prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: Cluster munitions are weapons that open in mid-air and disperse smaller submunitions—anywhere from a few dozen to hundreds—into an area  They can be delivered by aircraft or from ground systems such as artillery, rockets, and missiles  Cluster munitions are valued militarily because one munition can kill or destroy many targets within its impact area, and fewer weapons systems are needed to deliver fewer munitions to attack multiple targets  Cluster munitions also permit a smaller force to engage a larger adversary and are considered by some an "economy of force" weapon  Many cluster munitions rely on simple mechanical fuzes that arm the submunition based on its rate of spin and explode on impact or after a time delay  A newer generation of sensor-fuzed submunitions is being introduced by a number of nations to improve the munitions' and submunitions' accuracy and to reduce the large number of residual unexploded submunitions  These sensor-fuzed submunitions are designed to sense and destroy vehicles without creating an extensive hazard area of unexploded submunitions  Cluster bombs were first used in World War II, and inclusive of their debut, cluster munitions have been used in at least 21 states by at least 13 different countries  Cluster munitions were used extensively in Southeast Asia by the United States in the 1960s and 1970s, and the International Committee of the Red Cross (ICRC) estimates that in Laos alone, 9 million to 27 million unexploded submunitions remained after the conflict, resulting in over 10,000 civilian casualties to date  Cluster munitions were used by the Soviets in Afghanistan, by the British in the Falklands, by the Coalition in the Gulf War, and by the warring factions in Yugoslavia  In Kosovo and Yugoslavia in 1999, NATO forces dropped 1,765 cluster bombs containing approximately 295,000 submunitions  From 2001 through 2002, the United States dropped 1,228 cluster bombs containing 248,056 submunitions in Afghanistan, and U S  and British forces used almost 13,000 cluster munitions containing an estimated 1 8 million to 2 million submunitions during the first three weeks of combat in Iraq in 2003  Senior U S  government officials have stated that the United States has not used cluster munitions since 2003, during the intervention in Iraq  It is widely believed that confusion over U S  cluster submunitions (BLU-97/B) that were the same color and size as air-dropped humanitarian food packets played a major role in the U S  decision to suspend cluster munitions use in Afghanistan but not before using them in Iraq  In 2006, Israeli use of cluster munitions against Hezbollah forces in Lebanon resulted in widespread international criticism  Israel was said to have fired significant quantities of cluster munitions—primarily during the last 3 days of the 34-day war after a U N  cease-fire deal had been agreed to —resulting in almost 1 million unexploded cluster bomblets to which the U N  attributed 14 deaths during the conflict  Reports maintain that Hezbollah fired about 113 "cluster rockets" at northern Israel and, in turn, Israel's use of cluster munitions supposedly affected 26% of southern Lebanon's arable land and contaminated about 13 square miles with unexploded submunitions  One report states that there was a failure rate of upward of 70% of Israel's cluster weapons  The fundamental criticisms of cluster munitions are that they disperse large numbers of submunitions imprecisely over an extended area, that they frequently fail to detonate and are difficult to detect, and that submunitions can remain explosive hazards for decades  Civilian casualties are primarily caused by munitions being fired into areas where soldiers and civilians are intermixed, inaccurate cluster munitions landing in populated areas, or civilians traversing areas where cluster munitions have been employed but failed to explode  Two technical characteristics of submunitions—failure rate and lack of a self-destruct capability—have received a great deal of attention  There appear to be significant discrepancies among failure rate estimates  Some manufacturers claim a submunition failure rate of 2% to 5%, whereas mine clearance specialists have frequently reported failure rates of 10% to 30%  A number of factors influence submunition reliability  These include delivery technique, age of the submunition, air temperature, landing in soft or muddy ground, getting caught in trees and vegetation, and submunitions being damaged after dispersal, or landing in such a manner that their impact fuzes fail to initiate  Submunitions lacking a self-destruct capability—referred to as "dumb" munitions—are of particular concern because they can remain a hazard for decades, thereby increasing the potential for civilian casualties  Some nations are developing "smart" or sensor-fuzed weapons with greater reliability and a variety of self-destruct mechanisms intended to address the residual hazard of submunitions  Experts maintain that self-destruct features reduce—but do not eliminate—the unexploded ordnance problem caused by cluster munitions and that the advantage gained by using "smart" cluster munitions is negated when high-failure rate and/or "dumb" cluster munitions are used in the same area  For some nations, replacing "dumb" and high-failure rate cluster munitions may not be an option—China, Russia, and the Republic of Korea maintain that they cannot afford to replace all current submunitions with "smart" submunitions  In an effort to restrict or ban specific types of weapons used in armed conflicts, 51 states negotiated the CCW in 1980  When the treaty entered into force in December 1983, it applied only to incendiary weapons, mines and booby-traps, and weapons intended to cause casualties through very small fragments  Since then, some states-parties have added provisions through additional protocols to address other types of weapons  Acting in accordance with the recommendation of a group of experts established during the 2006 CCW review conference, states-parties to the convention decided in 2007 to "negotiate a proposal to address urgently the humanitarian impact of cluster munitions " Negotiations took place in 2008 and 2009, but the parties have not reached agreement on a new proposal  The experts group continued negotiations in 2011 "informed by" a Draft Protocol on Cluster Munitions  However, the CCW states-parties were unable to reach agreement on a protocol during their November 2011 review conference  Described as "frustrated with the CCW process," a number of CCW members—led by Norway—initiated negotiations in 2007 outside of the CCW to ban cluster munitions  On May 30, 2008, they reached an agreement to ban cluster munitions  The United States, Russia, China, Israel, Egypt, India, and Pakistan did not participate in the talks or sign the agreement  During the Signing Conference in Oslo on December 3-4, 2008, 94 states signed the convention and 4 of the signatories ratified the convention at the same time  China, Russia, and the United States did not sign the convention, but France, Germany, and the United Kingdom were among the 18 NATO members to do so  The convention was to enter into force six months after the deposit of the 30 th ratification  The United Nations received the 30 th ratification on February 16, 2010, and the convention entered into force on August 1, 2010  As of January 2, 2019, 105 states were party to the convention  The Convention on Cluster Munitions (CCM), inter alia, bans the use of cluster munitions, as well as their development, production, acquisition, transfer, and stockpiling  The convention does not prohibit cluster munitions that can detect and engage a single target or explosive submunitions equipped with an electronic self-destruction or self-deactivating feature —an exemption that seemingly permits sensor-fuzed or "smart" cluster submunitions  U S  officials were concerned that early versions of the CCM would prevent military forces from non-states-parties from providing humanitarian and peacekeeping support and significantly affect NATO military operations, but the version signed May 30, 2008, does permit states-parties to engage in military cooperation and operations with non-states-parties (Article 21, Paragraph 3)  Then-Acting Assistant Secretary for Political-Military Affairs Stephen Mull stated in May 2008 that the United States relies on cluster munitions "as an important part of our own defense strategy," and that Washington's preferred alternative to a ban is "to pursue technological fixes that will make sure that these weapons are no longer viable once the conflict is over " U S  officials note that Cluster munitions are available for use by every combat aircraft in the U S  inventory, they are integral to every Army or Marine maneuver element and in some cases constitute up to 50 percent of tactical indirect fire support  U S  forces simply can not fight by design or by doctrine without holding out at least the possibility of using cluster munitions  The United States also maintains that using cluster munitions reduces the number of aircraft and artillery systems needed to support military operations, and that if cluster munitions were eliminated, significantly more money would need to be spent on new weapons systems, ammunition, and logistical resources  Officials further suggest that if cluster munitions were eliminated, most militaries would increase their use of massed artillery and rocket barrages, which would likely increase destruction of key infrastructure  Then-Department of State Legal Adviser Harold Koh stated November 9, 2009, that the United States has determined that its "national security interests cannot be fully ensured consistent with the terms" of the CCM  The Barack Obama Administration announced on November 25, 2011, that the United States would continue to implement the DOD policy on cluster munitions issued June 19, 2008, which recognized the need to minimize harm to civilians and infrastructure but also reaffirmed that "cluster munitions are legitimate weapons with clear military utility " The central directive in the Pentagon's policy was the unwaiverable requirement that cluster munitions used after 2018 must leave less than 1% of unexploded submunitions on the battlefield  Prior to that deadline, U S  use of cluster munitions that did not meet this criterion required combatant commander approval  On November 30, 2017, then-Deputy Secretary of Defense Patrick Shanahan issued a revised policy on cluster munitions  The memorandum describing the policy noted that [c]luster munitions provide the Joint Force with an effective and necessary capability to engage area targets, including massed formations of enemy forces, individual targets dispersed over a defined area, targets whose precise location are not known, and time-sensitive or moving targets  Cluster munitions are legitimate weapons with clear military utility, as they provide distinct advantages against a range of threats in the operating environment  Additionally, the use of cluster munitions may result in less collateral damage than the collateral damage that results from use of unitary munitions alone  Since the inception of the 2008 policy, in the midst of extended combat operations in Iraq and Afghanistan, we have witnessed important changes in the global security environment and experienced several years of budgets that under-invested in replacement systems and the modernization of the Joint Force more broadly  Our adversaries and our potential adversaries have developed advanced capabilities and operational approaches specifically designed to limit our ability to project power  Both Shanahan and Admiral Harry Harris Jr  have also argued that sustaining the current U S  cluster munitions arsenal is necessary to prepare for a potential conflict with North Korea  The revised policy reverses the 2008 policy that established an unwaiverable requirement that cluster munitions used after 2018 must leave less than 1% of unexploded submunitions on the battlefield  Combatant commanders can use cluster munitions that do not meet the 1% or less unexploded submunitions standard in extreme situations to meet immediate warfighting demands  Furthermore, the new policy does not establish a deadline to replace cluster munitions exceeding the 1% rate, and these munitions will be removed only after new munitions that meet the 1% or less unexploded submunitions standard are fielded in sufficient quantities to meet combatant commander requirements  However, the new DOD policy stipulates that the department "will only procure cluster munitions containing submunitions or submunition warheads" meeting the 2008 UXO requirement or possessing "advanced features to minimize the risks posed by unexploded submunitions " Specifically, DOD's revised policy stipulates the following: Continuing or beginning with their respective FY2019 budgets, the military departments will program for capabilities to replace cluster munitions currently in active inventories that do not meet the above-described standards for procuring new cluster munitions  The department's annual Program and Budget Review will be used to assess the sufficiency of the replacement efforts  The department's operational planners should plan for the availability of cluster munitions  The approval authority to employ cluster munitions that do not meet the standards prescribed by this policy for procuring new cluster munitions, however, rests with the combatant commanders  In accordance with their existing authorities, commanders may use cluster munitions that meet the standards prescribed by this policy for procuring new cluster munitions  The military departments and combatant commands, in keeping with U S  legal obligations under CCW Protocol V on Explosive Remnants of War and consistent with past practices, will continue to record and retain information on the use of cluster munitions and provide relevant information to facilitate the removal or destruction of unexploded submunitions  The military departments and combatant commands will maintain sufficient inventories and a robust stockpile surveillance program to ensure operational quality and reliability of cluster munitions  In extremis, to meet immediate warfighting