, the OMB guidance requires that agencies review payments made at the point that federal funds are transferred to nonfederal entities and report on the root causes of identified improper payments  To calculate the Medicaid improper payment rate through the PERM, CMS computes an annual rolling average of improper payment rates across all states based on a 17-state, 3-year rotation cycle  In accordance with IPIA, as amended, OMB approved CMS’s PERM methodology, and the HHS-OIG conducts annual compliance reviews  Beginning with its annual improper payment compliance review for fiscal year 2014, the HHS-OIG established a rotating approach to reviewing the estimation methodology for high-priority programs, including Medicaid, that OMB deemed susceptible to improper payments  Due to the number and complexity of the programs, the HHS-OIG methodology reviews are scheduled to be performed over a 4-year period; the PERM estimation methodology will be reviewed as a part of its fiscal year 2017 compliance review  Each of the three components of the Medicaid PERM—FFS, managed care, and eligibility—is estimated differently: The FFS component of the PERM measures errors in a sample of FFS claims, which are records of services provided and the amount the Medicaid program paid for these services  For the majority of sampled FFS claims, the PERM review contractor performs a medical review, which includes a review of the medical documentation to determine errors that do not meet federal and state policies, such as medically unnecessary services, diagnosis coding errors, and policy violations  Any FFS claims that were paid for services that should have been covered under a managed care plan’s capitated payment are also considered errors  The managed care component of the PERM measures errors that occur in the capitated payments that state Medicaid agencies make to managed care organizations (MCO) on behalf of enrollees  Capitated payments are periodic payments approved by CMS that state Medicaid agencies make to contracted MCOs to cover the provision of medical services to enrollees, as well as the MCOs’ administrative expenses and their profits or earnings  The PERM assesses whether any payments made to the MCOs were in amounts different than those the state agency is contractually required to pay, which are approved by CMS  In contrast to the FFS component, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data  The eligibility component of the PERM measures errors in state determinations of whether enrollees meet categorical and financial criteria for receipt of benefits under the Medicaid program  The eligibility component assesses determinations for both FFS and managed care enrollees  This component has not been calculated since 2014; instead, CMS piloted different approaches to update the methodologies used to assess enrollee eligibility, as the Patient Protection and Affordable Care Act changed income eligibility requirements for nonelderly, nonpregnant individuals who qualify for Medicaid  Beginning in the 2019 reporting year, eligibility reviews under the PERM will resume and will be conducted by a federal contractor  Medicaid program integrity consists of efforts to ensure that federal and state expenditures are used to deliver quality, necessary care to eligible enrollees, and efforts to prevent fraud, waste, and abuse  We have found in prior work that CMS’s and states’ program integrity efforts focused primarily on payments and services delivered under FFS and did not closely examine program integrity in Medicaid managed care  For Medicaid managed care, CMS has largely delegated program integrity oversight of MCOs to the states  States, in turn, generally oversee MCOs and the providers under contract to MCOs through their contracts with the MCOs and reporting requirements  Some program integrity risks for managed care are similar to those in FFS, including payments made for nonenrolled, ineligible, or deceased individuals; payments to ineligible, excluded, or deceased providers; and payments to providers for improper or false claims, such as payments for services that are not medically necessary  Other program integrity risks are more unique to managed care  For example, capitated payments generally reflect the average cost to provide covered services to enrollees, rather than a specific service  Federal law requires capitation rates to be actuarially sound, meaning that, among other things, they must be reasonably calculated for the populations expected to be covered and for the services expected to be furnished under contract  In order to receive federal funds for its managed care program, a state is required to submit the rates it pays MCOs and the methodology it uses to set those rates to CMS for review and approval  Additionally, federal and state oversight of Medicaid managed care can include ensuring that MCOs fulfill contractual provisions within their managed care contracts  In some cases, these provisions relate directly to program integrity activities, including plans and procedures for identifying, recovering, and reporting on overpayments made to providers  The managed care component of the PERM measures the accuracy of the capitated payments state Medicaid agencies make to MCOs  Specifically, a CMS contractor examines whether the state agency made capitated payments only for eligible enrollees, made capitated payments for the correct amount based on the contract and coverage requirements (time period and geographic location), made capitated payments based on the correct rate for enrollees, and did not make any duplicate payments for enrollees  CMS officials noted that the agency established capitated payments as the level of review, because the capitation rate is the transaction used to determine the federal match in managed care  In general, the federal government matches most state expenditures for Medicaid services on the basis of a statutory formula  In FFS, the federal match is provided for the amount the state pays a health care provider for delivering services to enrollees  With managed care, the federal match is provided for the amount of the capitation rate the state pays the MCO  Capitated payments do not directly relate to the provision of a specific service, but reflect the average cost to provide covered services to enrollees  As a result, CMS officials maintain that the capitated payment is the lowest transaction level at which the agency can clearly identify federal funds without making significant assumptions  Because the managed care component of the PERM review is limited to measuring capitated payments, it does not account for other program integrity risks—such as overpayments to providers and unallowable MCO costs  In addition to errors in capitated payments included in PERM reviews, CMS regulations state that overpayments in managed care include any payment made to an MCO or provider under contract to an MCO to which the MCO or provider is not entitled under Medicaid  Such overpayments included payments for services that were not provided or medically necessary; or to ineligible, excluded, or deceased providers, which are not measured by the PERM  Unallowable MCO costs refers to operating costs that MCOs cannot claim under their managed care contracts, such as certain marketing costs, or that the MCO reported incorrectly  Among the 27 audits and investigations of Medicaid managed care programs we reviewed, 10 identified about $68 million in MCO overpayments to providers and unallowable MCO costs that were not accounted for in PERM estimates  In addition, one investigation of an MCO operating in nine states resulted in a $137 5 million settlement to resolve allegations of false claims  (See app  I for a complete list of the audits and investigations we identified ) However, the full extent of these overpayments and unallowable costs is unknown, because these audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017  Specifically, 24 of the audits and investigations represented reviews in 10 states and, in many cases, focused on individual providers or MCOs; there were about 90 MCOs operating in the 10 states as of September 2017, according to the Kaiser Family Foundation  Some examples of the audits and investigations that identified overpayments and unallowable costs include the following: The Washington State Auditor’s Office found that two MCOs made $17 5 million in overpayments to providers in 2010, which may have increased the state’s 2013 capitation rates  The New York State Comptroller found that two MCOs paid over $6 6 million to excluded and deceased providers from 2011 through 2014  The Massachusetts State Auditor found that one MCO paid $420,000 for health care services and unauthorized prescriptions from excluded providers in 2013 and 2014  The Department of Justice alleged that an MCO operating in several states submitted inflated expenditure information to the state Medicaid agencies, falsified encounter data, and manipulated claims costs and service provision costs in nine states  The MCO agreed to pay over $137 5 million to resolve these claims  The Texas State Auditor’s Office found that an MCO reported $3 8 million in unallowable costs for advertising, company events, gifts, and stock options, along with $34 million in other questionable costs in 2015  The New York State Comptroller also found that an MCO claimed over $260,000 in unallowable administrative expenses, which contributed to an increase in capitation rates across the state  To the extent that the state does not identify or know of MCO overpayments to providers or unallowable MCO costs, the overpayments and unallowable costs could inflate future capitation rates, as the Washington State Auditor and New York State Comptroller noted in their findings  The PERM assesses the accuracy of capitated payments that states make to MCOs  States set capitation rates based on cost data— historical utilization and spending—that MCOs submit to the state Medicaid agencies, but the PERM does not consider these data  Unless removed from these cost data, unidentified overpayments and unallowable costs would likely inflate the MCO cost data that states use to set capitation rates  (See fig  1 ) As a result, future capitation rates would also be inflated, resulting in higher state and federal spending  In fiscal year 2017, the Medicaid managed care improper payment rate was 0 3 percent, while the FFS improper payment rate was 12 9 percent, leading to an assumption that the estimated risks in managed care are less significant than those estimated in FFS  However, the managed care component of the PERM does not determine whether MCO payments to providers were for services that were medically necessary, actually provided, accurately billed and delivered by eligible providers, or whether the MCO costs were allowable and appropriate  As a result, the PERM improper payment estimate potentially understates the extent of program integrity risks in Medicaid managed care  Moreover, this potential understatement in the PERM’s improper payment rate estimate may curtail investigations into the appropriateness of MCO spending  We previously reported that CMS and state program integrity efforts did not closely examine program integrity in Medicaid managed care, focusing primarily on payments and services delivered under FFS  Our current review of the 27 audits we identified encompassed a 5-year period, suggesting that reviews of managed care continue to be limited  An official from a state auditor’s office we spoke with suggested that some states may not audit services delivered under managed care, because of a low improper payment rate  In addition, he noted that his state Medicaid agency used the relatively low payment error rate in managed care as an indicator of few program integrity problems  As noted, CMS has increased its focus on and worked with states to improve oversight of Medicaid managed care; however, these efforts and the oversight efforts of states do not ensure the identification and reporting of overpayments and unallowable costs  In recent years, the agency has sought to strengthen oversight of managed care programs through updated regulations; reviews of states’ managed care programs (Focused Program Integrity Reviews) and collaborative audits, which are conducted jointly by federal program integrity contractors and states; and state monitoring of overpayments  Regulations  In May 2016, CMS updated its regulations for managed care programs in order to strengthen oversight  The updated regulations require a number of additional program integrity activities, such as those listed below  If fully implemented, these updated regulations may help with the identification and removal of overpayments and unallowable costs from data used to set future capitation rates  Under these regulations States must arrange for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by MCOs, at least once every 3 years  Through contracts with MCOs, states must require MCOs to have a mechanism through which providers report and return overpayments to the MCOs  States must also require MCOs to promptly report any identified or recovered overpayments—specifying those that are potentially fraudulent—and submit an annual report on recovered overpayments to their state  States must use this information when setting actuarially sound capitation rates  Through contracts with MCOs, states must also require MCOs to report specific data, information, and documentation  In addition, the MCO’s chief executive officer or authorized representative must certify the accuracy and completeness of the reported data, information, and documentation  States must enroll MCO providers that are not otherwise enrolled with the state to provide services to enrollees in Medicaid FFS, and revalidate the enrollment at least once every 5 years  Initially this requirement was to start for MCO contracts beginning on July 1, 2018  Subsequently enacted legislation codified this requirement in statute and moved the implementation to January 1, 2018  It is too early to know if these regulations will assure better oversight of MCO payments to providers and the data used to set future capitation rates  The above program integrity requirements only went into effect recently—for contracts starting on or after July 1, 2017, and January 1, 2018  In addition, CMS issued a notice in June 2017 stating that the agency will use its enforcement discretion to assist states that are unable to implement new requirements by the required compliance date  Also, CMS has delayed issuance of implementing guidance for certain provisions until the agency completes its review, a step that may further delay states’ implementation  The agency has designated Medicaid managed care for “deregulatory action” and plans to propose a new rule, but has not indicated which of these provisions, if any, would be revised  Focused Program Integrity Reviews  In fiscal year 2014, CMS implemented its Focused Program Integrity Reviews in order to target high-risk program integrity areas in each state, including managed care  As we previously reported, these focused reviews are narrower in scope than the prior reviews conducted by CMS, but they still involve on-site visits to states  In its focused reviews of managed care, CMS found that several states had incomplete oversight of MCO payments to providers, even though the agency relies on states to verify reported MCO overpayments and to ensure the overpayments are excluded from the data used to set capitation rates  In the 27 focused reviews of managed care from 2014 to 2017, CMS found that MCOs in 17 states reported fewer overpayments to their state Medicaid agencies than CMS would expect  For example, MCOs in at least 5 states reported that overpayments were less than 0 1 percent of their total managed care expenditures; while CMS noted in 1 focused review that overpayments typically equal 1 to 10 percent of total expenditures in managed care  CMS also found that 5 of the 27 states did not verify that MCOs excluded overpayments from these data, and 1 state did not exclude overpayments from the capitation rate setting  This is consistent with our March 2017 report in which we noted that CMS commonly found that MCOs reported low amounts of recovered overpayments and conducted few reviews to identify overpayments  Also, officials from three of the five states we interviewed for that report said the focused reviews gave them leverage in dealing