demand, combatant commanders may accept transfers of cluster munitions that do not meet the above-described cluster-munition procurement standards  Cluster munitions that do not meet the standards prescribed by this policy for procuring new cluster munitions will be removed from active inventories and demilitarized after their capabilities have been replaced by sufficient quantities of munitions that meet the standards in this policy  The department will not transfer cluster munitions except as provided for under U S  law  The operational use of cluster munitions that include Anti-Personnel Landmines (APL) submunitions shall comply with presidential policy  Furthermore, the Deputy Secretary of Defense Expect(s) the Department to achieve the goals in this policy as rapidly as industry can support  Combatant Commanders will continue to ensure that the employment of cluster munitions is consistent with the law of war and applicable international agreements in order to minimize their harmful effects on civilian populations and infrastructure  In developing a new generation of cluster munitions less dangerous to civilians, DOD will need to determine whether such a high level of performance is achievable under both controlled laboratory conditions and real-world conditions  Factors such as delivery technique, landing in soft or muddy ground, getting caught in trees and vegetation, and submunitions being damaged after dispersal or landing could result in an appreciable number of dud submunitions, even if they have a self-deactivation feature  DOD and the services have been and are currently involved in efforts to reduce cluster munitions failure rates  The Army's Alternative Warhead Program (AWP) is intended to assess and recommend new technologies to reduce or eliminate cluster munitions failure rates  The AWP program is viewed as particularly relevant, as the Pentagon estimates that "upward of 80 percent of U S  cluster munitions reside in the Army artillery stockpile " In December 2008, the Army decided to cease procurement of a Guided Multiple Launch Rocket System (GMLRS) warhead—the Dual-Purpose Improved Conventional Munition (DPICM) warhead—because its submunitions had a dud rate up to 5%  The Air Force has also acquired cluster munitions that comply with the less than 1% failure rate—the CBU-97 Sensor Fuzed Weapon (SFW) and the CBU-105 WCMD/SFW  While DOD's new 2017 cluster munitions policy calls for DOD to continue its efforts to meet the 1% or less unexploded submunitions standard "as rapidly as industry can support," it is not yet known how this policy will affect the aforementioned programs or how it could result in the establishment of new programs  It may be argued that even with advances in "sensor-fuzed" type submunitions that seek out and destroy certain targets, cluster munitions are still essentially an indiscriminate area weapon in an era where precision weapons are increasingly becoming the military norm  In Operation Desert Storm in 1991, only about 10% of ordnance used were precision-guided, but by the time of the Iraq invasion in 2003, "the ratio of 'smart' to dumb weapons was nearly reversed " Since then, this trend toward greater precision has continued, if not accelerated with the development of precision rocket, artillery, mortar munitions, and smaller precision aerial bombs designed to reduce collateral damage  Given current and predicted future precision weaponry trends, cluster munitions might be losing their military relevance—much as chemical weapons did between World War I and World War II  According to the State Department, the U S  military suspended its use of cluster munitions in Iraq and Afghanistan in 2003  For subsequent military operations, where cluster munitions would otherwise have been the weapon of choice, Congress might review what types of weapons were substituted in place of cluster munitions and how effective they were in achieving the desired tactical results  Also worth considering are effects-based weapons systems and operations, which seek to achieve the same or similar effect against a potential target without applying a "kinetic solution" such as a cluster munition  Such insights could prove valuable in analyzing U S  policy options on the future of cluster munitions  DOD's November 2017 revised policy on cluster munitions potentially raises a number of issues for possible congressional consideration  With limits on cluster munition use after 2018 rescinded, how does this affect combatant commanders' operational plans in their respective theaters? Does this mean a lesser degree of military risk because combatant commanders can employ cluster munitions to meet warfighting demands, possibly translating into fewer forces needed to achieve the same result when the 2008 policy was in effect? Despite DOD emphasis on achieving a 1% or less unexploded submunitions standard "as rapidly as industry can support," will DOD funding restrictions slow or stall programs previously intended to replace those systems that exceeded 1% because there no longer is an urgent operational need to replace those systems? In a similar manner, will defense industry view this as a renewed opportunity to develop systems with a 1% or less unexploded submunitions standard or take a more sanguine view that since DOD is no longer time constrained to develop and field 1% or less weapons that funding these programs will be less of a priority and, therefore, an unprofitable venture? Another possible issue for consideration is how this U S  policy reversal on the military use of cluster munitions will be perceived by the international community and how this might affect future U S  and international military treaty initiatives  Consolidated Appropriations Acts The Consolidated Appropriations Act, 2010 ( P L  111-117 ), which the President signed into law December 16, 2009, prohibits the provision of military assistance for cluster munitions, the issuing of defense export licenses for cluster munitions, or the sale or transfer of cluster munitions or cluster munitions technology unless "the submunitions of the cluster munitions, after arming, do not result in more than 1 percent unexploded ordnance across the range of intended operational environments " Moreover, any agreement "applicable to the assistance, transfer, or sale of such cluster munitions or cluster munitions technology" must specify that the munitions "will only be used against clearly defined military targets and will not be used where civilians are known to be present or in areas normally inhabited by civilians " Subsequent appropriations laws have included similar provisions; the most recent is the Consolidated Appropriations Act, 2019 ( P L  116-6 ), which the President signed into law on February 15, 2019  
Report 2:  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 

ground_truth: The Forest Service, an agency within USDA, performs a variety of tasks as steward of 193 million acres of public forests and grasslands. Its budget execution process for carrying out its mission includes (1) allotments, which are authorizations by an agency to incur obligations within a specified amount, and (2) unliquidated obligations, which represent budgetary resources that have been committed but not yet paid. Deobligation refers to an agency's cancellation or downward adjustments of previously incurred obligations, which may result in funds that may be available for reobligation. GAO was asked to review the Forest Service's internal controls over its budget execution processes. This report examines the extent to which the Forest Service properly designed control activities over (1) allotments of budgetary resources, its system for administrative control of funds, and any fund transfers between Forest Service appropriations; (2) reimbursables and related collections; and (3) review and certification of unliquidated obligations. GAO reviewed the Forest Service's policies, procedures, and other documentation and interviewed agency officials. In fiscal years 2015 and 2016, the Forest Service received discretionary no-year appropriations of $5.1 billion and $5.7 billion, respectively. It is critical for the Forest Service to manage its budgetary resources efficiently and effectively. While the Forest Service had processes over certain of its budget execution activities, GAO found the following internal control deficiencies: Budgetary resources . The purpose statute requires that amounts designated in appropriations acts for specific purposes are used as designated. The Forest Service did not have an adequate process and related control activities to reasonably assure that amounts were used as designated. In fiscal year 2017, GAO issued a legal opinion that the Forest Service had failed to comply with the purpose statute with regard to a $65 million line-item appropriation specifically provided for the purpose of acquiring aircraft for the next-generation airtanker fleet. Further, the Forest Service lacked a process and related control activities to reasonably assure that unobligated no-year appropriation balances from prior years were reviewed for their continuing need; did not have a properly designed system for administrative control of funds, which keeps obligations and expenditures from exceeding limits authorized by law; and had not properly designed control activities for fund transfers to its Wildland Fire Management program. These deficiencies increase the risk that the Forest Service may make budget requests in excess of its needs. Reimbursable agreements . To carry out its mission, the Forest Service enters into reimbursable agreements with agencies within the U.S. Department of Agriculture (USDA), other federal agencies, state and local government agencies, and nongovernment entities. The Forest Service (1) did not have adequately described processes and related control activities in manuals and handbooks for its reimbursable agreement processes and (2) lacked control activities related to segregating incompatible duties performed by line officers and program managers. For example, line officers may be responsible for initiating cost sharing agreements, modifying cost settlement packages, and changing or canceling the related receivable, which represent incompatible duties. As a result, programs and resources may not be protected from waste, fraud, and mismanagement. Unliquidated obligations . The Forest Service's processes and control activities over the review and certification of unliquidated obligations were not properly designed to reasonably assure the best use of funds and that unliquidated obligations would be efficiently and effectively deobligated and made available for other program needs. Further, the current process, as designed, was inconsistent with USDA and Forest Service policy. In addition, the Forest Service's manuals and handbooks, which provide directives for the areas that GAO reviewed, had not been reviewed by management in accordance with the Forest Service's 5-year review policy. Further, standard operating procedures and desk guides prepared by staff to supplement the manuals and handbooks were not issued as directives and therefore were not considered official policy. This increases the risk that control activities may not be consistently performed across the agency. GAO is making 11 recommendations to improve processes and related internal control activities over the management of the Forest Service's budgetary resources, reimbursable receivables and collections, and its process for reviewing unliquidated obligations. The Forest Service generally agreed with the report and stated that it has made significant progress to address the report findings.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: The Forest Service’s mission includes sustaining the nation’s forests and grasslands; managing the productivity of those lands for the benefit of citizens; conserving open space; enhancing outdoor recreation opportunities; and conducting research and development in the biological, physical, and social sciences  The agency carries out its responsibilities in three main program areas: (1) managing public lands, known collectively as the National Forest System, through nine regional offices, 154 national forests, 20 national grasslands, and over 600 ranger districts; (2) conducting research through its network of seven research stations, multiple associated research laboratories, and 81 experimental forests and ranges; and (3) working with state and local governments, forest industries, and private landowners and forest users in the management, protection, and development of forest land in nonfederal ownership, largely through its nine regional offices  According to the Forest Service, it employs a workforce of over 30,000 employees across the country  However, this number grows by thousands in the summer months, when the agency hires seasonal employees to conduct fieldwork, respond to wildland fires, and meet the visiting public’s needs  The Office of the Chief of the Forest Service is located in Washington, D C , with 27 offices reporting directly to the Office of the Chief, as illustrated in figure 1  The nine national forest regions, each led by a regional forester, oversee the national forests and grasslands located in their respective regions  Each national forest or grassland is headed by a supervisor, the seven research stations are each led by a station director, and a state and private forestry area is headed by an area director  The Forest Service collectively refers to its forest regions, research stations, and area as RSAs  The RSAs are organized differently according to their operations, and comparable operations within the RSAs, such as collections from reimbursable agreements, may be processed differently in the various regions and stations, resulting in highly decentralized operations  In addition, the offices of the Chief Financial Officer (CFO); Deputy Chief of Business Operations (includes the budget office); and eight other offices located in the Washington, D C , headquarters also report directly to the Office of the Chief of the Forest Service  The Forest Service receives appropriations for its various programs and for specific purposes to meet its mission goals  Prior to fiscal year 2017, the Forest Service’s budgetary