with MCOs or led MCOs to focus more on program integrity  We also reported that CMS officials recommended states take steps to improve their oversight of MCOs, based on the focused review findings  The findings from CMS’s focused reviews of managed care also highlight the need for greater federal oversight of states  Without these reviews, it is unclear if states would independently identify MCOs’ reporting of overpayments or work to strengthen MCO reporting  Yet, CMS has not yet published the focused reviews of managed care in 13 states, and it may only conduct a focused review in a state once every three or more years  Given CMS’s timeline for the focused reviews, it may take years to determine if corrective actions result in improved program integrity in services delivered through managed care  Collaborative audits  CMS has expanded the federal-state collaborative audits beyond FFS, and has begun to engage states to participate in collaborative audits of MCOs and providers under contract to MCOs  As a part of the collaborative audit process, the state volunteers to jointly develop the audit processes the federal contractors follow  CMS officials told us that federal contractors have completed 14 collaborative audits of providers under contract to MCOs in three states—Arizona, the District of Columbia, and Tennessee  Only the audit of Trusted Healthcare, an MCO in the District of Columbia, has been published  That audit identified $129,000 in overpayments in a sample of MCO payments to providers, which, if generalized to all of the MCO’s payments over 6 months, would equate to over $4 million in overpayments  According to CMS, three additional states—Louisiana, Nebraska, and New Hampshire—have shown interest in collaborative audits of their MCOs, although such audits require states to prepare data files for the federal contractor and commit staff time  In our March 2017 report, we found that states’ participation in FFS collaborative audits varied and some states reported barriers to their participation  Expanding collaborative audits in managed care will require commitment from and coordination with states  State monitoring of overpayments in managed care  States are required to report overpayments they have identified and recouped along with state expenditures on a quarterly basis  However, based on the responses of the program integrity officials in 13 of the 16 states we contacted, most officials were unable to define the magnitude of overpayments in their managed care programs, which may signify a need for greater federal oversight or coordination  Specifically, officials in 7 of the 13 states could not or did not identify the share of total reported Medicaid overpayments that occurred in managed care  In 11 of the 13 states, officials responded that they did not directly monitor MCO payments to providers  Of those 11 states, officials in 4 said they depend on MCOs to report overpayments and exclude the overpayments from the data used to set capitation rates  As long as states are not taking action to identify overpayments in managed care, they cannot be assured that they are accurately paying MCOs for medically necessary services provided to enrollees  Federal internal control standards call for agency management to identify, analyze, and respond to risks  CMS has taken some steps to identify, analyze, and respond to risks through its regulations, Focused Program Integrity Reviews, and collaborative audits  However, key CMS and state oversight efforts fall short of mitigating the limitations of the PERM estimates of improper payments for managed care, because they do not ensure the identification and reporting of overpayments to providers and unallowable MCO costs  Without addressing these key risks, CMS and states cannot ensure the integrity of Medicaid managed care programs  The 0 3 percent improper payment rate for Medicaid managed care, as measured by the PERM, is significantly lower than the improper payment rate of 12 9 percent for Medicaid FFS  However, this difference does not signal better oversight; rather, it represents differences in the review criteria between FFS and managed care, which result in a less complete accounting for the program integrity risks in managed care  The PERM does not account for key program integrity risks in Medicaid managed care: specifically, unidentified overpayments and unallowable costs  One federal investigation of an MCO operating in nine states resulted in a settlement of $137 5 million to resolve allegations of false claims that were not captured in the national Medicaid improper payment rate estimate  Further, CMS found that MCOs and states do not provide sufficient oversight in Medicaid managed care to address the risks that are not accounted for in the PERM, findings that are reinforced by our reports on Medicaid managed care program integrity  CMS has taken steps to improve its oversight of Medicaid managed care, yet these efforts fall short of ensuring that the agency and states will be able to identify and address overpayments to providers and unallowable MCO costs  Without better measurement of program risks—particularly as expenditures for Medicaid managed care continue to grow—CMS cannot be certain that the low improper payment rate for managed care, as measured by the PERM, accurately reflects lower risks in managed care  The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care  (Recommendation 1) We provided a draft of this report to the Department of Health and Human Services (HHS) for comment  In its written comments, HHS concurred with our recommendation, and indicated that it will review regulatory authority and audit resources to determine the best way to account for Medicaid program risks that are not accounted for in the PERM  However, HHS stated that the PERM is not intended to measure all Medicaid program integrity risks, and utilizing the PERM measurement in that way would be a misunderstanding and misuse of the reported rate  HHS also commented that a review of payments from MCOs to providers is outside the scope of IPIA  In addition, HHS asserted that including such a review would diminish the value of PERM reporting—because it would require significant assumptions about the amount of federal share in MCO payments to providers  Further, HHS maintained that such a review also would result in a measurement that was not comparable to other programs or agencies, which would diminish the value of government- wide improper payment rate reporting  We acknowledge that the current PERM methodology has been approved by OMB  However, we maintain that the PERM likely underestimates program integrity risks in Medicaid managed care  To ensure the appropriate targeting of program integrity activities, CMS needs better information about these risks  Given the size of the Medicaid program, its vulnerability to improper payments, and the growth in managed care, it is critical to have a full accounting of program integrity risks in managed care in order to best ensure the integrity of the whole Medicaid program  In its written comments, HHS also summarized several activities it uses to oversee and support states’ Medicaid program integrity efforts, including state program integrity reviews; collaborative audits conducted by federal contractors; Medicaid Integrity Institute training for state employees; and the Medicaid Provider Enrollment Compendium  HHS also provided technical comments, which we incorporated as appropriate  HHS’s comments are reprinted in appendix II  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff that made key contributions to this report are listed in appendix III  We reviewed 16 federal and state audits and 11 notices of investigations of Medicaid managed care organizations (MCO) and providers issued from January 2012 to September 2017  As the findings below show, the audits and investigations represent a limited number of reviews that, in many cases, focused on individual states and individual providers or MCOs within that state  Given the limited scope and number of states reviewed, the amount of the overpayments and unallowable costs occurring nationwide is unknown  These audits and investigations show cases of MCO overpayments to providers or unallowable costs, which are not accounted for by the Centers for Medicare & Medicaid Services’ Payment Error Rate Measurement (PERM) ; errors in capitated payments (e g , capitated payments made for deceased individuals), which are accounted for in the PERM; and gaps in managed care oversight  When reporting overpayments and unallowable costs identified in the audits and investigations, we only include amounts specifically attributed to MCOs in our total  This total does not include the following: overpayments and unallowable costs identified in those audits and investigations that did not distinguish between the amounts attributable to MCOs, Medicaid fee-for-service, or Medicare; overpayments and unallowable costs identified in criminal proceedings that are not yet resolved; and errors in capitated payments, as those payments would be reviewed by the PERM  As a result, the total amount of overpayments and unallowable costs and capitated payment errors in this appendix exceed what we report  In addition to the contact named above, Leslie V  Gordon (Assistant Director), Pauline Adams (Analyst-in-Charge), Erika Huber, and Drew Long made key contributions to this report  Also contributing were Muriel Brown and Jennifer Whitworth 


Report 2:  Some mergers that did not qualify as inversions under the tax law also occurred  The most significant in size was the proposed Pfizer merger  On November 23, 2015, Pfizer announced a proposed merger with Allergan, an Irish company, and the move of its headquarters to Ireland  This merger, which would result in the largest pharmaceutical company in the world, is not covered under the anti-inversion rules because Pfizer will own 56% of the value of the new firm  Allergan itself is the product of a merger involving both stock and cash acquisition by Actavis in 2015, with former Allergen shareholders owning a minority of the new company  Thus, this merger as well was not an inversion under the tax law  Actavis, in turn, was a former U S  firm that inverted by merger with Warner Chillcott, an Irish firm, in 2013 (where the former shareholders of the U S  firm acquired 77% of the stock)  Pfizer terminated its merger with Allergen after the April 4, 2016, regulations (discussed below)  Other notable mergers not subject to anti-inversion rules were the acquisition of Salix, a pharmaceutical company, by Valeant (a Canadian company); the acquisition of Auxilium by Endo (after Auxilium backed out of an inversion with Canadian firm QLT); the merger of Cyberonics with Italy's Sorin (to be headquartered in the U K ); and the merger of Broadcom (a chipmaker) with Avago (a Singapore firm)  Information and analytics provider HIS announced a merger with Markit Ltd, a U K  firm, to be headquartered in the U K , but the ownership share of HIS would be less than 60% of the firm  Johnson Controls also merged with Tyco, one of the earlier inverted firms  The 2015 Treasury regulations appear to have more limited consequences for inversions than the 2014 regulations did  Three regulatory changes were made by the notice  First, in the case where the foreign parent is a tax resident of a third country, stock issued by that parent to the existing foreign firm will be disregarded for purposes of the ownership requirement  That change will prevent a U S  firm from merging with a partner and then choosing a tax friendly third country to headquarter in  The second provision would clarify the so called "anti-stuffing" rules, where the foreign firm's size is inflated by adding assets to that firm  The notice clarifies that this rule applies to any assets, not just passive assets  Third, the current business activity exception requires 25% of business activity to be in the foreign country where the new parent is created or organized, but does not require it to be a foreign parent  This rule requires the business activity to be in the foreign parent  It prevents inversion based on the business activity test when the foreign parent has a tax residence in another country without substantial business activities  On April 4, 2016, the Treasury Department issued temporary and proposed regulations formalizing rules contained in Notices 2014-52 and 2015-79 limiting corporate tax inversions, as well as adding new rules addressing inversions and earnings-stripping transactions  In response to these new regulations, the proposed merger between Pfizer and Allergen PLC has been terminated  The April 4, 2016, Treasury regulations put in place several anti-inversion rules that target groups that have engaged in a series of inversion or acquisition transactions as well as a rule that restricts postinversion asset dilution  The temporary regulations target inversion transactions involving a new foreign parent that previously acquired one or more U S  entities in inversions or acquisitions in which the new foreign parent issued stock  These prior acquisitions would generally increase the value of the foreign entity, enabling it to subsequently engage in an inversion transaction with a larger U S  company while remaining below the 60% or 80% ownership thresholds  The temporary regulations disregard stock of the new foreign parent to the extent the value of such stock is attributable to its prior U S  entity acquisitions during the prior three years  According to analysis by Americans for Tax Fairness, the implementation of this rule would have increased Pfizer's share of the merged company to roughly 70% from 56% prior to the rule  Similar to the multiple domestic entity acquisition rule, the multiple-step acquisition rule targets certain inversions that are structured as back-to-back foreign acquisitions  Specifically, it targets transactions that are part of a plan in which a foreign corporation acquires substantially all of the assets of a U S  entity and, subsequent to this first acquisition, a second foreign corporation acquires substantially all of the assets of the first foreign corporation  The temporary regulations, under certain circumstances, treat each acquisition as an acquisition of a U S  entity that may be subject to anti-inversion rules  Unlike the multiple domestic entity acquisition rule, which has a three-year look-back period, the multiple-step acquisition rule can be applied to all acquisitions that are part of the same plan regardless of time  A third rule modified existing regulations to restrict the ability of inverted companies to avoid paying tax on unrealized gains (under Section 965) through a transfer to a controlled foreign corporation (CFC) (under Section 351)  This would address situations where a CFC of an inverted U S  company engages in a postinversion exchange that could dilute a U S  shareholder's indirect interest in the exchanged asset, allowing the U S  shareholder to avoid U S  tax on any realized gain in the asset that is not recognized at the time of the transfer  The rule requires a CFC of an inverted U S  group to recognize all realized gain with respect to any such postinversion Section 351 exchange  The earnings-stripping regulations aim to restrict the ability of foreign-parent groups to shift earnings out of the United States through dividends or other economically similar transactions (under Section 385)  In these cases certain related-party debt will be characterized as equity for tax purposes  The result of equity classification is that interest deductions will be disallowed, and withholding obligations of 30% (or lower rate based on an applicable income tax treaty) could ensue  The regulations do not normally apply for related-party debt that is incurred to fund actual business investment, such as building or equipping a factory  The regulations also require documentation of debt instruments issued and held by certain members of an expanded group to establish that such instruments are properly characterized as debt  The regulations also allow the IRS on audit to treat an instrument issued to a related party as in part debt and in part equity  The final regulations issued on October 21, 2016, scaled back the original regulations in response to the comment period  The final regulations removed the general bifurcation rule that would have allowed a debt instrument to be classified as part debt and part equity and an