resources consisted primarily of no-year funds  Its budget office in Washington, D C , initiates apportionment requests and monitors the receipt of Department of the Treasury (Treasury) warrants  Upon receipt of the warrant, the apportionment is recorded in the financial system and then the budget office develops an allocation summary detailing the allocation of its budget authority by fund, programs within the funds, and distribution of funds at the regional, station, and area levels  The Forest Service may also transfer funds from other appropriations to the appropriations account that funds its fire suppression activities when available funds appropriated for fire suppression and the Federal Land Assistance, Management, and Enhancement (FLAME) fund will be exhausted within 30 days  The Forest Service’s administrative policies, practices, and procedures are issued in its Directive System, which provides a unified system for issuing, storing, and retrieving internal direction that governs Forest Service programs and activities  The Directive System consists of the Forest Service’s manuals and handbooks  The manuals contain management objectives, policies, and responsibilities and provide general direction to Forest Service line officers and staff directors for planning and executing their assigned programs and activities  The handbooks provide detailed direction to employees and are the principal source of specialized guidance and instruction for carrying out directions issued in the manuals  Line officers at the national and RSA levels have authority to issue directives in the manuals and handbooks under their respective jurisdictions  The Forest Service’s policy states that the Directive System is the only place where Forest Service policy and procedures are issued  In addition to the Directive System, Forest Service staff have also developed standard operating procedures (SOP) and desk guides to supplement guidance provided in directives  However, the SOPs and desk guides are not part of the Forest Service Directive System and therefore are not official policy and procedures  While the Forest Service had documented processes for allotting its budgetary resources, it did not have an adequate process and related control activities for reasonably assuring that (1) amounts designated in appropriations acts for specific purposes are used as designated and (2) unobligated no-year appropriation balances from prior years were reviewed for their continuing need  In addition, the Forest Service did not have a properly designed and documented system for administrative control of funds  Finally, the Forest Service had not properly designed control activities for fund transfers for fire suppression activities under its Wildland Fire Management program  While the Forest Service had documented processes for allotting its budgetary resources, it did not have an adequate process and related control activities to reasonably assure that amounts designated in appropriations acts for specific purposes are used as designated—as required by the purpose statute, which states that “appropriations shall be applied only to the objects for which the appropriations were made except as otherwise provided by law ” We reviewed Forest Service documents about its budget authority processes, which included control objectives, related control activities, and processes over the allotment of its budgetary resources  We found that these documents, including manuals and handbooks, did not include an adequate process and related control activities for assuring that appropriated amounts are used for the purposes designated  For example, such a process would include the Forest Service allotting appropriated funds for specific programs or objects as provided in the applicable appropriation act, by either using specific budget line items already defined in the Forest Service’s financial system or creating new budget line items, as needed  Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks and design appropriate control activities to achieve objectives and respond to the risks identified  As a result of the Forest Service not having an adequate process and related control activities for assuring that appropriated amounts are used for the purposes designated, the Forest Service did not properly allocate certain funds for specific purposes detailed in the appropriations acts for fiscal years 2015 and 2016  For example, in fiscal year 2015, the Forest Service did not set aside in its financial system the $65 million specified in the fiscal year 2015 appropriations act for acquiring aircraft for the next- generation airtanker fleet  According to Forest Service documents, as of January 6, 2016, $35 million of the designated funds was used for other purposes  In February 2017, we issued a legal opinion, related to the Forest Service’s use of the $65 million, which concluded that the Forest Service had failed to comply with the purpose statute  According to USDA’s Office of General Counsel, “this lack of any separate apportionment or account for the next-generation airtanker fleet was due to the fact that it was a new item, not included in the agency’s budget request, and added late in the appropriations process ” Similarly, in fiscal year 2016, the Forest Service did not create new budget line items to reserve in its financial system $75 million for the Forest Inventory and Analysis Program specified in the fiscal year 2016 appropriations act  Rather than creating a new budget line item for the program specified in the appropriations act, the funds were combined with an existing budget line item, making it difficult to track related budget amounts and actual expenditures  The lack of an adequate process and related control activities to reasonably assure that appropriated amounts are used for the purpose designated also increases the risk that the Forest Service may violate the Antideficiency Act  The Forest Service did not have a process and related control activities to reasonably assure that unobligated, no-year funds from prior years were reviewed for continuing need  We reviewed the Forest Service’s budget authority process document and related manuals and handbooks, which documented control objectives and procedures over its budgetary resources and the guidance for administrative control of funds  We found that these documents did not include a process for reviewing the Forest Service’s unobligated, no-year funds from prior years and related control activities to reasonably assure that such funds were reviewed for continuing need  Such reviews, if performed, may identify unneeded funds that could be reallocated to other programs needing additional budgetary resources, if consistent with the purposes designated in appropriations acts  The USDA Budget Manual states as a department policy that “agencies of the Department have a responsibility to review their programs continually and recommend, when appropriate, deferrals or rescissions ” The USDA Budget Manual further states the following: “Agency officials should remain alert to this responsibility since the establishment of reserves is an important phase of budgetary administration  If it becomes evident during the fiscal year that any amount of funds available will not be needed to carry out foreseeable program requirements, it is in the interest of good management to recommend appropriate actions, thereby maintaining a realistic relationship between apportionments, allotments, and obligations ” However, the Forest Service did not develop a directive addressing the control objectives, related risks, and control activities for implementing this USDA policy  Up until fiscal year 2017, Forest Service budgetary resources consisted primarily of no-year funds  At the beginning of each fiscal year, unobligated balances of no-year funds are carried forward and reapportioned to become part of budget authority available for obligation in the new fiscal year  Unobligated balances can increase during the fiscal year due to deobligation of prior years’ unliquidated obligations that the Forest Service determines it no longer needs  These resources are immediately available to the Forest Service to the extent authorized by law without further legislation or action from Office of Management and Budget (OMB) unless the apportionment states otherwise  According to Forest Service officials, unobligated funds reported in the Forest Service’s September 30, 2016, Statement of Budgetary Resources included $351 million in discretionary unobligated no-year funds, appropriated as far back as fiscal year 1999  The Forest Service did not identify and define a process and control objectives related to its review of unobligated no-year funds from prior years for continuing need  As a result, the Forest Service did not have reasonable assurance that prior no-year unobligated balances were properly managed and considered in its annual budget requests  This increased the risk that the Forest Service may make budget requests in excess of its needs  Additionally, the Forest Service could miss opportunities to use its prior year unobligated no-year funds more timely and effectively, for example, using these funds for other Forest Service program needs, if consistent with the purposes designated in appropriations acts  During our work, we brought this issue to management’s attention, and in response, Forest Service officials stated that the Forest Service is planning to develop a quarterly process to review available balances and, as needed, redirect funds to agency priorities  However, as of July 2017, the Forest Service had not yet developed this review process  Further, Congress rescinded about $18 million of the Forest Service’s prior year unobligated balances and required it to report unobligated balances quarterly within 30 days after the close of each quarter and appropriated multi-year funds instead of no- year funds to the Forest Service for fiscal year 2017  The Forest Service issued guidance related to administrative control of funds in manuals and handbooks, which USDA did not review and approve prior to their issuance  Based on our review of these documents, we found that the processes and related control activities over the administrative control of funds were dispersed in numerous manuals and handbooks, which may hamper a clear understanding of the overall system  Further, the system lacked key elements that would allow it to serve as an adequate system of administrative control of funds  For example, in its manuals and handbooks the Forest Service did not identify, by title or office, those officials with the authority and responsibility for obligating the service’s appropriated funds, such as funds for contracts, travel, and training  As a result, the responsibility for obligating funds was not clearly described and properly assigned in Forest Service policy as required by the USDA Budget Manual and OMB Circular No  A-11  OMB Circular No  A-11 states that the Antideficiency Act requires that the agency head prescribe, by regulation, a system of administrative control of funds, and OMB provided a checklist in appendix H to the circular that agencies can use for drafting their fund control regulations  This requirement is consistent with those in the USDA Budget Manual, which prescribes budgetary administration through a system of administrative controls for its component agencies, including the Forest Service  The USDA Budget Manual states that to the extent necessary for effective administration, (1) the heads of USDA component agencies may delegate to subordinate officials responsibilities in connection with the administrative distribution of funds within apportionments and allotments and the monitoring, control, and reporting of the occurrence of obligations and expenditures under apportionments and allotments and (2) the chain of such responsibility shall be clearly defined  In addition, USDA requires its component agencies to promulgate and maintain administrative control of funds regulation and to send such regulation to USDA’s Office of Program and Budget Analysis for review and approval prior to issuance  Because the Forest Service has not developed and issued a comprehensive system for administrative control of funds that considers all aspects of the budget execution processes, it cannot reasonably assure that (1) programs will achieve their intended results; (2) the use of resources is consistent with the agency’s mission; (3) programs and resources are protected from waste, fraud, and mismanagement; and (4) laws and regulations are followed  We also found that the Forest Service had not reviewed and updated most of its administrative control of funds guidance in the manuals and handbooks for over 5 years  The USDA Budget Manual requires each component to periodically review its funds control system for overall effectiveness and to assure that it is consistent with its agency programs and organizational structures  Further, Forest Service policy also requires routine review, every 5 years, of policies and procedures in its Directive System  According to Forest Service officials, when directives are up for review and update, a staff from the Office of Regulatory and Management Services (ORMS) sends an e-mail reminder to notify responsible personnel that updates to applicable directives are needed  However, we found that the Forest Service does not have adequate controls in place to monitor the reviews and any updates of the manuals and handbooks in its Directive System to reasonably assure that their efforts resulted in timely updates  As a result, the Forest Service is at risk that guidance for its system for administrative control of funds may lose relevance as processes change over time and control activities may become inadequate  The Forest Service did not have properly designed control activities over its process for fund transfers related to wildland fire suppression activities  The Forest Service receives appropriations for necessary expenses for (1) fire suppression activities on National Forest System lands, (2) emergency fire suppression on or adjacent to such lands or other lands under fire protection agreement, (3) hazardous fuels management on or adjacent to such lands, and (4) state and volunteer fire assistance  