exemption for debt for foreign issuers  The rules also provided exemptions for cash pools (a pool of cash to be accessed for short-term needs), short-term loans, regulated financial entities, and pass-throughs (firms not taxed as corporations)  The Treasury delayed documentation rules for a year on July 28, 2017  Treasury announced on July 7, 2017, that these debt-equity regulations were to be among eight rules targeted for review  The Treasury issued final regulations for the temporary regulations introduced in April 2016 on July 12, 2018, as TD 9834 with minor changes  Two days after the regulations were issued, Pfizer withdrew from its merger with Allergen, an Irish-based company that was an inverted firm  It appears that this merger was affected by the multiple-entity rule, which has come to be called "serial inversion " Mergers between Shire (Ireland based) and Basalta, and between HIS and Markit Group Inc  (U K  based) went forward  The CF Industries merger with OCI NV (based in the Netherlands) was also called off; Johnson Controls and Tyco went forward  A merger between Konecranes (a Finnish firm) and Terex was scaled down to an acquisition of a share of Terex with the U S  firm owning 25%, thus avoiding the effect of regulations  In May 2016 Cardtronics, Inc , an ATM operator, announced a plan to move to the U K  using the substantial business activities test  Also in May, an oil and gas industry service and technology firm announced a merger with Technip SA (France) to form a U K  company, with each firm holding about half the stock and thus avoiding any of the recent regulations and establishing a new headquarters in another country  In 2017, Praxaire (a U S  industrial gas company) announced a merger with Linde AG (a German gas and technology company), also with each owning half of the new company  As noted in the introduction, statistical data suggest a decline in inversions from 2015 to 2016, and again from 2016 to 2017, and these data are consistent with the limited news reports of major inversions  Pfizer's CEO has recently indicated that deals are on hold generally while tax reform is being considered  The 2017 legislation not only made fundamental changes to the overall treatment of corporate income at home and abroad, but also adopted several provisions specifically aimed at inverted corporations (those with 60% to 80% ownership)  Under the new law, existing untaxed earnings held abroad are taxed under a deemed repatriation rule, but at a lower rate (8% for earnings reinvested in noncash assets and 15 5% for earnings held as cash or cash equivalents)  A special recapture rule applies on deemed repatriations of newly inverted firms  This recapture rule applies if a firm first becomes an expatriated entity at any time during the 10-year period beginning on December 22, 2017  In this case, the tax will be increased from 8% and 15 5% to 35% tax for the entire deemed repatriation, with no foreign tax credit allowed for the increase in tax rate  The additional tax is due on the full amount of the deemed repatriation in the first tax year in which the taxpayer becomes an expatriated entity  BEAT excludes payments which reduce gross receipts with the result that payment for the cost of goods sold is not included under BEAT  An exception applies for firms that invert after November 9, 2017, where payments to a foreign parent or any foreign firm in the affiliated for cost of goods sold is included in BEAT  The constructive ownership rules for purposes of determining 10% U S  shareholders, whether a corporation is a CFC and whether parties satisfy certain relatedness tests, were expanded in the 2017 tax revision  Specifically, the new law treats stock owned by a foreign person as attributable to a U S  entity owned by the foreign person (so-called "downward attribution")  As a result, stock owned by a foreign person may generally be attributed to (1) a U S  corporation, 10% of the value of the stock of which is owned, directly or indirectly, by the foreign person; (2) a U S  partnership in which the foreign person is a partner; and (3) certain U S  trusts if the foreign person is a beneficiary or, in certain circumstances, a grantor or a substantial owner  The downward attribution rule was originally conceived to deal with inversions  In an inversion, without downward attribution, a subsidiary of the original U S  parent could lose CFC status if it sold enough stock to the new foreign parent so the U S  parent no longer had majority ownership  With downward attribution, the ownership of stock by the new foreign parent in the CFC is attributed to the U S  parent, so that the subsidiary continues its CFC status, making it subject to any tax rules that apply to CFCs (such as Subpart F and repatriation taxes under the old law, and Subpart F and GILTI under the new law)  Dividends (like capital gains) are allowed lower tax rates than the rates applied to ordinary income  The rates are 0%, 15%, and 20% depending on the rate bracket that ordinary income falls into  Certain dividends received from foreign firms (those that do not have tax treaties and PFICs ) are not eligible for these lower rates  Dividends paid by firms that inverted after the date of enactment of P L  115-97 are added to the list of those not eligible for the lower rates  In 2004, an excise tax of 15% was imposed on stock compensation received by insiders in an expatriated corporation; the new law increases it to 20%, effective on the date of enactment for corporations that first become expatriated after that date  As noted earlier, there are no aggregate data available yet for 2018, but there are also indications that most tax-motivated inversions had already been discouraged by the 2016 regulations  Considering announcements of individual companies, one planned inversion, by Assurant, Inc  was revised to retain the headquarters in the United States  Ohio-based Dana, Inc  announced plans to merge and move the headquarters to the U K , although the merger would leave the U S  shareholders with less than 60% ownership, and therefore not make them subject to anti-inversion penalties  A recent announcement indicated that the Dana merger was called off  Some firms may be considering reversing their headquarters decisions  The AJCA was successful at limiting a form of inversions, at least initially  In particular, the AJCA stopped the practice of basic "naked inversions," in which little activity or presence in the new jurisdiction is required and the new parent is domiciled in a tax haven  Further, through regulation, Treasury has limited the use of the substantial business activity test safe harbor to invert  Recent activity (as noted above), however, suggests that mergers continued to be used as a vehicle for corporate inversions after these changes  These more recent mergers have increasingly resulted in a U K  parent company (e g , FMC-Technip, HIS-Markit), due to policy decisions by the U K  government  Specifically, the U K  lowered its corporate tax rate and adopted a territorial tax system  In addition, anti-abuse provisions for foreign source income were weakened by the European Union courts  The U K  has also proposed taxing certain intangible income at a 10% rate  (This is referred to as a patent box ) To restrict the occurrence of tax-motivated inversions, both a general reform of the U S  corporate tax and specific provisions to deal with tax-motivated international mergers were discussed  Some important changes were made in 2017; other options remain  Interest in reforming the corporate income tax was long-standing, including calling for explicit accommodation of international concerns  As noted earlier, two aspects of the U S  corporate tax system are particularly relevant to corporate location decisions: the corporate tax rate and the taxation of foreign-source earnings  Taken together, these factors, under prior law, could yield a substantial reduction in taxes paid  In the case of the proposed merger of Forest Laboratories Inc  (a U S  company) and Actavis (an Irish company) in 2014, the tax reduction was estimated to be roughly $100 million per year  Prior to the 2017 changes, the U S  corporate statutory tax rate was higher than both the average statutory rates of the other Organisation for Economic Co-operation and Development (OECD) countries and that of the 15 largest economies in the world  Many asserted that the U S  statutory tax rate needed to be lowered to reduce the incentive for inversion transactions  With the rate lowered from 35% to 21%, the combined central and subnational corporate tax rates are similar to most rates in the OECD  While lowering the corporate tax rate would reduce the incentive to invert, there are reasons to suggest that it would be impractical to reduce the rate to the level needed to stop inversions  Namely, to stop inversions through a reduction in the corporate tax rate would require a U S  corporate tax rate set equal to the lowest tax rate of a destination company, or zero  A lower corporate tax rate alone reduced the incentive for corporate inversions, primarily by reducing the tax rate applied to repatriated earnings  For a company like Pfizer, with large foreign earnings, a rate reduction could yield significantly lower taxes paid  However, as discussed below, the benefit of a lowered rate is negligible relative to the benefit to corporate taxpayers afforded by territorial tax systems, when income earned in low- or no-tax foreign jurisdictions is never subject to U S  tax  Two factors present challenges for lowering the corporate tax rate further  First, if revenue neutrality is a goal, there may not be enough base-broadening provisions with revenue offsets to provide deep cuts in the corporate tax; and, if such offsets were found, they might have their own consequences for investment  Reducing the corporate tax without corresponding base broadening would likely reduce corporate tax revenue, adding to chronic budget deficits  Prior to the 2017 revision, the United States was one of the few countries that had a worldwide tax system and levied a tax on the foreign-source income of domestic corporations  Changing corporate tax residence to a country with a territorial tax system (where foreign earnings would not be taxed at all) was thought to drive inversion decisions  This issue led to proposals for the United States to adopt a territorial tax system to stop inversion transactions  One concern about adopting a territorial tax system is the strain it would likely place on the current transfer pricing system  From this perspective, the worldwide tax system provided a backstop on the amount of profit shifting or base erosion possible, because shifted profits will eventually be repatriated  Under a territorial tax system, this is not the case  Research has found evidence of significant profit shifting, especially related to mobile intellectual property, suggesting a lot of income from foreign sources is really U S  income in disguise  Numerous other issues surround the adoption of a U S  territorial tax  For example, while some supported a territorial tax to eliminate the incentive to keep earnings abroad, others opposed it because it likely discourages domestic investment and activity in the United States  The revisions in 2017 maintained a worldwide system, but with some changes  Income from U S  subsidiaries is taxed on a current basis but at a lower rate and with an exemption for a deemed return on tangible assets  It also provided a subsidy for locating intangible assets with earnings from abroad in the United States  Many of the inverting firms had significant intangible assets, and it is not clear whether this new regime (a lower tax rate but on a current basis) is more or less generous to firms considering inverting  Moving closer to a pure territorial tax, as in the case of a rate reduction, would likely reduce corporate tax revenue and add to current budget pressures unless it is offset by other tax increases, although this effect would be less costly at the lower 21% tax rate  In 2027, GILTI is projected to raise $21 billion  GILTI could be retained and the rate lowered or the temporarily lower rate could be made permanent  There has been some agreement that adopting a territorial tax without some significant anti-abuse provisions could be problematic, as it would likely increase profit shifting abroad by U S  firms  Evidence suggests that administrative remedies were successful at dramatically slowing inversions; the targeted legislative changes in the 2017 Act may have had some impact as well  There are further changes that could be made to discourage inversions  This section discusses the history of these proposals, both legislative and administrative  One approach would be to extend the rate recapture enacted in the 2017 Act for a period longer than 10 years, or to make it apply indefinitely to future inversions  A second alternative is to directly restrict the ability of U S  firms to invert by merger  The President's FY2015, FY2016, and FY2017 budget proposals contained a provision that would have further restricted the use of inversions  The proposal would modify the 80% test enacted in the AJCA to a 50% test and eliminate the 60% test  In effect, this proposal would reduce the percentage of shareholders that are owners of the "old U S  company" and the "new foreign merged company " The proposal would also require that the new foreign corporation be managed and controlled from outside the United States and prohibit transactions where the new foreign company has substantial business activities in the United States  In November 2015, then-Senate Finance Committee Chairman Hatch indicated the possibility of adding an anti-inversion provision to legislation to extend expired provisions  Many of these bills were introduced in the 115 th Congress  H R  1931 (Doggett), the Corporate EXIT Fairness Act, and H R  3434 (Levin) and S  1636 (Durbin, along with a number of cosponsors), the Stop Corporate Inversions Act, would have treated all mergers as U S  firms when the U S  firm's shareholders hold more than 50% or when management and control primarily takes place in the United States  H R  1932 (Doggett) and S  851 (Whitehouse), as with bills introduced in the 114 th Congress, would have included anti-inversion provisions as part of a broader proposal to address tax havens and deferral  H R  3603 (Levin) would have addressed earnings stripping of inverted corporations  H R  3424 (DeLauro) would disallow federal contracts for inverted firms  H R  1451 (Schakowsky) and S  586 (Sanders) would make major changes in the tax treatment of foreign source income and include anti-inversion rules  Following the change in the international system adopted at the end of 2017, Representative Doggett and Senator Whitehouse introduced the "No Tax Break for Outsourcing Act" ( H R  5108 , S  2459 ) which, in addition to other changes, would have treated foreign corporations that are managed and controlled in the United States as domestic corporations and treated inverted firms as U S  firms when the shareholders of the former U S  company own more than 50% of the shares  These bills would have also limited interest deductions in the United States to the proportionate share of the firm's assets  The last proposal (to allocate worldwide interest) was in both the House and Senate versions of the legislation ( H R  1 ; 115 th Congress) in somewhat different form but was not retained in the final legislation  While this proposal was not specifically targeted at inverted firms it would have increased the restrictions that limit earnings stripping  Former President Obama had encouraged Congress to act directly to limit inversions, but had also indicated on August 6, 2014, that administrative changes to limit inversions were under examination  Prior to that announcement, Steve Shay, a Harvard professor and former practitioner and Treasury official, outlined two regulatory actions that he believed could be taken  The first would limit earnings stripping by reclassifying debt as equity due to excessive related party debt in an inversion  (The second provision is no longer relevant under the new international tax regime ) A number of other administrative proposals that have been suggested (such as provisions relating to taxing accumulated deferred earnings) are no longer relevant and others have been adopted in the regulatory changes discussed above  Expanding the scope of Section 7874 (which treats inverted firms as U S  firms) by combining multiple transactions into single ones, or vice versa  The scope of Section 7874 could also be expanded by treating certain stock as disqualified (because it is expected to be held temporarily or because it is accompanied by restrictions on voting rights); this provision was adopted in Treasury regulations; Potentially recognizing accumulated deferred earnings as currently taxable under authority such as Subpart F, Section 367, or other rules (this provision is no longer relevant with the end of deferral, but it may have influenced the decision to tax deferred earnings of newly inverted firms at the full 35% rate for the next 10 years); Issuing regulations that would generally tighten restrictions on interest deductions under the thin capitalization rules of Section 163(j)  These changes would probably apply to corporations in general, and not just to inverted corporations (this change was made in the 2017 tax revision); Stricter regulations under Section 367 to immediately include foreign earnings in the case of actions that attempt to move foreign operations out from under the U S  parent  This would make future earnings of these operations nontaxable; Strengthening and modernizing the effectively connected income rules that determined whether trade or business activity is taking place in the United States by foreign firms; and Closely monitoring the creation of non-U S  subsidiaries owned by the foreign parent after inversion, and ensuring that assets (including intangibles such as inventions, knowhow, etc ) transferred from the U S  firm are transferred at arms-length prices  There is disagreement among experts about whether the types of regulatory changes discussed in this section are feasible or desirable  A number of legislative proposals were advanced in 2014, when the wave of inversions through merger began  Representative Levin, the ranking member of the House Ways and Means Committee, introduced the Stop Corporate Inversions Act of 2014 ( H R  4679 ), which would have reflected the Administration's proposed changes, retroactive to May 8, 2014  The inversion would have not been recognized if the U S  stockholders had 50% of the shares or if 25% of the business activity is in the United States  A companion bill, which would have sunset in two years to provide time for tax reform, was introduced in the Senate by Senator Levin in 2014 ( S  2360 )  The Joint Committee on Taxation estimated the permanent proposal to gain $19 5 billion in revenue over FY2015-FY2024  The two-year proposal would have raise $0 8 billion over the same period  In the 114 th Congress, these legislative proposals were introduced as H R  415 (Levin) and S  198 (Durbin)  Senator Casey proposed an anti-inversion amendment to an education bill ( S  1177 )  In the 114 th Congress, H R  297 (Doggett) and S  174 (Whitehouse) included anti-inversion provisions as part of a broader proposal to address tax haven abuses and restrict the benefits of deferral  S  922 (Sanders) and H R  1790 (Schakowsky) also included anti-inversion provisions, as well as earnings-stripping provisions (discussed below) and broader provisions, including the repeal of deferral  In 2014 a number of legislative proposals were introduced that would limit the tax benefits associated with inversions for certain corporations  For example, H R  1554 (Doggett), H R  3666 (DeLauro), H R  3793 (Maffei), S  268 (Levin), S  1533 (Levin), and S  1844 (Shaheen) would each treat corporations managed and controlled from the United States as domestic corporations regardless of their legal tax home or status as an inverted company  This provision was also included in S  922 (Sanders) and H R  1790 (Schakowsky)  Other proposals in 2014, H R  694 (Schakowsky) and S  250 (Sanders), would have eliminated deferral (taxing foreign source income currently), in addition to limiting the benefits of inversions when management and control continues to reside in the United States  Legislative proposals were also under discussion in 2014 by Representative Levin (announced July 31, 2014) and by Senator Schumer (announced August 14, 2014) to address earnings stripping, where foreign parent companies borrow from the U S  subsidiary to increase interest deductions and reduce taxable income in the United States  Both of these proposals would have tightened the rules allowing interest deductions by reducing the current limit on interest deductions relative to adjusted income from 50% to 25% and repealing an alternative safe-harbor debt-to-equity test  Both proposals would have also eliminated or limited interest carryforwards  The Schumer proposal was intended to apparently apply to inverted firms while the Levin proposal would have applied generally  The Levin proposal would have also limited other transactions between related parties within the firm that allow untaxed investment of funds in the United States  The restrictions on interest in the Levin bill were the same as those initially proposed in the House in 2004  Senator Schumer introduced his proposal, S  2786 , the Corporate Inverters Earnings Stripping Reform Act of 2014  Its limits on interest deductions would have applied to inverted firms where U S  shareholders own more than 50% of the firm  The restriction also would have applied to firms that inverted using the substantial business activities test  The bill had nine Democratic cosponsors; five of them were on the Senate Finance Committee  In the 114 th Congress, S  922 (Sanders) and H R  1790 (Schakowsky) included general earnings-stripping provisions for firms with a foreign parent  Earnings stripping provisions were also addressed in the report of the Senate Finance Committee's working group on Tax Reform  H R  5278 (DeLauro) and S  2704 (Levin), introduced May 30, 2014, would have disallowed awarding federal contracts to inverted firms  These proposals were introduced in the 114 th Congress as H R  1809 (DeLauro) and S  975 (Durbin)  In 2014, Senators Brown and Durbin proposed S  2895 , and Representative Doggett introduced H R  5549 , the Pay What You Owe Before You Go Act, that would have taxed the accumulated deferred earnings of inverting firms  Then Senate Finance Committee Chairman Ron Wyden had proposed having draft legislation in place in September 2014, and also referred to Schumer's earnings-stripping proposal  Senator Wyden had previously announced that any changes would be retroactive to May 8, 2014 

ground_truth: The improper payment rate is a sentinel measure of program integrity risks for the Medicaid program. CMS and the states oversee Medicaid, whose size, structure, and diversity make it vulnerable to improper payments. CMS estimates the Medicaid improper payment rate annually through its PERM, which includes an estimate for Medicaid managed care, in which states contract with MCOs to provide services to Medicaid enrollees. GAO was asked to study the PERM methodology for managed care. In this report, GAO examined the extent to which the PERM accounts for program integrity risks in Medicaid managed care, including CMS's and states' oversight. GAO identified program integrity risks reported in 27 federal and state audits and investigations issued between January 2012 and September 2017; reviewed federal regulations and guidance on the PERM and CMS's Focused Program Integrity Reviews; and contacted program integrity officials in the 16 states with a majority of 2016 Medicaid spending for managed care, as well as CMS officials and program integrity experts. The Centers for Medicare & Medicaid Services' (CMS) estimate of improper payments for Medicaid managed care has limitations that are not mitigated by the agency's and states' current oversight efforts. One component of the Payment Error Rate Measurement (PERM) measures the accuracy of capitated payments, which are periodic payments that state Medicaid agencies make to managed care organizations (MCO) to provide services to enrollees and to cover other allowable costs, such as administrative expenses. However, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data. Further, GAO's review of the 27 federal and state audits and investigations identified key program risks. Ten of the 27 federal and state audits and investigations identified about $68 million in overpayments and unallowable MCO costs that were not accounted for by PERM estimates; another of these investigations resulted in a $137.5 million settlement. These audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017. To the extent that overpayments and unallowable costs are unidentified and not removed from the cost data used to set capitation rates, they may allow inflated MCO payments and minimize the appearance of program risks in Medicaid managed care. CMS and states have taken steps to improve oversight of Medicaid managed care through updated regulations, focused reviews of states' managed care programs, and federal program integrity contractors' audits of managed care services. However, some of these efforts went into effect only recently, and others are unlikely to address the risks in managed care across all states. Furthermore, these efforts do not ensure the identification and reporting of overpayments to providers and unallowable costs by MCOs. Federal internal control standards call for agency management to identify and respond to risks. Without addressing key risks, such as the extent of overpayments and unallowable costs, CMS cannot be certain that its estimated improper payment rate for managed care (0.3 percent compared with 12.9 percent in Medicaid fee-for-service) accurately reflects program risks. The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. HHS concurred with this recommendation. HHS also provided technical comments, which were incorporated as appropriate.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2: IT systems supporting federal agencies and our nation’s critical infrastructures are inherently at risk  These systems are highly complex and dynamic, technologically diverse, and often geographically dispersed  This complexity increases the difficulty in identifying, managing, and protecting the numerous operating systems, applications, and devices comprising the systems and networks  Compounding the risk, federal systems and networks are also often interconnected with other internal and external systems and networks, including the Internet  This increases the number of avenues of attack and expands their attack surface  As systems become more integrated, cyber threats will pose an increasing risk to national security, economic well-being, and public health and safety  Advancements in technology, such as data analytics software for searching and collecting information, have also made it easier for individuals and organizations to correlate data (including PII) and track it across large and numerous databases  For example, social media has been used as a mass communication tool where PII can be gathered in vast amounts  In addition, ubiquitous Internet and cellular connectivity makes it easier to track individuals by allowing easy access to information pinpointing their locations  These advances—combined with the increasing sophistication of hackers and others with malicious intent, and the extent to which both federal agencies and private companies collect sensitive information about individuals—have increased the risk of PII being exposed and compromised  Cybersecurity incidents continue to impact entities across various critical infrastructure sectors  For example, in its 2018 annual data breach investigations report, Verizon reported that 53,308 security incidents and 2,216 data breaches were identified across 65 countries in the 12 months since its prior report  Further, the report noted that cybercriminals can often compromise a system in just a matter of minutes—or even seconds, but that it can take an organization significantly longer to discover the breach  Specifically, the report stated nearly 90 percent of the reported breaches occurred within minutes, while nearly 70 percent went undiscovered for months  These concerns are further highlighted by the number of information security incidents reported by federal executive branch civilian agencies to DHS’s U S  Computer Emergency Readiness Team (US-CERT)  For fiscal year 2017, 35,277 such incidents were reported by the Office of Management and Budget (OMB) in its 2018 annual report to Congress, as mandated by the Federal Information Security Modernization Act (FISMA)  These incidents include, for example, web-based attacks, phishing, and the loss or theft of computing equipment  Different types of incidents merit different response strategies  However, if an agency cannot identify the threat vector (or avenue of attack), it could be difficult for that agency to define more specific handling procedures to respond to the incident and take actions to minimize similar future attacks  In this regard, incidents with a threat vector categorized as “other” (which includes avenues of attacks that are unidentified) made up 31 percent of the various incidents reported to US-CERT  Figure 1 shows the percentage of the different types of incidents reported across each of the nine threat vector categories for fiscal year 2017, as reported by OMB  These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security  The following examples highlight the impact of such incidents: In March 2018, the Mayor of Atlanta, Georgia, reported that the city was victimized by a ransomware cyberattack  As a result, city government officials stated that customers were not able to access multiple applications that are used to pay bills or access court related information  In response to the attack, the officials noted that they were working with numerous private and governmental partners, including DHS, to assess what occurred and determine how best to protect the city from future attacks  In March 2018, the Department of Justice reported that it had indicted nine Iranians for conducting a massive cybersecurity theft campaign on behalf of the Islamic Revolutionary Guard Corps  According to the department, the nine Iranians allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 U S  companies, and five federal government agencies, among other entities  In March 2018, a joint alert from DHS and the Federal Bureau of Investigation (FBI) stated that, since at least March 2016, Russian government actors had targeted the systems of multiple U S  government entities and critical infrastructure sectors  Specifically, the alert stated that Russian government actors had affected multiple organizations in the energy, nuclear, water, aviation, construction, and critical manufacturing sectors  In July 2017, a breach at Equifax resulted in the loss of PII for an estimated 148 million U S  consumers  According to Equifax, the hackers accessed people’s names, Social Security numbers (SSN), birth dates, addresses and, in some instances, driver’s license numbers  In April 2017, the Commissioner of the Internal Revenue Service (IRS) testified that the IRS had disabled its data retrieval tool in early March 2017 after becoming concerned about the misuse of taxpayer data  Specifically, the agency suspected that PII obtained outside the agency’s tax system was used to access the agency’s online federal student aid application in an attempt to secure tax information through the data retrieval tool  In April 2017, the agency began notifying taxpayers who could have been affected by the breach  In June 2015, OPM reported that an intrusion into its systems had affected the personnel records of about 4 2 million current and former federal employees  Then, in July 2015, the agency reported that a separate, but related, incident had compromised its systems and the files related to background investigations for 21 5 million individuals  In total, OPM estimated 22 1 million individuals had some form of PII stolen, with 3 6 million being a victim of both breaches  Safeguarding federal IT systems and the systems that support critical infrastructures has been a long-standing concern of GAO  Due to increasing cyber-based threats and the persistent nature of information security vulnerabilities, we have designated information security as a government-wide high-risk area since 1997  In 2003, we expanded the information security high-risk area to include the protection of critical cyber infrastructure  At that time, we highlighted