Transfer of funds from other Forest Service programs to its fire suppression activities occurs when the Forest Service has exhausted all available funds appropriated for the purpose of fire suppression and the FLAME fund  A key aspect of this process is assessing the FLAME forecast, which the Forest Service uses to predict the costs of fighting wildland fires for a given season, and developing a strategy to identify specific programs and the amounts that may be transferred to pay for fire suppression activities when needed  The process for reviewing the FLAME forecast and strategizing the fund transfers was documented in the Basic Budget Desk Guide created by staff in the Forest Service’s Strategic Planning and Budget Analysis Office  However, the desk guide did not contain evidence of review by responsible officials  As a result, the Forest Service lacked reasonable assurance that the desk guide was complete and appropriate for its use  The Basic Budget Desk Guide included a listing of actions to be performed by the analyst for reviewing the FLAME forecast report and developing a strategy for fund transfer from other programs  However, the desk guide did not specify the factors to be considered when developing the strategy  For example, it did not call for documentation addressing the rationale for the strategy or an assessment of the risk that the fund transfer could have on the programs from which the funds would be transferred  The desk guide also did not describe the review and approval of the strategy by a responsible official(s) prior to the fund transfer request sent to the Chief of the Forest Service  According to Standards for Internal Control in the Federal Government, management should design control activities to achieve objectives and respond to risks and that such control activities should be designed at the appropriate levels in the organizational structure  Further, management may design a variety of transaction control activities for operational processes, which may include verifications, authorizations and approvals, and supervisory control activities  The lack of properly designed control activities for supervisory review of the desk guide and strategy to identify the amounts for fund transfers does not provide the Forest Service reasonable assurance that the objectives of the fund transfers—including mitigating the risk of a shortfall of funding for other critical Forest Service program activities, such as payroll or other day-to-day operating costs—will be efficiently and effectively achieved  The Forest Service enters into various reimbursable agreements with agencies within USDA, other federal agencies, state and local government agencies, and nongovernment entities to carry out its mission for public benefit  The reimbursable agreements may be for the Forest Service to provide goods and services to a third party or to receive goods and services from a third party, or may be a partnership agreement with a third party for a common goal  According to Forest Service officials, the two distinct types of Forest Service reimbursable agreements are (1) fire incident cooperative agreements and (2) reimbursable and advanced collection agreements (RACA)  The Forest Service did not have documented processes and related control activities for its fire incident cooperative agreements to reasonably assure the effectiveness and efficiency of its related fire incident operations  In addition, processes and related control activities applicable to RACAs were not adequately described in applicable manuals and handbooks in the Directive System, to reasonably assure that control activities could be performed consistently and effectively  Further, certain RACA processes in the Directive System had not been timely reviewed by management and did not reflect current processes  Moreover, as previously discussed, SOPs and desk guides developed in field offices related to RACA processes were not in the Forest Service’s Directive System  Finally, the Forest Service lacked control activities segregating incompatible duties performed by line officers and program managers in creating reimbursable agreements and the final disposition of related receivables  The Forest Service did not have documented processes and related control activities for its fire incident cooperative agreements to reasonably assure the effectiveness and efficiency of its related fire incident operations and reliable reporting internally and externally  As part of the service’s mission objective to suppress wildland fires, Forest Service officials stated that they enter into 5-year agreements referred to as master cooperative agreements with federal, state, and other entities  These agreements document the framework for commitment and support efficient and effective coordination and cooperation among the parties in suppressing fires, when they occur  The master cooperative agreements do not require specific funding commitments as amounts are not yet known  These agreements vary from region to region because of the differing laws and regulations pertaining to the participating states and other entities  These variations can also result in different billing and collection processes between regions  When a fire occurs, supplemental agreements, which are based on the framework established in the applicable master cooperative agreements, are signed by relevant parties for each fire incident  These agreements establish the share of fire suppression costs incurred by the Forest Service and amounts related to entities that benefitted from those fire suppression efforts  These supplemental agreements require commitment and obligation of funds  As indicated in figure 2, the Forest Service’s obligations for fire suppression activities ranged from $412 million to $1 4 billion over the 10-year period from fiscal years 2007 through 2016  In response to our request for documentation of processes and related control activities over its fire incident cooperative agreements, Forest Service officials stated that processes and related control activities over reimbursable agreements were applicable to both fire incident cooperative agreements and RACAs  However, based on our review of the Forest Service’s processes and related control activities over its reimbursable agreements, we found that the unique features of fire incident cooperative agreements (as compared to features of RACAs) were not addressed in the processes and related controls for reimbursable agreements  For example, there was no process and related control activities over the negotiation and review of (1) a fire incident master cooperative agreement, which is developed before a fire occurs, and (2) supplemental agreements, which are signed by all relevant parties after the start of a fire incident  These supplemental agreements detail, among other things, the terms for (1) fire department resource use, (2) financial arrangements, and (3) specific cost-sharing agreements  Another unique feature of fire incident cooperative agreements, which was not covered in process documents for its reimbursable agreements, was the preparation of the Cost Settlement Package  The preparation of this package does not start until after the fire has ended and the Forest Service has received and paid all bills  According to Forest Service officials, a fire incident is deemed to have ended when there are no more resources (firefighters and equipment) on the ground putting out the fire  However, this definition was not documented in the Forest Service’s manuals and handbooks in the Directive System  Based on our review of documentation that the Forest Service provided for four fire incidents, we found that for these incidents the Cost Settlement Packages and the billings took several months to years to complete after the fire incident  According to Forest Service officials, delays in preparing the Cost Settlement Package in many cases were due to parties involved in suppressing the fires taking a long time to submit their invoices to the Forest Service for payment  Because the preparation of Cost Settlement Packages was not included in the process documents, the Forest Service did not have a defined time frame for when, in relation to the end of the fire, the Cost Settlement Package must be completed  For example, in one case we reviewed, the bill for a cost settlement was sent 9 months after the fire occurred, and in another case, settlement occurred approximately 2 years after the fire occurred  For both fire incidents, based on the reports we reviewed, the fires were contained within a week or two, but the Forest Service does not have a policy for documenting the date when the fire incident is deemed to have ended  Because of the complexity of the process for negotiating and determining the reimbursable amounts from all the costs that the Forest Service pays for a fire incident, the reimbursable amounts may take time to negotiate, and subsequent billing to and collection from parties may take much longer  Forest Service officials stated that some receivables that were not going to be collected until after its financial system’s aging process for receivables deemed such receivables uncollectible and a bad debt are tracked in a spreadsheet outside its financial system  We found that the Forest Service did not have a documented process and related control activities to reasonably assure that its Budget Office was informed of these older receivables being tracked in a spreadsheet and the related progress of collection activities that local program managers and line officers perform, which could affect the reliability of the reported reimbursable receivable amounts  According to Standards for Internal Control in the Federal Government, management should internally communicate the necessary quality information to achieve the entity’s objectives  Without proper communication, important information, such as amounts that the Forest Service will receive from fire incident cost settlement negotiations, may not be considered in the Forest Service’s strategy for the effective and efficient management of fund transfers for fire suppression activities  Processes and related control activities applicable to RACAs were not adequately described in Forest Service manuals and handbooks in its Directive System  RACAs, which may be for research or other nonemergency purposes, are billed and collected based on previously agreed upon billing and collection terms  In accordance with the Forest Service’s Directive System, policies related to business processes, such as RACAs, are documented in its manuals while procedures for performing specialized activities are documented in its handbooks  We found that the manuals and handbooks in the Directive System did not adequately describe the processes and related control activities over the RACA processes to enable efficient and effective performance of the work by appropriate and responsible personnel  The manuals and handbooks related to RACAs state that a manager review the documentation to ensure that the funding supports the objective of the agreement, the agreement is the correct instrument for funding the project, all relevant terms and conditions have been included in the agreement, the entity’s financial strength and capability are acceptable, and all applicable regulations and OMB circulars have been addressed  However, there was no discussion in the manuals and handbooks about when the manager needs to perform the reviews and how these reviews were to be documented  Further, in response to our inquiry regarding procedures performed to assess the entity’s financial strength and capability are acceptable before a RACA is signed, Forest Service officials stated that there is currently no formal process for determining financial capability for RACAs  For reimbursable agreements, the Forest Service’s process documented in its handbook consisted of completing a creditworthiness checklist  However, the handbook did not describe procedures for (1) completing the checklist and (2) documenting responsible personnel’s review and approval of an entity’s acceptable financial capability  Standards for Internal Control in the Federal Government states that management should design control activities to achieve objectives and respond to risks  Management’s design of internal control establishes and communicates the who, what, when, where, and why of internal control execution to personnel  Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel  Further, the standards also explain that management clearly document internal control in a manner that allows the documentation to be readily available and properly managed and maintained  In addition, the manuals and handbooks applicable to the RACAs have not been timely reviewed by management, and had not been updated to reflect current processes  For example, the document that serves as direction for Forest Service personnel on how to enter into RACAs referred to an outdated financial system that was replaced in fiscal year 2013  Further, the manuals and handbooks for the RACA processes had no indication that they had been reviewed within the past 5 years  Forest Service policy requires routine review, every 5 years, of policies and procedures in its Directive System  According to Forest Service officials, a staff member from ORMS sends an e-mail to officials responsible for updating these policies and procedures  However, appropriate control activities have not been designed to reasonably assure that updates were made, reviewed, approved, and issued as needed for continued relevance and effectiveness  Without adequate descriptions of processes and related control activities in its manuals and handbooks over RACAs, the Forest Service is at risk that processes and related control activities may not be properly, consistently, and timely performed  Further, because it lacks a process and related controls for monitoring and reviewing the updates of the guidance and various process documents in the Directive System, the Forest Service is at risk that its policies and procedures may not provide appropriate agency-wide direction in achieving control objectives, particularly when financial systems change and old processes may no longer be applicable  SOPs and desk guides related to RACA processes