the need to manage critical infrastructure protection activities that enhance the security of the cyber and physical public and private infrastructures that are essential to national security, national economic security, and/or national public health and safety  We further expanded the information security high-risk area in 2015 to include protecting the privacy of PII  Since then, advances in technology have enhanced the ability of government and private sector entities to collect and process extensive amounts of PII, which has posed challenges to ensuring the privacy of such information  In addition, high- profile PII breaches at commercial entities, such as Equifax, heightened concerns that personal privacy is not being adequately protected  Our experience has shown that the key elements needed to make progress toward being removed from the High-Risk List are top-level attention by the administration and agency leaders grounded in the five criteria for removal, as well as any needed congressional action  The five criteria for removal that we identified in November 2000 are as follows: Leadership Commitment  Demonstrated strong commitment and top leadership support  Capacity  The agency has the capacity (i e , people and resources) to resolve the risk(s)  Action Plan  A corrective action plan exists that defines the root cause, solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended  Monitoring  A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures  Demonstrated Progress  Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area  These five criteria form a road map for efforts to improve and ultimately address high-risk issues  Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list  Figure 2 shows the five criteria and illustrative actions taken by agencies to address the criteria  Importantly, the actions listed are not “stand alone” efforts taken in isolation from other actions to address high- risk issues  That is, actions taken under one criterion may be important to meeting other criteria as well  For example, top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress—actions which are also vital to monitoring criteria  As we reported in the February 2017 high-risk report, the federal government’s efforts to address information security deficiencies had fully met one of the five criteria for removal from the High-Risk List— leadership commitment—and partially met the other four, as shown in figure 3  We plan to update our assessment of this high-risk area against the five criteria in February 2019  Based on our prior work, we have identified four major cybersecurity challenges: (1) establishing a comprehensive cybersecurity strategy and performing effective oversight, (2) securing federal systems and information, (3) protecting cyber critical infrastructure, and (4) protecting privacy and sensitive data  To address these challenges, we have identified 10 critical actions that the federal government and other entities need to take (see figure 4)  The four challenges and the 10 actions needed to address them are summarized following the table  In addition, we also discuss in more detail each of the 10 actions in appendices II through XI  The federal government has been challenged in establishing a comprehensive cybersecurity strategy and in performing effective oversight as called for by federal law and policy  Specifically, we have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  We have also reported on challenges in performing oversight, including monitoring the global supply chain, ensuring a highly skilled cyber workforce, and addressing risks associated with emerging technologies  The federal government can take four key actions to improve the nation’s strategic approach to, and oversight of, cybersecurity  Develop and execute a more comprehensive federal strategy for national cybersecurity and global cyberspace  In February 2013 we reported that the government had issued a variety of strategy- related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  In October 2015, in response to our recommendation to develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy, the Director of OMB and the Federal Chief Information Officer issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  For example, a May 2017 presidential executive order required federal agencies to take a variety of actions, including better manage their cybersecurity risks and coordinate to meet reporting requirements related to cybersecurity of federal networks, critical infrastructure, and the nation  Additionally, the December 2017 National Security Strategy cites cybersecurity as a national priority and identifies related needed actions, such as including identifying and prioritizing risk, and building defensible government networks  Further, DHS issued a cybersecurity strategy in May 2018, which articulated seven goals the department plans to accomplish in support of its mission related to managing national cybersecurity risks  The strategy is intended to provide DHS with a framework to execute its cybersecurity responsibilities during the next 5 years to keep pace with the evolving cyber risk landscape by reducing vulnerabilities and building resilience; countering malicious actors in cyberspace; responding to incidents; and making the cyber ecosystem more secure and resilient  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we have previously recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically, the documents generally did not include milestones and performance measures to gauge results, nor did they describe the resources needed to carry out the goals and objective  Further, most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, the Department of Defense (DOD), and OMB, who contribute substantially to the nation’s cybersecurity programs  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  For more information on this action area, see appendix II  Mitigate global supply chain risks  The global, geographically disperse nature of the producers and suppliers of IT products is a growing concern  We have previously reported on potential issues associated with IT supply chain and risks originating from foreign- manufactured equipment  For example, in July 2017, we reported that the Department of State had relied on certain device manufacturers, software developers, and contractor support which had suppliers that were reported to be headquartered in a cyber-threat nation (e g , China and Russia)  We further pointed out that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  In July 2018, we testified that if such global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  These factors highlight the importance and urgency of federal agencies appropriately assessing, managing, and monitoring IT supply chain risk as part of their agency-wide information security programs  For more information on this action area, see appendix III  Address cybersecurity workforce management challenges  The federal government faces challenges in ensuring that the nation’s cybersecurity workforce has the appropriate skills  For example, in June 2018, we reported on federal efforts to implement the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015  We determined that most of the Chief Financial Officers (CFO) Act agencies had not fully implemented all statutory requirements, such as developing procedures for assigning codes to cybersecurity positions  Further, we have previously reported that DHS and DOD had not addressed cybersecurity workforce management requirements set forth in federal laws  In addition, we have reported in the last 2 years that federal agencies (1) had not identified and closed cybersecurity skills gaps, (2) had been challenged with recruiting and retaining qualified staff, and (3) had difficulty navigating the federal hiring process  A recent executive branch report also discussed challenges associated with the cybersecurity workforce  Specifically, in response to Executive Order 13800, the Department of Commerce and DHS led an interagency working group exploring how to support the growth and sustainment of future cybersecurity employees in the public and private sectors  In May 2018, the departments issued a report that identified key findings, including: the U S  cybersecurity workforce needs immediate and sustained improvements; the pool of cybersecurity candidates needs to be expanded through retraining and by increasing the participation of women, minorities, and veterans; a shortage exists of cybersecurity teachers at the primary and secondary levels, faculty in higher education, and training instructors; and comprehensive and reliable data about cybersecurity workforce position needs and education and training programs are lacking  The report also included recommendations and proposed actions to address the findings, including that private and public sectors should (1) align education and training with employers’ cybersecurity workforce needs by applying the National Initiative for Cybersecurity Education Cybersecurity Workforce Framework; (2) develop cybersecurity career model paths; and (3) establish a clearinghouse of information on cybersecurity workforce development education, training, and workforce development programs and initiatives  In addition, in June 2018, the executive branch issued a government reform plan and reorganization recommendations that included, among other things, proposals for solving the federal cybersecurity workforce shortage  In particular, the plan notes that the administration intends to prioritize and accelerate ongoing efforts to reform the way that the federal government recruits, evaluates, selects, pays, and places cyber talent across the enterprise  The plan further states that, by the end of the first quarter of fiscal year 2019, all CFO Act agencies, in coordination with DHS and OMB, are to develop a critical list of vacancies across their organizations  Subsequently, OMB and DHS are to analyze these lists and work with OPM to develop a government-wide approach to identifying or recruiting new employees or reskilling existing employees  Regarding cybersecurity training, the plan notes that OMB is to consult with DHS to standardize training for cybersecurity employees, and should work to develop an enterprise-wide training process for government cybersecurity employees  For more information on this action area, see appendix IV  Ensure the security of emerging technologies  As the devices used in daily life become increasingly integrated with technology, the risk to sensitive data and PII also grows  Over the last several years, we have reported on weaknesses in addressing vulnerabilities associated with emerging technologies, including: IoT devices, such as fitness trackers, cameras, and thermostats, that continuously collect and process information are potentially vulnerable to cyber-attacks; IoT devices, such as those acquired and used by DOD employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department; vehicles that are potentially susceptible to cyber-attack through technology, such as Bluetooth; the unknown impact of artificial intelligence cybersecurity; and advances in cryptocurrencies and blockchain technologies  Executive branch agencies have also highlighted the challenges associated with ensuring the security of emerging technologies  Specifically, in a May 2018 report issued in response to Executive Order 13800, the Department of Commerce and DHS issued a report on the opportunities and challenges in reducing the botnet threat  The opportunities and challenges are centered on six principal themes, including the global nature of automated, distributed attacks; effective tools; and awareness and education  The report also provides recommended actions, including that federal agencies should increase their understanding of what software components have been incorporated into acquired products and establish a public campaign to support awareness of IoT security  For more information on this action area, see appendix V  In our previously discussed reports related to this cybersecurity challenge, we made a total of 50 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 48 recommendations had not been implemented  These outstanding recommendations include 8 priority recommendations, meaning that we believe that they warrant priority attention from heads of key departments and agencies  These priority recommendations include addressing weaknesses associated with, among other things, agency-specific cybersecurity workforce challenges and agency responsibilities for supporting mitigation of vehicle network attacks  Until our recommendations are fully implemented, federal agencies may be limited in their ability to provide effective oversight of critical government-wide initiatives, address challenges with cybersecurity workforce management, and better ensure the security of emerging technologies  In addition to our prior work related to the federal government’s efforts to establish key strategy documents and implement effective oversight, we also have several ongoing reviews related to this challenge  These include reviews of: the CFO Act agencies’ efforts to submit complete and reliable baseline assessment reports of their cybersecurity workforces; the extent to which DOD has established training standards for cyber mission force personnel, and efforts the department has made to achieve its goal of a trained cyber mission force; and selected agencies’ ability to implement cloud service technologies and notable benefits this might have on agencies  The federal government has been challenged in securing federal systems and information  Specifically, we have reported that federal agencies have experienced challenges in implementing government-wide cybersecurity initiatives, addressing weaknesses in their information systems and responding to cyber incidents on their systems  This is particularly concerning given that the emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security  As such, it is important that federal agencies take appropriate steps to better ensure they have effectively implemented programs to protect their information and systems  We have identified three actions that the agencies can take  Improve implementation of government-wide cybersecurity initiatives  Specifically, in January 2016, we reported that DHS had not ensured that the National Cybersecurity Protection System (NCPS) had fully satisfied all intended system objectives related to intrusion detection and prevention, information sharing, and analytics  In addition, in February 2017, we reported that the DHS National Cybersecurity and Communications Integration Center’s (NCCIC) functions were not being performed in adherence with the principles set forth in federal laws  We noted that, although NCCIC was sharing information about cyber threats in the way it should, the center did not have metrics to measure that the information was timely, relevant and actionable, as prescribed by law  For more information on this action area, see appendix VI  Address weaknesses in federal information security programs  We have previously identified a number of weaknesses in agencies’ protection of their information and information systems  For example, over the past 2 years, we have reported that: most of the 24 agencies covered by the CFO Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management); three agencies—the Securities Exchange Commission, the Federal Deposit Insurance Corporation, and the Food and Drug Administration—had not effectively implemented aspects of their information security programs, which resulted in weaknesses in these agencies’ security controls; information security weaknesses in selected high-impact systems at four agencies—the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veterans Affairs—were cited as a key reason that the agencies had not effectively implemented elements of their information security programs; DOD’s process for monitoring the implementation of cybersecurity guidance had weaknesses and resulted in the closure of certain tasks (such as completing cyber risk assessments) before they were fully implemented; and agencies had not fully defined the role of their Chief Information Security Officers, as required by FISMA  We also recently testified that, although the government had acted to protect federal information systems, additional work was needed to improve agency security programs and cyber capabilities  In particular, we noted that further efforts were needed by agencies to implement our prior recommendations in order to strengthen their information security programs and technical controls over their computer networks and systems  For more information on this action area, see appendix VII  Enhance the federal response to cyber incidents  We have reported that certain agencies have had weaknesses in responding to cyber incidents  For example, as of August 2017, OPM had not fully implemented controls to address deficiencies identified as a result of its 2015 cyber incidents; DOD had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises; as of April 2016, DOD had not identified, clarified, or implemented all components of its support of civil authorities during cyber incidents; and as of January 2016, DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  For more information on this action area, see appendix VIII  In the public versions of the reports previously discussed for this challenge area, we made a total of 101 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 61 recommendations had not been implemented  These outstanding recommendations include 14 priority recommendations to address weaknesses associated with, among other things, the information security programs at the National Aeronautics and Space Administration, OPM, and the Security Exchange Commission  Until these recommendations are implemented, these federal agencies will be limited in their ability to ensure the effectiveness of their programs for protecting information and systems  In addition to our prior work, we also have several ongoing reviews related to the federal government’s efforts to protect its information and systems  These include reviews of: Federal Risk and Authorization Management Program (FedRAMP) implementation, including an assessment of the implementation of the program’s authorization process for protecting federal data in cloud environments; the Equifax data breach, including an assessment of federal oversight of credit reporting agencies’ collection, use, and protection of consumer PII; the Federal Communication Commission’s Electronic Comment Filing System security, to include a review of the agency’s detection of and response to a May 2017 incident that reportedly impacted the system; DOD’s efforts to improve the cybersecurity of its major weapon DOD’s whistleblower program, including an assessment of the policies, procedures, and controls related to the access and storage of sensitive and classified information needed for the program; IRS’s efforts to (1) implement security controls and the agency’s information security program, (2) authenticate taxpayers, and (3) secure tax information; and the federal approach and strategy to securing agency information systems, to include federal intrusion detection and prevention capabilities and the intrusion assessment plan  The federal government has been challenged in working with the private sector to protect critical infrastructure  This infrastructure includes both public and private systems vital to national security and other efforts, such as providing the essential services that underpin American society  As the cybersecurity threat to these systems continues to grow, federal agencies have millions of sensitive records that must be protected  Specifically, this critical infrastructure threat could have national security implications and more efforts should be made to ensure that it is not breached  To help address this issue, the National Institute of Standards and Technology (NIST) developed the cybersecurity framework—a voluntary set of cybersecurity standards and procedures for industry to adopt as a means of taking a risk-based approach to managing cybersecurity  However, additional action is needed to strengthen the federal role in protecting the critical infrastructure  Specifically, we have reported on other critical infrastructure protection issues that need to be addressed  For example: DHS did not track vulnerability reduction from the implementation and verification of planned security measures at the high-risk chemical facilities that engage with the department, as a basis for assessing performance  Entities within the 16 critical infrastructure sectors reported encountering four challenges to adopting the cybersecurity framework, such as being limited in their ability to commit necessary resources towards framework adoption and not having the necessary knowledge and skills to effectively implement the framework  DOD and the Federal Aviation Administration identified a variety of operations and physical security risks that could adversely affect DOD missions  Major challenges existed to securing the electricity grid against cyber threats  These challenges included monitoring implementation of cybersecurity standards, ensuring security features are built into smart grid systems, and establishing metrics for cybersecurity  DHS and other agencies needed to enhance cybersecurity in the maritime environment  Specifically, DHS did not include cyber risks in its risk assessments that were already in place nor did it address cyber risks in guidance for port security plans  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  For more information on this action area, see appendix IX  We made a total of 21 recommendations to federal agencies to address these weaknesses and others  These recommendations include, for example, a total of 9 recommendations to 9 sector-specific agencies to develop methods to determine the level and type of cybersecurity framework adoption across their respective sectors  As of August 2018, all 21 recommendations had not been implemented  Until these recommendations are implemented, the federal government will continue to be challenged in fulfilling its role in protecting the nation’s critical infrastructure  In addition to our prior work related to the federal government’s efforts to protect critical infrastructure, we also have several ongoing reviews focusing on: the physical and cybersecurity risks to pipelines across the country responsible for transmitting oil, natural gas, and other hazardous liquids; the cybersecurity risks to the electric grid; and the privatization of utilities at DOD installations  The federal government has been challenged in protecting privacy and sensitive data  Advances in technology, including powerful search technology and data analytics software, have made it easy to correlate information about individuals across large and numerous databases, which have become very inexpensive to maintain  In addition, ubiquitous Internet connectivity has facilitated sophisticated tracking of individuals and their activities through mobile devices such as smartphones and fitness trackers  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of PII maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  Federal agencies should take two types of actions to address this challenge area  In addition, we have previously proposed two matters for congressional consideration aimed toward better protecting PII  Improve federal efforts to protect privacy and sensitive data  We have issued several reports noting that agencies had deficiencies in protecting privacy and sensitive data that needed to be addressed  For example: The Department of Health and Human Services’ (HHS) Centers for Medicare and Medicaid Services (CMS) and external entities were at risk of compromising Medicare Beneficiary Data due to a lack of guidance and proper oversight  The Department of Education’s Office of Federal Student Aid had not properly overseen its school partners’ records or information security programs  HHS had not fully addressed key security elements in its guidance for protecting the security and privacy of electronic health information  CMS had not fully protected the privacy of users’ data on state- based marketplaces  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives aimed at eliminating the unnecessary collection, use, and display of SSNs  For more information on this action area, see appendix X  Appropriately limit the collection and use of personal information and ensure that it is obtained with appropriate knowledge or consent  We have issued a series of reports that highlight a number of the key concerns in this area  For example: The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent; Federal laws for smartphone tracking applications have not generally been well enforced; The FBI has not fully ensured privacy and accuracy related to the use of face recognition technology  For more information on this action area, see appendix XI  We have previously suggested that Congress consider amending laws, such as the Privacy Act of 1974 and the E-Government Act of 2002, because they may not consistently protect PII  Specifically, we found that while these laws and guidance set minimum requirements for agencies, they may not consistently protect PII in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles  However, revisions to the Privacy Act and the E-Government Act have not yet been enacted  Further, we also suggested that Congress consider strengthening the consumer privacy framework and review issues such as the adequacy of consumers’ ability to access, correct, and control their personal information; and privacy controls related to new technologies such as web tracking and mobile devices  However, these suggested changes have not yet been enacted  We also made a total of 29 recommendations to federal agencies to address the weaknesses identified  As of August 2018, 28 recommendations had not been implemented  These outstanding recommendations include 6 priority recommendations to address weaknesses associated with, among other things, publishing privacy impact assessments and improving the accuracy of the FBI’s face recognition services  Until these recommendations are implemented, federal agencies will be challenged in their ability to protect privacy and sensitive data and ensure that its collection and use is appropriately limited  In addition to our prior work, we have several ongoing reviews related to protecting privacy and sensitive data  These include reviews of: IRS’s taxpayer authentication efforts, including what steps the agency is taking to monitor and improve its authentication methods; the extent to which the Department of Education’s Office of Federal Student Aid’s policies and procedures for overseeing non-school partners’ protection of federal student aid data align with federal requirements and guidance; data security issues related to credit reporting agencies, including a review of the causes and impacts of the August 2017 Equifax data breach; the extent to which Equifax assessed, responded to, and recovered from its August 2017 data breach; federal agencies’ efforts to remove PII from shared cyber threat indicators; and how the federal government has overseen Internet privacy, including the roles of the Federal Communications Commission and the Federal Trade Commission, and strengths and weaknesses of the current oversight authorities  In conclusion, since 2010, we have made over 3,000 recommendations to agencies aimed at addressing the four cybersecurity challenges  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  Of the roughly 3,000 recommendations made since 2010, nearly 1,000 had not been implemented as of August 2018  We have also designated 35 as priority recommendations, and as of August 2018, 31 had not been implemented  The federal government and the nation’s critical infrastructure are dependent on IT systems and electronic data, which make them highly vulnerable to a wide and evolving array of cyber-based threats  Securing these systems and data is vital to the nation’s security, prosperity, and well-being  Nevertheless, the security over these systems and data is inconsistent and urgent actions are needed to address ongoing cybersecurity and privacy challenges  Specifically, the federal government needs to implement a more comprehensive cybersecurity strategy and improve its oversight, including maintaining a qualified cybersecurity workforce; address security weaknesses in federal systems and information and enhance cyber incident response efforts; bolster the protection of cyber critical infrastructure; and prioritize efforts to protect individual’s privacy and PII  Until our recommendations are addressed and actions are taken to address the four challenges we identified, the federal government, the national critical infrastructure, and the personal information of U S  citizens will be increasingly susceptible to the multitude of cyber-related threats that exist  We are sending copies of this report to the appropriate congressional committees  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Nick Marinos at (202) 512-9342 or marinosn@gao gov or Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix XII  Critical Infrastructure Protection: DHS Should Take Actions to Measure Reduction in Chemical Facility Vulnerability and Share Information with First Responders  GAO-18-538  Washington, D C : August 8, 2018  High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation  GAO-18-645T  Washington, D C : July 25, 2018  Information Security: Supply Chain Risks Affecting Federal Agencies  GAO-18-667T  Washington, D C : July 12, 2018  Information Technology: Continued Implementation of High-Risk Recommendations Is Needed to Better Manage Acquisitions, Operations, and Cybersecurity  GAO-18-566T  Washington, D C : May 23, 2018  Cybersecurity: DHS Needs to Enhance Efforts to Improve and Promote the Security of Federal and Private-Sector Networks, GAO-18-520T  Washington, D C : April 24, 2018  Electronic Health Information: CMS Oversight of Medicare Beneficiary Data Security Needs Improvement  GAO-18-210  Washington, D C : March 6, 2018  Technology Assessment: Artificial Intelligence, Emerging Opportunities, Challenges, and Implications  GAO-18-142SP  Washington, D C : March 28, 2018  GAO Strategic Plan 2018-2023: Trends Affecting Government and Society  GAO-18-396SP  Washington, D C : February 22, 2018  Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption  GAO-18-211  Washington, D C : February 15, 2018  Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements  GAO-18-175  Washington, D C : February 6, 2018  Homeland Defense: Urgent Need for DOD and FAA to Address Risks and Improve Planning for Technology That Tracks Military Aircraft  GAO-18-177  Washington, D C : January 18, 2018  Federal Student Aid: Better Program Management and Oversight of Postsecondary Schools Needed to Protect Student Information  GAO-18-121  Washington, D C : December 15, 2017  Defense Civil Support: DOD Needs to Address Cyber Incident Training Requirements  GAO-18-47  Washington, D C : November 30, 2017  Federal Information Security: Weaknesses Continue to Indicate Need for Effective Implementation of Policies and Practices  GAO-17-549  Washington, D C : September 28, 2017  Information Security: OPM Has Improved Controls, but Further Efforts Are Needed  GAO-17-614  Washington, D C : August 3, 2017  Defense Cybersecurity: DOD’s Monitoring of Progress in Implementing Cyber Strategies Can Be Strengthened  GAO-17-512  Washington, D C : August 1, 2017  State Department Telecommunications: Information on Vendors and Cyber-Threat Nations  GAO-17-688R  Washington, D C : July 27, 2017  Internet of Things: Enhanced Assessments and Guidance Are Needed to Address Security Risks in DOD  GAO-17-668  Washington, D C : July 27, 2017  Information Security: SEC Improved Control of Financial Systems but Needs to Take Additional Actions  GAO-17-469  Washington, D C : July 27, 2017  Information Security: Control Deficiencies Continue to Limit IRS’s Effectiveness in Protecting Sensitive Financial and Taxpayer Data  GAO-17-395  Washington, D C : July 26, 2017  Social Security Numbers: OMB Actions Needed to Strengthen Federal Efforts to Limit Identity Theft Risks by Reducing Collection, Use, and Display  GAO-17-553  Washington, D C : July 25, 2017  Information Security: FDIC Needs to Improve Controls over Financial Systems and Information  GAO-17-436  Washington, D C : May 31, 2017  Technology Assessment: Internet of Things: Status and implications of an increasingly connected world  GAO-17-75  Washington, D C : May 15, 2017  Cybersecurity: DHS’s National Integration Center Generally Performs Required Functions but Needs to Evaluate Its Activities More Completely  GAO-17-163  Washington, D C : February 1, 2017  High-Risk Series: An Update  GAO-17-317  Washington, D C : February 2017  IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; Selected Departments Need to Assess Skill Gaps  GAO-17-8  Washington, D C : November 30, 2016  Electronic Health Information: HHS Needs to Strengthen Security and Privacy Guidance and Oversight  GAO-16-771  Washington, D C : September 26, 2016  Defense Civil Support: DOD Needs to Identify National Guard’s Cyber Capabilities and Address Challenges in Its Exercises  GAO-16-574  Washington, D C : September 6, 2016  Information Security: FDA Needs to Rectify Control Weaknesses That Place Industry and Public Health Data at Risk  GAO-16-513  Washington, D C : August 30, 2016  Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority  GAO-16-686  Washington, D C : August 26, 2016  Federal Hiring: OPM Needs to Improve Management and Oversight of Hiring Authorities  GAO-16-521  Washington, D C : August 2, 2016  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 