were not in the Directive System and are not considered official Forest Service policy and procedures  Forest Service field staff responsible for various processes generally developed SOPs and desk guides to document day-to-day procedures for employees in carrying out RACA processes to supplement the manuals and handbooks  However, the SOPs and desk guides did not reference the applicable manuals and handbooks they supplemented  Further, the SOPs and desk guides did not provide descriptions of (1) review procedures for authorization, completeness, and validity of RACAs and related receivables; (2) detailed review procedures to be performed and by whom; (3) timing of review procedures; and (4) how to document the completion of the review procedures  Finally, SOPs and desk guides did not have evidence that responsible officials reviewed and approved them to authorize their use  These SOPs and desk guides are only available in the field office where these were developed, and if similar SOPs and desk guides were developed in other field offices, control activities and how they are performed could vary  We also noted that these SOPs and desk guides were not timely updated to reflect processes and systems currently in use  For example, there were many instances where the SOPs and desk guides referred to systems that the Forest Service no longer used  Standards for Internal Control in the Federal Government states that management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives  Effective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel  Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel and to achieve the entity’s objectives  Management assigns responsibility and delegates authority to key roles throughout the entity  As a result of the issues discussed above, the Forest Service is at risk that control activities may not be properly and consistently performed and its related control objectives may not be achieved efficiently and effectively  In addition, the Forest Service is at risk that knowledge for performing the control activities may be limited to a few personnel or lost altogether in the event of employee turnover  The Forest Service lacked control activities over the segregation of incompatible duties performed by line officers and program managers for reimbursable agreements and any adjustments affecting the final disposition of related receivables  Field offices manage the majority of Forest Service projects, including authorizing the agreements and monitoring related collection  The Forest Service line officer for fire incident cooperative agreements and program managers for RACA at the RSA, unit, or field levels initiate and develop the terms of the agreements and are also responsible for any subsequent negotiation of the agreements  In the process of negotiating and settling costs, the line officer or program manager has the authority to cancel or change related receivables that they deemed uncollectible  For example, in a fire incident, the line officer at the region or field level is involved in both developing a Cost Share Agreement and after the fire incident has ended, negotiating the Cost Settlement Package with parties involved in the agreement to determine the final settlement amount that the Forest Service will be reimbursed for expenses paid in suppressing the fire incident  Therefore, the line officer is responsible for initiating the Cost Share Agreement, modifying the Cost Settlement Package, and changing or canceling the related receivable, which represent conflicting duties  We also found that the Forest Service did not have any mitigating controls, such as independent approval of any adjustments affecting the final disposition of receivables, to mitigate the risk of these incompatible duties  Standards for Internal Control in the Federal Government states that management should design control activities to achieve objectives and respond to risks  Segregation of duties contributes to the design, implementation, and operating effectiveness of control activities  To achieve segregation of key functions, management can divide responsibilities among different people to reduce the risk of error, misuse, or fraud  This may include separating the responsibilities for authorizing or approving transactions, processing and recording them, and reviewing the transactions so that no one individual controls all key aspects of a transaction or event  Forest Service officials stated they did not consider segregating the conflicting duties related to reimbursable agreements because these line officers and program managers were most familiar with the terms of the agreement and the activities performed  However, a lack of adequate segregation of conflicting duties or proper monitoring and review of conflicting duties for receivables from reimbursable agreements could result in receivables not being collected, and an increased risk of fraud  The Forest Service’s processes and related control activities over review of unliquidated obligations were not properly designed to reasonably assure optimum utilization of funds and were inconsistent with USDA and Forest Service policy  Further, Forest Service manuals and handbooks related to the review of unliquidated obligations did not clearly describe control activities and were not timely reviewed by management  The Forest Service reported unliquidated obligations of approximately $2 6 billion and $2 5 billion in its financial statements as of September 30, 2015, and 2016, respectively  In fiscal year 2016, the Forest Service deobligated about $319 million of its unliquidated obligations from prior years  The Forest Service’s procedures related to the review of unliquidated obligations were not properly designed and were inconsistent with USDA and Forest Service policy  In accordance with USDA Departmental Regulation (Regulation 2230-001) and related Forest Service policy, the Forest Service identifies and reviews unliquidated obligations that have been inactive for at least 12 months to determine whether delivery or performance of goods or services is still expected to occur  Once a determination has been made that an unliquidated obligation can be deobligated, program or procurement personnel are to notify finance personnel, in writing, within 5 days of the determination to process the deobligation  Within 15 days of receipt of the written notification, the unliquidated obligations are to be adjusted in the financial management system  The Forest Service CFO is then to be notified in writing that the deobligation was processed  Within 1 month of the close of each quarter, the Forest Service CFO is to submit to USDA’s Associate CFO for Financial Operations a certification stating that the Forest Service has performed reviews of its unliquidated obligations and taken appropriate actions, such as promptly deobligating an unliquidated obligation that is no longer needed  However, the Forest Service’s quarterly certifications are inconsistent with USDA and Forest Service policy because the months included in each quarterly review do not line up with the months outlined in policy  For example, as shown in table 1, based on policy the certification due on October 31, covers the months July through September  However in practice, the certification that the Forest Service prepared for October 31 covers May through July  As a result, the review and certification for August and September would be delayed an entire quarter  According to Forest Service officials, it takes considerable time to produce accurate unliquidated obligations reports from USDA’s financial system and then distribute them to field offices  Therefore, there is not sufficient time for the field offices to review and deobligate amounts not needed from the unliquidated obligations balances to meet USDA’s certification timing and requirements  However, the Forest Service has not developed other processes and control activities that could help meet USDA and Forest Service policy and reasonably assure that unliquidated obligations are reviewed timely and appropriate actions are taken  As a result, there is an increased risk that the Forest Service may not achieve its control objectives of optimum utilization of funds and timely adjustments of obligated balances  The Forest Service’s process and related control activities over its review of unliquidated obligations and resulting certifications were not adequately described in manuals and handbooks in its Directive System  Further, the manuals and handbooks were not timely reviewed and updated to reflect processes and systems currently in use  In accordance with the Forest Service’s Directive System, policies are documented in its manuals while procedures for performing specialized activities are documented in its handbooks  However, we found that the Forest Service’s processes and related control activities for reviewing unliquidated obligations were not adequately described and documented in such manuals and handbooks  Although parts of the applicable section of the handbook referred to procedures, there were no detailed descriptions of the processes, and only references to objectives of the procedures for reviewing unliquidated obligations were listed  For example, in identifying unliquidated obligations for review, the narrative description of the procedures in the handbook states that the responsible obligating official must review each selected unliquidated obligation to determine whether (1) delivery or performance of goods or services has occurred or is expected to occur and (2) accounting corrections to the obligation data in the accounting system are necessary  The handbook also refers to an unliquidated obligations report listing the unliquidated obligations that must be reviewed  The narrative does not provide any detailed procedures that obligating officials or responsible personnel need to perform, how to perform those procedures, and how those control activities are to be documented  The guidance in the handbook was supplemented by two desk guides  However, the desk guides are outside the Forest Service’s Directive System and, as previously noted, the Directive System is the only place where the Forest Service’s policy and procedures are issued  In addition, these desk guides did not reference the applicable guidance in the Directive System that they were supplementing  Further, the process and related control activities for adjusting unliquidated obligations within 15 days of receipt of written notification, as stated in USDA’s policy, were not described in either the handbooks or the desk guides  Standards for Internal Control in the Federal Government states that management should design control activities to achieve objectives and respond to risks to achieve an effective internal control system  Management’s design of internal control establishes and communicates the who, what, when, where, and why of internal control execution to personnel  Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel  Further, the standards also explain that management clearly document internal control in a manner that allows documentation to be readily available and that documentation be properly managed and maintained  In addition, manuals and handbooks for processes related to review and certification of unliquidated obligations had no evidence that they had been reviewed within the past 5 years for ongoing relevance and effectiveness  According to a Forest Service manual, all service-wide directives, except interim directives, shall be reviewed at least once every 5 years  The Forest Service does not have an effective process in place to monitor the reviews and any updates of the manuals and handbooks in its Directive System  As previously discussed, while ORMS sends an e- mail requesting that the applicable officials review and update the guidance in the manuals and handbooks, there is no follow-up process to help ensure that documents were reviewed and updated as needed  Because the Forest Service’s process and related control activities over its review and certification of unliquidated obligations were not adequately described in its manuals and handbooks, the Forest Service is at risk that its control activities may not reasonably assure that control objectives provide (1) optimum utilization of funds and (2) for unliquidated obligations that are no longer needed to be efficiently and effectively deobligated and made available for other program needs  Adequate processes and related control activities over the Forest Service’s budgetary resources are critical in reasonably assuring that these resources are timely and effectively available for its mission operations, including fire suppression  However, we identified deficiencies in the Forest Service’s processes and related controls over allotments, unobligated no-year funds from prior years, administrative control of funds, fund transfers, reimbursable agreements, and available funds from deobligation of unliquidated obligations  Deficiencies ranged from a lack of processes to control activities that were not properly designed, resulting in an increased risk that Forest Service funds may not be effectively and efficiently monitored and used  In addition, the Forest Service’s manuals and handbooks, which provide the directives for the areas we reviewed, had not been reviewed by management in accordance with the Forest Service’s 5-year review policy  Further, Forest Service staff prepared SOPs and desk guides that documented control activities, but they were not issued as official policy and had not been reviewed and approved by responsible officials  As a result, the Forest Service is at increased risk that the control activities may not be consistently performed across the agency and that the guidance in the SOPs and desk guides may not comply with agency policy in the Directive System  To improve internal controls over the Forest Service’s budget execution processes, we are making the following 11 recommendations: The Chief of the Forest Service should (1) revise its process and (2) design, document, and implement related control activities to reasonably assure that amounts designated in appropriations acts for specific purposes are properly used for the purposes specifically designated  (Recommendation 1) The Chief of the Forest Service should (1) develop a process and (2) design, document, and implement related control activities to reasonably assure that unobligated no-year funds from prior years are reviewed for continuing need  (Recommendation 2) The Chief of the Forest Service should (1) design, document, and implement a comprehensive system for administrative control of funds and (2) submit it for review and approval by USDA before issuance, as required by the USDA Budget Manual  (Recommendation 3) The Chief of the Forest Service should design, document, and implement control activities over the preparation and approval of a fire suppression fund transfers strategy, to specify all appropriate factors to be considered in developing and documenting the strategy, and incorporate these control activities into the Directive System  (Recommendation 4) The Chief of the Forest Service should design, document, and implement processes and related control activities for its fire incident cooperative agreements to reasonably assure efficient and effective operations and timely and reliable reporting of reimbursable receivables related to fire incident cooperative agreements, and incorporate them in the Directive System  (Recommendation 5) The Chief of the Forest Service should update the RACA manuals and handbooks to adequately describe the processes and related control activities applicable to RACAs to reasonably assure that staff will know (1) how and when to perform processes and control activities and (2) how to document their performance  (Recommendation 6) The Chief of the Forest Service should design, document, and implement segregation of duties or mitigating control activities over reimbursable agreements and any adjustments affecting the final disposition of related receivables  (Recommendation 7) The Chief of the Forest Service should modify, document, and implement control activities consistent with USDA and Forest Service policy to reasonably assure that unliquidated obligations are reviewed timely and appropriate actions are taken  (Recommendation 8) The Chief of the Forest Service should adequately describe the processes and related control activities for unliquidated obligations review and certification processes in manuals and handbooks within the Directive System  (Recommendation 9) The Chief of the Forest Service should develop, document, and implement a process and related control activities to reasonably assure that manuals and handbooks for allotments, reimbursable agreements, and review of unliquidated obligations are reviewed and updated every 5 years, consistent with Forest Service policy  (Recommendation 10) The Chief of the Forest Service should develop, document, and implement a process and related control activities to reasonably assure that SOPs and desk guides (1) clearly refer to guidance in the Directive System for allotments, reimbursable agreements, and review of unliquidated obligations and (2) are reviewed and approved by responsible officials prior to use  (Recommendation 11) We provided a draft of this report to USDA for comment  In its comments, reproduced in appendix III, the Forest Service stated that it generally agreed with the report and that it has made significant progress to address the report’s findings  Specifically, the Forest Service stated that its financial policies concerning budget execution have been revised to address our concerns with allotments, unliquidated obligations, commitments, and administrative control of funds as prescribed by OMB Circular No  A-11  Further, the Forest Service stated that it has undertaken an in-depth review of its unliquidated obligations and modified the certification process to comply with the USDA requirement  We are sending copies of this report to the appropriate congressional committees and to the Secretary of Agriculture and the Chief of the Forest Service  In addition, this report is available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-9869 or khana@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff members who made key contributions to this report are listed in appendix IV  Our objectives were to determine the extent to which the Forest Service properly designed control activities over (1) allotments of budgetary resources, its system for administrative control of funds, and any fund transfers between Forest Service appropriations; (2) reimbursables and related collections; and (3) unliquidated obligations  We reviewed the Forest Service’s process documents and control activities, policies and procedures from its manual and handbooks in its Directive System, and other guidance in the form of standard operating procedures (SOP) and desk guides to obtain an understanding of internal controls at the Forest Service related to our three objectives  We reviewed the control activities that the Forest Service identified to determine whether the activities would achieve the control objectives that the service identified and whether the activities were consistent with Standards for Internal Control in the Federal Government  We also reviewed recent relevant GAO and U S  Department of Agriculture (USDA) Office of Inspector General reports to obtain background information related to the Forest Service’s budget execution processes  We evaluated the design of the Forest Service’s control activities based on data for fiscal year 2016  To address our first objective, we reviewed Forest Service process documents related to allotments and budget authority to obtain an understanding of control activities over the allotments of budgetary resources, its system for administrative control of funds, and any related fund transfers between Forest Service appropriations  The process documents included a list of control objectives and related control activities that the Forest Service had used to assess its internal controls  We also reviewed the related guidance in appendix H to Office of Management and Budget Circular No  A-11, Preparation, Submission, and Execution of the Budget for Administrative Control of Funds, to identify requirements that agencies must meet to ascertain whether their controls over funds management are properly designed  We interviewed key officials from the Forest Service’s Strategic Planning, Budget and Accountability Office to gain an understanding of their processes for allotments of budgetary resources, its system for administrative control of funds, and fund transfers between Forest Service appropriations for wildland fire suppression activities, including how each of their risk assessments were performed and their plans to mitigate the risks  We reviewed and analyzed the processes documented in the manuals and handbooks collectively referred to as directives to determine whether the processes and control activities were designed to achieve the Forest Service’s stated objectives  Specifically, we examined the Forest Service’s control activities to determine whether these sufficiently communicated the procedures to be performed and the documentation to be prepared  We also reviewed USDA Budget Manual to determine whether Forest Service guidance was consistent with USDA’s requirements for all of its component agencies, specifically requirements related to the administrative control of funds  To address our second objective, we reviewed the Forest Service’s policies, procedures, and other documentation and interviewed agency officials to develop an understanding of its processes related to reimbursable agreements and related collection activities  We first identified, through interviews with Forest Service officials, the different kinds of reimbursable agreements that the Forest Service enters into with other USDA components, other federal agencies, state and local government agencies, and nongovernment entities to carry out its mission for the benefit of the public  Two distinct types of reimbursable agreements include (1) fire incident cooperative agreements and (2) reimbursable and advanced collection agreements  We reviewed Forest Service process documents and templates related to these two types of reimbursable agreements provided to obtain an understanding of control activities over reimbursable processes  We reviewed the list of control objectives and related control activities that the Forest Service identified to determine whether the control activities were designed to achieve the applicable control objectives  To address our third objective, we reviewed the Forest Service’s policies, procedures, and other documentation related to and interviewed agency officials about unliquidated obligations to develop an understanding of the Forest Service’s review and certification processes for unliquidated obligations balances  We reviewed the Forest Service’s control activities related to its process for reviewing unliquidated obligations to obtain an understanding of control activities around its process and to determine whether the control activities were designed to achieve the applicable control objectives  Based on the results of our evaluation of the Forest Service’s design of internal control activities over the budget execution processes, we did not evaluate the implementation of the control activities or whether they were operating as designed  While our audit objectives focused on certain control activities related to (1) allotments of budgetary resources, the Forest Service’s system for administrative control of funds, and related fund transfers; (2) reimbursables and related collections for reimbursable agreements; and (3) unliquidated obligations, we did not evaluate all control activities and other components of internal control  If we had done so, additional deficiencies may or may not have been identified that could impair the effectiveness of the control activities evaluated as part of this audit  We conducted this performance audit from August 2016 to January 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control  Internal control represents an agency’s plans, methods, policies, and procedures used to fulfill its mission, strategic plan, goals, and objectives  Internal control is a process by an entity’s oversight body, management, and other personnel to provide reasonable assurance that the objectives of the entity will be achieved  When properly designed, implemented, and operating effectively, it provides reasonable assurance that the following objectives are achieved: (1) effectiveness and efficiency of operations, (2) reliability of internal and external reporting, and (3) compliance with applicable laws and regulations  Internal control is not one event, but a series of actions that occur throughout an entity’s operations  The five components of internal control are as follows: Control Environment - The foundation for an internal control system that provides the discipline and structure to help an entity achieve its objectives  Risk Assessment - Assesses the risks facing the entity as it seeks to achieve its objectives and provides the basis for developing appropriate risk responses  Control Activities - The actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system  Information and Communication - The quality information management and personnel communicate and use to support the internal control system  Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews  An effective internal control system has each of the five components of internal control effectively designed, implemented, and operating with the components operating together in an integrated manner  In this audit, we assessed the design of control activities at the Forest Service related to its (1) allotments of budgetary resources and any related fund transfers between Forest Service appropriations, (2) reimbursables and related collections, and (3) review of unliquidated obligations  In addition to the contact named above, the following individuals made key contributions to this report: Roger Stoltz (Assistant Director), Meafelia P  Gusukuma (Auditor-in-Charge), Tulsi Bhojwani, Cory Mazer, Sabrina Rivera, and Randy Voorhees 


Report 2:  Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems  GAO-16-501  Washington, D C : May 18, 2016  Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy  GAO-16-267  Washington, D C : May 16, 2016  Smartphone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking  GAO-16-317  Washington, D C : May 9, 2016  Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack  GAO-16-350  Washington, D C : April 25, 2016  Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents  GAO-16-332  Washington, D C : April 4, 2016  Healthcare gov: Actions Needed to Enhance Information Security and Privacy Controls  GAO-16-265  Washington, D C : March 23, 2016  Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System  GAO-16-294  Washington, D C : January 28, 2016  Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress  GAO-16-79  Washington, D C : November 19, 2015  Critical Infrastructure Protection: Cybersecurity of the Nation’s Electricity Grid Requires Continued Attention  GAO-16-174T  Washington, D C : October 21, 2015  Maritime Critical Infrastructure Protection: DHS Needs to Enhance Efforts to Address Port Cybersecurity  GAO-16-116T  Washington, D C : October 8, 2015  Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented  GAO-13-187  Washington, D C : February 14, 2014  Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace  GAO-13-663  Washington, D C : September 25, 2013  Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information  GAO-08-536  Washington, D C : May 19, 2008  Federal law and policy call for a risk-based approach to managing cybersecurity within the government, as well as globally  We have previously reported that the federal government has faced challenges in establishing a comprehensive strategy to provide a framework for how the United States will engage both domestically and internationally on cybersecurity related matters  More specifically, in February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector; however, no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy including, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  In response to our recommendation, in October 2015, the Director of OMB and the Federal Chief Information Officer, issued a Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government  The plan directed a series of actions to improve capabilities for identifying and detecting vulnerabilities and threats, enhance protections of government assets and information, and further develop robust response and recovery capabilities to ensure readiness and resilience when incidents inevitably occur  The plan also identified key milestones for major activities, resources needed to accomplish milestones, and specific roles and responsibilities of federal organizations related to the strategy’s milestones  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  Table 1 identifies these recent efforts and a description of their related contents  These efforts provide a good foundation toward establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of a national strategy that we recommended  The recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  Specifically: Milestones and performance measures to gauge results were generally not included in strategy documents  For example, although the DHS Cybersecurity Strategy stated that its implementation would be assessed on an annual basis, it did not describe the milestones and performance measures for tracking the effectiveness of the activities intended to meet the stated goals (e g , protecting critical infrastructure and responding effectively to cyber incidents)  Without such performance measures, DHS will lack a means to ensure that the goals and objectives discussed in the document are accomplished and that responsible parties are held accountable  According to officials from DHS’s Office of Cybersecurity and Communications, the department is developing a plan for implementing the DHS Cybersecurity Strategy and expects to issue the plan by the end of calendar year 2018  The officials stated that the plan is expected to identify milestones, roles, and responsibilities across DHS to inform the prioritization of future efforts  The strategy documents generally did not include information regarding the resources needed to carry out the goals and objectives  For example, although the DHS Cybersecurity Strategy identified a variety of actions the agency planned to take to perform their cybersecurity mission, it did not articulate the resources needed to carry out these actions and requirements  Without information on the specific resources needed, federal agencies may not be positioned to allocate such resources and investments and, therefore, may be hindered in their ability meet national priorities  Most of the strategy documents lacked clearly defined roles and responsibilities for key agencies, such as DHS, DOD, and OMB  These agencies contribute substantially to the nation’s cybersecurity programs  For example, although the National Security Strategy discusses multiple priority actions needed to address the nation’s cybersecurity challenges (e g , building defensible government networks, and deterring and disrupting malicious cyber actors), it does not describe the roles, responsibilities, or the expected coordination of any specific federal agencies, including DHS, DOD, or OMB, or other non-federal entities needed to carry out those actions  Without this information, the federal government may not be able foster effective coordination, particularly where there is overlap in responsibilities, or hold agencies accountable for carrying out planned activities  Ultimately, a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  The exploitation of information technology (IT) products and services through the supply chain is an emerging threat  IT supply chain-related threats can be introduced in the manufacturing, assembly, and distribution of hardware, software, and services  Moreover, these threats can appear at each phase of the system development life cycle, when an agency initiates, develops, implements, maintains, and disposes of an information system  As a result, the compromise of an agency’s IT supply chain can degrade the confidentiality, integrity, and availability of its critical and sensitive networks, IT-enabled equipment, and data  Federal regulation and guidance issued by the National Institute of Standards and Technology (NIST) set requirements and best practices for mitigating supply chain risks  The Federal Acquisition Regulation established codification and publication of uniform policies and procedures for acquisition by all executive branch agencies  Agencies are required by the Federal Acquisition Regulation to ensure that contracts include quality requirements that are determined necessary to protect the government’s interest  In addition, the NIST guidance on supply chain risk management practices for federal information systems and organizations intends to assist federal agencies with identifying, assessing, and mitigating information and communications technology supply chain risks at all levels of their organizations  We have previously reported on risks to the IT supply chain and risks originating from foreign-manufactured equipment  For example: In July 2018, we testified that if global IT supply chain risks are realized, they could jeopardize the confidentiality, integrity, and availability of federal information systems  Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees  We further stated that in 2012 we determined that four national security-related agencies—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks  We recommended that three agencies take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk  The agencies generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation  In July 2017, we reported that, based on a review of a sample of organizations within the Department of State’s telecommunications supply chain, we were able to identify instances in which device manufacturers, software developers and contractor support were reported to be headquartered in a leading cyber-threat nation  For example, of the 52 telecommunications device manufacturers and software developers in our sample, we were able to identify 12 that had 1 or more suppliers that were reported to be headquartered in a leading cyber-threat nation  We noted that the reliance on complex, global IT supply chains introduces multiple risks to federal agencies, including insertion of counterfeits, tampering, or installation of malicious software or hardware  Figure 5 illustrates possible manufacturing locations of typical network components  Although federal agencies have taken steps to address IT supply chain deficiencies that we previously identified, this area continues to be a potential threat vector for malicious actors to target the federal government  For example, in September 2017, DHS issued a binding operating directive which calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems and to develop detailed plans to remove and discontinue present and future use of the products  DHS expressed concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks  On May 11, 2017, the President issued an executive order on strengthening the cybersecurity of federal networks and critical infrastructure  The order makes it the policy of the United States to support the growth and sustainment of a workforce that is skilled in cybersecurity and related fields as the foundation for achieving our objectives in cyberspace  It directed the Secretaries of Commerce and Homeland Security (DHS), in consultation with other federal agencies, to assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity- related education curricula, training, and apprenticeship programs, from primary through higher education  Nevertheless, the federal government continues to face challenges in addressing the nation’s cybersecurity workforce  Agencies had not effectively conducted baseline assessments of their cybersecurity workforce or fully developed procedures for coding positions  In June 2018, we reported that 21 of the 24 agencies covered by the Chief Financial Officer’s Act had conducted and submitted to Congress a baseline assessment identifying the extent to which their cybersecurity employees held professional certifications, as required by the Federal Cybersecurity Workforce Assessment Act of 2015  However, we found that the results of these assessments may not have been reliable because agencies did not address all of the reportable information and agencies were limited in their ability to obtain complete and consistent information about their cybersecurity employees and the certifications they held  We determined that this was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions  Further, 23 of the agencies reviewed had established procedures for identifying and assigning the appropriate employment codes to their civilian cybersecurity positions, as called for by the act  However, 6 of the 23 did not address one or more of 7 activities required by OPM in their procedures, such as reviewing all filled and vacant positions and annotating reviewed position descriptions with the appropriate employment code  Accordingly, we made 30 recommendations to 13 agencies to fully implement two of the act’s requirements on baseline assessments and coding procedures  The extent to which these agencies agreed with the recommendations varied  DHS and the Department of Defense (DOD) had not addressed cybersecurity workforce management requirements set forth in federal laws  In February 2018, we reported that, while DHS had taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014, its actions were not timely and complete  For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities  Further, DHS had not yet completed its efforts to identify all of its cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions  Table 2 shows DHS’s progress in implementing the requirements of the Homeland Security Cybersecurity Workforce Assessment Act of 2014, as of December 2017  Accordingly, we recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed  DHS agreed with our six recommendations, but had not implemented them as of August 2018  Regarding DOD, in November 2017, we reported that instead of developing a comprehensive plan for U S  Cyber Command, the department submitted a report consisting of a collection of documents that did not fully address the required six elements set forth in Section 1648 of the National Defense Authorization Act for Fiscal Year 2016  More specifically, DOD’s 1648 report did not address an element related to cyber incident training  In addition to not addressing the training element in the report, DOD had not ensured that staff were trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD’s Significant Cyber Incident Coordination Procedures  Accordingly, we made two recommendations to DOD to address these issues  DOD agreed with one of the recommendations and partially agreed with the other, citing ongoing activities related to cyber incident coordination training it believed were sufficient  However, we continued to believe the recommendation was warranted  As of August 2018, both recommendations had not yet been implemented  Agencies had not identified and closed cybersecurity skills gaps  In November 2016, we reported that five selected agencies had made mixed progress in assessing their information technology (IT) skill gaps  These agencies had started focusing on identifying cybersecurity staffing gaps, but more work remained in assessing competency gaps and in broadening the focus to include the entire IT community  Accordingly, we made a total of five recommendations to the agencies to address these issues  Four agencies agreed and one, DOD, partially agreed with our recommendations citing progress made in improving its IT workforce planning  However, we continued to believe our recommendation was warranted  As of August 2018, all five of the recommendations had not been implemented  Agencies had been challenged with recruiting and retaining qualified staff  In August 2016, we reported on the current authorities chief information security officers (CISO) at 24 agencies  Among other things, CISOs identified key challenges they faced in fulfilling their responsibilities  Several of these challenges were related to the cybersecurity workforce, such as not having enough personnel to oversee the implementation of the number and scope of security requirements  In addition, CISOs stated that they were not able to offer salaries that were competitive with the private sector for candidates with high-demand technical skills  Furthermore, CISOs stated that certain security personnel lacked the skill sets needed or were not sufficiently trained  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to the Office of Management and Budget (OMB) and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Agencies have had difficulty navigating the federal hiring process  In August 2016, we reported on the extent to which federal hiring authorities were meeting agency needs  Although competitive hiring has been the traditional method of hiring, agencies can use additional hiring authorities to expedite the hiring process or achieve certain public policy goals  Among other things, we noted that agencies rely on a relatively small number of hiring authorities (as established by law, executive order, or regulation) to fill the vast majority of hires into the federal civil service  Further, while OPM collects a variety of data to assess the federal hiring process, neither it nor agencies used this information to assess the effectiveness of hiring authorities  Conducting such assessments would be a critical first step in making more strategic use of the available hiring authorities to more effectively meet their hiring needs  Accordingly, we made three recommendations to OPM to work with agencies to strengthen hiring efforts  OPM generally agreed with the recommendations; however, as of August 2018, two of them had not been implemented  The emergence of new technologies can potentially introduce security vulnerabilities for those technologies which were previous unknown  As we have previously reported, additional processes and controls will need to be developed to potentially address these new vulnerabilities  While some progress has been made to address the security and privacy issues associated with these technologies, such as the Internet of