Report 2:  Some mergers that did not qualify as inversions under the tax law also occurred  The most significant in size was the proposed Pfizer merger  On November 23, 2015, Pfizer announced a proposed merger with Allergan, an Irish company, and the move of its headquarters to Ireland  This merger, which would result in the largest pharmaceutical company in the world, is not covered under the anti-inversion rules because Pfizer will own 56% of the value of the new firm  Allergan itself is the product of a merger involving both stock and cash acquisition by Actavis in 2015, with former Allergen shareholders owning a minority of the new company  Thus, this merger as well was not an inversion under the tax law  Actavis, in turn, was a former U S  firm that inverted by merger with Warner Chillcott, an Irish firm, in 2013 (where the former shareholders of the U S  firm acquired 77% of the stock)  Pfizer terminated its merger with Allergen after the April 4, 2016, regulations (discussed below)  Other notable mergers not subject to anti-inversion rules were the acquisition of Salix, a pharmaceutical company, by Valeant (a Canadian company); the acquisition of Auxilium by Endo (after Auxilium backed out of an inversion with Canadian firm QLT); the merger of Cyberonics with Italy's Sorin (to be headquartered in the U K ); and the merger of Broadcom (a chipmaker) with Avago (a Singapore firm)  Information and analytics provider HIS announced a merger with Markit Ltd, a U K  firm, to be headquartered in the U K , but the ownership share of HIS would be less than 60% of the firm  Johnson Controls also merged with Tyco, one of the earlier inverted firms  The 2015 Treasury regulations appear to have more limited consequences for inversions than the 2014 regulations did  Three regulatory changes were made by the notice  First, in the case where the foreign parent is a tax resident of a third country, stock issued by that parent to the existing foreign firm will be disregarded for purposes of the ownership requirement  That change will prevent a U S  firm from merging with a partner and then choosing a tax friendly third country to headquarter in  The second provision would clarify the so called "anti-stuffing" rules, where the foreign firm's size is inflated by adding assets to that firm  The notice clarifies that this rule applies to any assets, not just passive assets  Third, the current business activity exception requires 25% of business activity to be in the foreign country where the new parent is created or organized, but does not require it to be a foreign parent  This rule requires the business activity to be in the foreign parent  It prevents inversion based on the business activity test when the foreign parent has a tax residence in another country without substantial business activities  On April 4, 2016, the Treasury Department issued temporary and proposed regulations formalizing rules contained in Notices 2014-52 and 2015-79 limiting corporate tax inversions, as well as adding new rules addressing inversions and earnings-stripping transactions  In response to these new regulations, the proposed merger between Pfizer and Allergen PLC has been terminated  The April 4, 2016, Treasury regulations put in place several anti-inversion rules that target groups that have engaged in a series of inversion or acquisition transactions as well as a rule that restricts postinversion asset dilution  The temporary regulations target inversion transactions involving a new foreign parent that previously acquired one or more U S  entities in inversions or acquisitions in which the new foreign parent issued stock  These prior acquisitions would generally increase the value of the foreign entity, enabling it to subsequently engage in an inversion transaction with a larger U S  company while remaining below the 60% or 80% ownership thresholds  The temporary regulations disregard stock of the new foreign parent to the extent the value of such stock is attributable to its prior U S  entity acquisitions during the prior three years  According to analysis by Americans for Tax Fairness, the implementation of this rule would have increased Pfizer's share of the merged company to roughly 70% from 56% prior to the rule  Similar to the multiple domestic entity acquisition rule, the multiple-step acquisition rule targets certain inversions that are structured as back-to-back foreign acquisitions  Specifically, it targets transactions that are part of a plan in which a foreign corporation acquires substantially all of the assets of a U S  entity and, subsequent to this first acquisition, a second foreign corporation acquires substantially all of the assets of the first foreign corporation  The temporary regulations, under certain circumstances, treat each acquisition as an acquisition of a U S  entity that may be subject to anti-inversion rules  Unlike the multiple domestic entity acquisition rule, which has a three-year look-back period, the multiple-step acquisition rule can be applied to all acquisitions that are part of the same plan regardless of time  A third rule modified existing regulations to restrict the ability of inverted companies to avoid paying tax on unrealized gains (under Section 965) through a transfer to a controlled foreign corporation (CFC) (under Section 351)  This would address situations where a CFC of an inverted U S  company engages in a postinversion exchange that could dilute a U S  shareholder's indirect interest in the exchanged asset, allowing the U S  shareholder to avoid U S  tax on any realized gain in the asset that is not recognized at the time of the transfer  The rule requires a CFC of an inverted U S  group to recognize all realized gain with respect to any such postinversion Section 351 exchange  The earnings-stripping regulations aim to restrict the ability of foreign-parent groups to shift earnings out of the United States through dividends or other economically similar transactions (under Section 385)  In these cases certain related-party debt will be characterized as equity for tax purposes  The result of equity classification is that interest deductions will be disallowed, and withholding obligations of 30% (or lower rate based on an applicable income tax treaty) could ensue  The regulations do not normally apply for related-party debt that is incurred to fund actual business investment, such as building or equipping a factory  The regulations also require documentation of debt instruments issued and held by certain members of an expanded group to establish that such instruments are properly characterized as debt  The regulations also allow the IRS on audit to treat an instrument issued to a related party as in part debt and in part equity  The final regulations issued on October 21, 2016, scaled back the original regulations in response to the comment period  The final regulations removed the general bifurcation rule that would have allowed a debt instrument to be classified as part debt and part equity and an exemption for debt for foreign issuers  The rules also provided exemptions for cash pools (a pool of cash to be accessed for short-term needs), short-term loans, regulated financial entities, and pass-throughs (firms not taxed as corporations)  The Treasury delayed documentation rules for a year on July 28, 2017  Treasury announced on July 7, 2017, that these debt-equity regulations were to be among eight rules targeted for review  The Treasury issued final regulations for the temporary regulations introduced in April 2016 on July 12, 2018, as TD 9834 with minor changes  Two days after the regulations were issued, Pfizer withdrew from its merger with Allergen, an Irish-based company that was an inverted firm  It appears that this merger was affected by the multiple-entity rule, which has come to be called "serial inversion " Mergers between Shire (Ireland based) and Basalta, and between HIS and Markit Group Inc  (U K  based) went forward  The CF Industries merger with OCI NV (based in the Netherlands) was also called off; Johnson Controls and Tyco went forward  A merger between Konecranes (a Finnish firm) and Terex was scaled down to an acquisition of a share of Terex with the U S  firm owning 25%, thus avoiding the effect of regulations  In May 2016 Cardtronics, Inc , an ATM operator, announced a plan to move to the U K  using the substantial business activities test  Also in May, an oil and gas industry service and technology firm announced a merger with Technip SA (France) to form a U K  company, with each firm holding about half the stock and thus avoiding any of the recent regulations and establishing a new headquarters in another country  In 2017, Praxaire (a U S  industrial gas company) announced a merger with Linde AG (a German gas and technology company), also with each owning half of the new company  As noted in the introduction, statistical data suggest a decline in inversions from 2015 to 2016, and again from 2016 to 2017, and these data are consistent with the limited news reports of major inversions  Pfizer's CEO has recently indicated that deals are on hold generally while tax reform is being considered  The 2017 legislation not only made fundamental changes to the overall treatment of corporate income at home and abroad, but also adopted several provisions specifically aimed at inverted corporations (those with 60% to 80% ownership)  Under the new law, existing untaxed earnings held abroad are taxed under a deemed repatriation rule, but at a lower rate (8% for earnings reinvested in noncash assets and 15 5% for earnings held as cash or cash equivalents)  A special recapture rule applies on deemed repatriations of newly inverted firms  This recapture rule applies if a firm first becomes an expatriated entity at any time during the 10-year period beginning on December 22, 2017  In this case, the tax will be increased from 8% and 15 5% to 35% tax for the entire deemed repatriation, with no foreign tax credit allowed for the increase in tax rate  The additional tax is due on the full amount of the deemed repatriation in the first tax year in which the taxpayer becomes an expatriated entity  BEAT excludes payments which reduce gross receipts with the result that payment for the cost of goods sold is not included under BEAT  An exception applies for firms that invert after November 9, 2017, where payments to a foreign parent or any foreign firm in the affiliated for cost of goods sold is included in BEAT  The constructive ownership rules for purposes of determining 10% U S  shareholders, whether a corporation is a CFC and whether parties satisfy certain relatedness tests, were expanded in the 2017 tax revision  Specifically, the new law treats stock owned by a foreign person as attributable to a U S  entity owned by the foreign person (so-called "downward attribution")  As a result, stock owned by a foreign person may generally be attributed to (1) a U S  corporation, 10% of the value of the stock of which is owned, directly or indirectly, by the foreign person; (2) a U S  partnership in which the foreign person is a partner; and (3) certain U S  trusts if the foreign person is a beneficiary or, in certain circumstances, a grantor or a substantial owner  The downward attribution rule was originally conceived to deal with inversions  In an inversion, without downward attribution, a subsidiary of the original U S  parent could lose CFC status if it sold enough stock to the new foreign parent so the U S  parent no longer had majority ownership  With downward attribution, the ownership of stock by the new foreign parent in the CFC is attributed to the U S  parent, so that the subsidiary continues its CFC status, making it subject to any tax rules that apply to CFCs (such as Subpart F and repatriation taxes under the old law, and Subpart F and GILTI under the new law)  Dividends (like capital gains) are allowed lower tax rates than the rates applied to ordinary income  The rates are 0%, 15%, and 20% depending on the rate bracket that ordinary income falls into  Certain dividends received from foreign firms (those that do not have tax treaties and PFICs ) are not eligible for these lower rates  Dividends paid by firms that inverted after the date of enactment of P L  115-97 are added to the list of those not eligible for the lower rates  In 2004, an excise tax of 15% was imposed on stock compensation received by insiders in an expatriated corporation; the new law increases it to 20%, effective on the date of enactment for corporations that first become expatriated after that date  As noted earlier, there are no aggregate data available yet for 2018, but there are also indications that most tax-motivated inversions had already been discouraged by the 2016 regulations  Considering announcements of individual companies, one planned inversion, by Assurant, Inc  was revised to retain the headquarters in the United States  Ohio-based Dana, Inc  announced plans to merge and move the headquarters to the U K , although the merger would leave the U S  shareholders with less than 60% ownership, and therefore not make them subject to anti-inversion penalties  A recent announcement indicated that the Dana merger was called off  Some firms may be considering reversing their headquarters decisions  The AJCA was successful at limiting a form of inversions, at least initially  In particular, the AJCA stopped the practice of basic "naked inversions," in which little activity or presence in the new jurisdiction is required and the new parent is domiciled in a tax haven  Further, through regulation, Treasury has limited the use of the substantial business activity test safe harbor to invert  Recent activity (as noted above), however, suggests that mergers continued to be used as a vehicle for corporate inversions after these changes  These more recent mergers have increasingly resulted in a U K  parent company (e g , FMC-Technip, HIS-Markit), due to policy decisions by the U K  government  Specifically, the U K  lowered its corporate tax rate and adopted a territorial tax system  In addition, anti-abuse provisions for foreign source income were weakened by the European Union courts  The U K  has also proposed taxing certain intangible income at a 10% rate  (This is referred to as a patent box ) To restrict the occurrence of tax-motivated inversions, both a general reform of the U S  corporate tax and specific provisions to deal with tax-motivated international mergers were discussed  Some important changes were made in 2017; other options remain  Interest in reforming the corporate income tax was long-standing, including calling for explicit accommodation of international concerns  As noted earlier, two aspects of the U S  corporate tax system are particularly relevant to corporate location decisions: the corporate tax rate and the taxation of foreign-source earnings  Taken together, these factors, under prior law, could yield a substantial reduction in taxes paid  In the case of the proposed merger of Forest Laboratories Inc  (a U S  company) and Actavis (an Irish company) in 2014, the tax reduction was estimated to be roughly $100 million per year  Prior to the 2017 changes, the U S  corporate statutory tax rate was higher than both the average statutory rates of the other Organisation for Economic Co-operation and Development (OECD) countries and that of the 15 largest economies in the world  Many asserted that the U S  statutory tax rate needed to be lowered to reduce the incentive for inversion transactions  With the rate lowered from 35% to 21%, the combined central and subnational corporate tax rates are similar to most rates in the OECD  While lowering the corporate tax rate would reduce the incentive to invert, there are reasons to suggest that it would be impractical to reduce the rate to the level needed to stop inversions  Namely, to stop inversions through a reduction in the corporate tax rate would require a U S  corporate tax rate set equal to the lowest tax rate of a destination company, or zero  A lower corporate tax rate alone reduced the incentive for corporate inversions, primarily by reducing the tax rate applied to repatriated earnings  For a company like Pfizer, with large foreign earnings, a rate reduction could yield significantly lower taxes paid  However, as discussed below, the benefit of a lowered rate is negligible relative to the benefit to corporate taxpayers afforded by territorial tax systems, when income earned in low- or no-tax foreign jurisdictions is never subject to U S  tax  Two factors present challenges for lowering the corporate tax rate further  First, if revenue neutrality is a goal, there may not be enough base-broadening provisions with revenue offsets to provide deep cuts in the corporate tax; and, if such offsets were found, they might have their own consequences for investment  Reducing the corporate tax without corresponding base broadening would likely reduce corporate tax revenue, adding to chronic budget deficits  Prior to the 2017 revision, the United States was one of the few countries that had a worldwide tax system and levied a tax on the foreign-source income of domestic corporations  Changing corporate tax residence to a country with a territorial tax system (where foreign earnings would not be taxed at all) was thought to drive inversion decisions  This issue led to proposals for the United States to adopt a territorial tax system to stop inversion transactions  One concern about adopting a territorial tax system is the strain it would likely place on the current transfer pricing system  From this perspective, the worldwide tax system provided a backstop on the amount of profit shifting or base erosion possible, because shifted profits will eventually be repatriated  Under a territorial tax system, this is not the case  Research has found evidence of significant profit shifting, especially related to mobile intellectual property, suggesting a lot of income from foreign sources is really U S  income in disguise  Numerous other issues surround the adoption of a U S  territorial tax  For example, while some supported a territorial tax to eliminate the incentive to keep earnings abroad, others opposed it because it likely discourages domestic investment and activity in the United States  The revisions in 2017 maintained a worldwide system, but with some changes  Income from U S  subsidiaries is taxed on a current basis but at a lower rate and with an exemption for a deemed return on tangible assets  It also provided a subsidy for locating intangible assets with earnings from abroad in the United States  Many of the inverting firms had significant intangible assets, and it is not clear whether this new regime (a lower tax rate but on a current basis) is more or less generous to firms considering inverting  Moving closer to a pure territorial tax, as in the case of a rate reduction, would likely reduce corporate tax revenue and add to current budget pressures unless it is offset by other tax increases, although this effect would be less costly at the lower 21% tax rate  In 2027, GILTI is projected to raise $21 billion  GILTI could be retained and the rate lowered or the temporarily lower rate could be made permanent  There has been some agreement that adopting a territorial tax without some significant anti-abuse provisions could be problematic, as it would likely increase profit shifting abroad by U S  firms  Evidence suggests that administrative remedies were successful at dramatically slowing inversions; the targeted legislative changes in the 2017 Act may have had some impact as well  There are further changes that could be made to discourage inversions  This section discusses the history of these proposals, both legislative and administrative  One approach would be to extend the rate recapture enacted in the 2017 Act for a period longer than 10 years, or to make it apply indefinitely to future inversions  A second alternative is to directly restrict the ability of U S  firms to invert by merger  The President's FY2015, FY2016, and FY2017 budget proposals contained a provision that would have further restricted the use of inversions  The proposal would modify the 80% test enacted in the AJCA to a 50% test and eliminate the 60% test  In effect, this proposal would reduce the percentage of shareholders that are owners of the "old U S  company" and the "new foreign merged company " The proposal would also require that the new foreign corporation be managed and controlled from outside the United States and prohibit transactions where the new foreign company has substantial business activities in the United States  In November 2015, then-Senate Finance Committee Chairman Hatch indicated the possibility of adding an anti-inversion provision to legislation to extend expired provisions  Many of these bills were introduced in the 115 th Congress  H R  1931 (Doggett), the Corporate EXIT Fairness Act, and H R  3434 (Levin) and S  1636 (Durbin, along with a number of cosponsors), the Stop Corporate Inversions Act, would have treated all mergers as U S  firms when the U S  firm's shareholders hold more than 50% or when management and control primarily takes place in the United States  H R  1932 (Doggett) and S  851 (Whitehouse), as with bills introduced in the 114 th Congress, would have included anti-inversion provisions as part of a broader proposal to address tax havens and deferral  H R  3603 (Levin) would have addressed earnings stripping of inverted corporations  H R  3424 (DeLauro) would disallow federal contracts for inverted firms  H R  1451 (Schakowsky) and S  586 (Sanders) would make major changes in the tax treatment of foreign source income and include anti-inversion rules  Following the change in the international system adopted at the end of 2017, Representative Doggett and Senator Whitehouse introduced the "No Tax Break for Outsourcing Act" ( H R  5108 , S  2459 ) which, in addition to other changes, would have treated foreign corporations that are managed and controlled in the United States as domestic corporations and treated inverted firms as U S  firms when the shareholders of the former U S  company own more than 50% of the shares  These bills would have also limited interest deductions in the United States to the proportionate share of the firm's assets  The last proposal (to allocate worldwide interest) was in both the House and Senate versions of the legislation ( H R  1 ; 115 th Congress) in somewhat different form but was not retained in the final legislation  While this proposal was not specifically targeted at inverted firms it would have increased the restrictions that limit earnings stripping  Former President Obama had encouraged Congress to act directly to limit inversions, but had also indicated on August 6, 2014, that administrative changes to limit inversions were under examination  Prior to that announcement, Steve Shay, a Harvard professor and former practitioner and Treasury official, outlined two regulatory actions that he believed could be taken  The first would limit earnings stripping by reclassifying debt as equity due to excessive related party debt in an inversion  (The second provision is no longer relevant under the new international tax regime ) A number of other administrative proposals that have been suggested (such as provisions relating to taxing accumulated deferred earnings) are no longer relevant and others have been adopted in the regulatory changes discussed above  Expanding the scope of Section 7874 (which treats inverted firms as U S  firms) by combining multiple transactions into single ones, or vice versa  The scope of Section 7874 could also be expanded by treating certain stock as disqualified (because it is expected to be held temporarily or because it is accompanied by restrictions on voting rights); this provision was adopted in Treasury regulations; Potentially recognizing accumulated deferred earnings as currently taxable under authority such as Subpart F, Section 367, or other rules (this provision is no longer relevant with the end of deferral, but it may have influenced the decision to tax deferred earnings of newly inverted firms at the full 35% rate for the next 10 years); Issuing regulations that would generally tighten restrictions on interest deductions under the thin capitalization rules of Section 163(j)  These changes would probably apply to corporations in general, and not just to inverted corporations (this change was made in the 2017 tax revision); Stricter regulations under Section 367 to immediately include foreign earnings in the case of actions that attempt to move foreign operations out from under the U S  parent  This would make future earnings of these operations nontaxable; Strengthening and modernizing the effectively connected income rules that determined whether trade or business activity is taking place in the United States by foreign firms; and Closely monitoring the creation of non-U S  subsidiaries owned by the foreign parent after inversion, and ensuring that assets (including intangibles such as inventions, knowhow, etc ) transferred from the U S  firm are transferred at arms-length prices  There is disagreement among experts about whether the types of regulatory changes discussed in this section are feasible or desirable  A number of legislative proposals were advanced in 2014, when the wave of inversions through merger began  Representative Levin, the ranking member of the House Ways and Means Committee, introduced the Stop Corporate Inversions Act of 2014 ( H R  4679 ), which would have reflected the Administration's proposed changes, retroactive to May 8, 2014  The inversion would have not been recognized if the U S  stockholders had 50% of the shares or if 25% of the business activity is in the United States  A companion bill, which would have sunset in two years to provide time for tax reform, was introduced in the Senate by Senator Levin in 2014 ( S  2360 )  The Joint Committee on Taxation estimated the permanent proposal to gain $19 5 billion in revenue over FY2015-FY2024  The two-year proposal would have raise $0 8 billion over the same period  In the 114 th Congress, these legislative proposals were introduced as H R  415 (Levin) and S  198 (Durbin)  Senator Casey proposed an anti-inversion amendment to an education bill ( S  1177 )  In the 114 th Congress, H R  297 (Doggett) and S  174 (Whitehouse) included anti-inversion provisions as part of a broader proposal to address tax haven abuses and restrict the benefits of deferral  S  922 (Sanders) and H R  1790 (Schakowsky) also included anti-inversion provisions, as well as earnings-stripping provisions (discussed below) and broader provisions, including the repeal of deferral  In 2014 a number of legislative proposals were introduced that would limit the tax benefits associated with inversions for certain corporations  For example, H R  1554 (Doggett), H R  3666 (DeLauro), H R  3793 (Maffei), S  268 (Levin), S  1533 (Levin), and S  1844 (Shaheen) would each treat corporations managed and controlled from the United States as domestic corporations regardless of their legal tax home or status as an inverted company  This provision was also included in S  922 (Sanders) and H R  1790 (Schakowsky)  Other proposals in 2014, H R  694 (Schakowsky) and S  250 (Sanders), would have eliminated deferral (taxing foreign source income currently), in addition to limiting the benefits of inversions when management and control continues to reside in the United States  Legislative proposals were also under discussion in 2014 by Representative Levin (announced July 31, 2014) and by Senator Schumer (announced August 14, 2014) to address earnings stripping, where foreign parent companies borrow from the U S  subsidiary to increase interest deductions and reduce taxable income in the United States  Both of these proposals would have tightened the rules allowing interest deductions by reducing the current limit on interest deductions relative to adjusted income from 50% to 25% and repealing an alternative safe-harbor debt-to-equity test  Both proposals would have also eliminated or limited interest carryforwards  The Schumer proposal was intended to apparently apply to inverted firms while the Levin proposal would have applied generally  The Levin proposal would have also limited other transactions between related parties within the firm that allow untaxed investment of funds in the United States  The restrictions on interest in the Levin bill were the same as those initially proposed in the House in 2004  Senator Schumer introduced his proposal, S  2786 , the Corporate Inverters Earnings Stripping Reform Act of 2014  Its limits on interest deductions would have applied to inverted firms where U S  shareholders own more than 50% of the firm  The restriction also would have applied to firms that inverted using the substantial business activities test  The bill had nine Democratic cosponsors; five of them were on the Senate Finance Committee  In the 114 th Congress, S  922 (Sanders) and H R  1790 (Schakowsky) included general earnings-stripping provisions for firms with a foreign parent  Earnings stripping provisions were also addressed in the report of the Senate Finance Committee's working group on Tax Reform  H R  5278 (DeLauro) and S  2704 (Levin), introduced May 30, 2014, would have disallowed awarding federal contracts to inverted firms  These proposals were introduced in the 114 th Congress as H R  1809 (DeLauro) and S  975 (Durbin)  In 2014, Senators Brown and Durbin proposed S  2895 , and Representative Doggett introduced H R  5549 , the Pay What You Owe Before You Go Act, that would have taxed the accumulated deferred earnings of inverting firms  Then Senate Finance Committee Chairman Ron Wyden had proposed having draft legislation in place in September 2014, and also referred to Schumer's earnings-stripping proposal  Senator Wyden had previously announced that any changes would be retroactive to May 8, 2014 

ground_truth: Federal agencies and the nation's critical infrastructures—such as energy, transportation systems, communications, and financial services—are dependent on information technology systems to carry out operations. The security of these systems and the data they use is vital to public confidence and national security, prosperity, and well-being. The risks to these systems are increasing as security threats evolve and become more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015. This report provides an update to the information security high-risk area. To do so, GAO identified the actions the federal government and other entities need to take to address cybersecurity challenges. GAO primarily reviewed prior work issued since the start of fiscal year 2016 related to privacy, critical federal functions, and cybersecurity incidents, among other areas. GAO also reviewed recent cybersecurity policy and strategy documents, as well as information security industry reports of recent cyberattacks and security breaches. GAO has identified four major cybersecurity challenges and 10 critical actions that the federal government and other entities need to take to address them. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities. GAO has made over 3,000 recommendations to agencies aimed at addressing cybersecurity shortcomings in each of these action areas, including protecting cyber critical infrastructure, managing the cybersecurity workforce, and responding to cybersecurity incidents. Although many recommendations have been addressed, about 1,000 have not yet been implemented. Until these shortcomings are addressed, federal agencies' information and systems will be increasingly susceptible to the multitude of cyber-related threats that exist. GAO has made over 3,000 recommendations to agencies since 2010 aimed at addressing cybersecurity shortcomings. As of August 2018, about 1,000 still needed to be implemented.