Things (IoT) and vehicle networks, there is still much work to be done  For example: IoT devices that continuously collect and process information are potentially vulnerable to cyber-attacks  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as fitness trackers, cameras, and thermostats)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  For example, IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack  Table 3 provides examples of cyber- attacks that could affect IoT devices and networks  IoT devices may increase the security risks to federal agencies  In July 2017, we reported that IoT devices, such as those acquired and used by Department of Defense (DOD) employees or that DOD itself acquires (e g , smartphones), may increase the security risks to the department  We noted that these risks can be divided into two categories, risks with the devices themselves, such as limited encryption, and risks with how they are used, such as unauthorized communication of information  The department has also identified notional threat scenarios, based on input from multiple DOD entities, which exemplify how these security risks could adversely impact DOD operations, equipment, or personnel  Figure 6 highlights a few examples of these scenarios  In addition, we reported that DOD had started to examine the security risks of IoT devices, but that the department had not conducted required assessments related to the security of its operations  Further, DOD had issued policies and guidance for these devices, but these did not clearly address all of the risks relating to these devices  To address these issues, we made two recommendations to DOD  The department agreed with our recommendations; however, as of August 2018, they had not yet been implemented  Vehicles are potentially susceptible to cyber-attack through networks, such as Bluetooth  In March 2016, we reported that many stakeholders in the automotive industry acknowledge that in-vehicle networks pose a threat to the safety of the driver, as an external attacker could gain control to critical systems in the car  Further, these industry stakeholders agreed that critical systems and other vehicle systems, such as a Bluetooth connection, should be separate in-vehicle networks so they could not communicate or interfere with one another  Figure 7 identifies the key interfaces that could be exploited in a vehicle cyber-attack  To enhance the Department of Transportation’s ability to effectively respond in the event of a real-world vehicle cyberattack, we made one recommendation to the department to better define its roles and responsibilities  The department agreed with the recommendation but, as of August 2018, had not yet taken action to implement it  Artificial intelligence holds substantial promise for improving cybersecurity, but also posed new risks  In March 2018, we reported on the results of a forum we convened to discuss emerging opportunities, challenges, and implications associated with artificial intelligence  At the forum, participants from industry, government, academia, and nonprofit organizations discussed the potential implications of this emerging technology, including assisting with cybersecurity by helping to identify and patch vulnerabilities and defending against attacks; creating safer automated vehicles; improving the criminal justice system’s allocation of resources; and improving how financial services govern investments  However, forum participants also highlighted a number of challenges and risks related to artificial intelligence  For example, if the data used by artificial intelligence are biased or become corrupted by hackers, the results could be biased or cause harm  Moreover, the collection and sharing of data needed to train artificial intelligence systems, a lack of access to computing resources, and adequate human capital were also challenges facing the development of artificial intelligence  Finally, forum participants noted that the widespread adoption raises questions about the adequacy of current laws and regulations  Cryptocurrencies provide an alternative to traditional government-issued currencies, but have security implications  In February 2018, we reported on trends affecting government and society, including the increased use of cryptocurrencies—digital representations of value that are not government-issued—that operate online and verify transactions using a public ledger called blockchain  We highlighted the potential benefits of this technology, such as anonymity and lower transaction costs, as well as drawbacks, including making it harder to detect money laundering and other financial crimes  Because of these capabilities and others, we noted the potential for virtual currencies and blockchain technology to reshape financial services and affect the security of critical financial infrastructures  Lastly, we pointed out that the use of blockchain technology could have more security vulnerabilities as computing power increases as a result of new advancements in quantum computing, an area of quantum information science  In January 2008, the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23  The directive established the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks  Under the initiative, the Department of Homeland Security (DHS) was to lead several projects to better secure civilian federal government networks  Specifically, the agency established the National Cybersecurity and Communications Integration Center (NCCIC), which functions as the 24/7 cyber monitoring, incident response, and management center  Figure 8 depicts the Watch Floor, which functions as a national focal point of cyber and communications incident integration  The United States Computer Emergency Readiness Team (US-CERT), one of several subcomponents of the NCCIC, is responsible for operating the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to entities across the federal government  Although DHS is fulfilling its statutorily required mission by establishing the NCCIC and managing the operation of NCPS, we have identified challenges in the agency’s efforts to manage these programs: DHS had not ensured that NCPS has fully satisfied all intended system objectives  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  DHS had been challenged in measuring how the NCCIC was performing its functions in accordance with mandated implementing principles  In February 2017, we reported instances where, with certain products and services, NCCIC had implemented its functions in adherence with one or more of its principles, as required by the National Cybersecurity Protection Act of 2014 and Cybersecurity Act of 2015  For example, consistent with the principle that it seek and receive appropriate consideration from industry sector-specific, academic, and national laboratory expertise, NCCIC coordinated with contacts from industry, academia, and the national laboratories to develop and disseminate vulnerability alerts  However, we also identified instances where the cybersecurity functions were not performed in adherence with the principles  For example, NCCIC is to provide timely technical assistance, risk management support, and incident response capabilities to federal and nonfederal entities, but it had not established measures or other procedures for ensuring the timeliness of these assessments  Further, we reported that NCCIC faces impediments to performing its cybersecurity functions more efficiently, such as tracking security incidents and working across multiple network platforms  Accordingly, we made nine recommendations to DHS related to implementing the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015  The department agreed with our recommendations and has taken action to address two of them  However, as of August 2018, the remaining seven recommendations had not been implemented  The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies in the executive branch to develop, document, and implement an information security program and evaluate it for effectiveness  The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002  These agency programs should include periodic risk assessments; information security policies and procedures; plans for protecting the security of networks, facilities, and systems; security awareness training; security control assessments; incident response procedures; a remedial action process, and continuity plans and procedures  In addition, Executive Order 13800 states that the President will hold agency heads accountable for managing cybersecurity risk to their enterprises  In addition, according to the order, it is the policy of the United States to manage cybersecurity risk as an executive branch enterprise because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security  Over the past several years, we have performed numerous security control audits to determine how well agencies are managing information security risk to federal information systems and data through the implementation of effective security controls  These audits have resulted in the identification of hundreds of deficiencies related to agencies’ implementation of effective security controls  Accordingly, we provided agencies with limited official use only reports identifying technical security control deficiencies for their respective agency  In these reports, we made hundreds of recommendations related to improving agencies’ implementation of those security control deficiencies  In addition to systems and networks maintained by federal agencies, it is also important that agencies ensure the security of federal information systems operated by third party providers, including cloud service providers  Cloud computing is a means for delivering computing services via information technology networks  Since 2009, the government has encouraged agencies to use cloud-based services to store and process data as a cost-savings measure  In this regard, the Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services  FedRAMP is intended to ensure that cloud computing services have adequate information security, eliminate duplicative efforts, and reduce costs  Although there are requirements and government-wide programs to assist with ensuring the security of federal information systems maintained by federal agencies and third party providers, we have identified weaknesses in agencies’ implementation of information security programs  Federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices  In September 2017, we reported that most of the 24 agencies covered by the Chief Financial Officers (CFO) Act had weaknesses in each of the five major categories of information system controls (i e , access controls, configuration management controls, segregation of duties, contingency planning, and agency-wide security management)  Weaknesses in these security controls indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016  Figure 9 identifies the number of agencies with information security weaknesses in each of the five categories  In addition, we found that several agencies had not effectively implemented some aspects of its information security program, which resulted in weaknesses in these agencies’ security controls  In July 2017, we reported that the Security Exchange Commission did not always keep system security plans complete and accurate or fully implement continuous monitoring, as required by agency policy  We made two recommendations to the Security Exchange Commission to effectively manage its information security program  The agency agreed with our recommendations; however, as of August 2018, they had not been implemented  In another July 2017 report, we noted that the Internal Revenue Service (IRS) did not effectively support a risk-based decision to accept system deficiencies; fully develop, document, or update information security policies and procedures; update system security plans to reflect changes to the operating environment; perform effective tests and evaluations of policies, procedures, and controls; or address shortcomings in the agency’s remedial process  Accordingly, we made 10 recommendations to IRS to more effectively implement security-related policies and plans  The agency neither agreed nor disagreed with the recommendations; as of August 2018, all 10 recommendations had not been implemented  In May 2017, we reported that the Federal Deposit Insurance Corporation did not include all necessary information in procedures for granting access to a key financial application; fully address its Inspector General findings that security control assessments of outsourced service providers had not been completed in a timely manner; fully address key previously identified weaknesses related to establishing agency-wide configuration baselines and monitoring changes to critical server files; or complete actions to address the Inspector General’s finding that the Federal Deposit Insurance Corporation had not ensured that major security incidents are identified and reported in a timely manner  We made one recommendation to the agency to more fully implement its information security program  The agency agreed with our recommendation and has taken steps to implement it  In August 2016, we reported that the Food and Drug Administration did not fully implement certain security practices involved with assessing risks to systems; complete or review security policies and procedures in a timely manner; complete and review system security plans annually; always track and fully train users with significant security responsibilities; fully test controls or monitor them; remediate identified security weaknesses in a timely fashion based on risk; or fully implement elements of its incident response program  Accordingly, we issued 15 recommendations to the Food and Drug Administration to fully implement its agency-wide information security program  The agency agreed with our recommendations  As of August 2018, all 15 recommendations had been implemented  In May 2016, we reported that a key reason for the information security weaknesses in selected high-impact systems at four agencies—National Aeronautics and Space Administration, Nuclear Regulatory Commission, the Office of Personnel Management, and Department of Veterans Affairs—was that they had not effectively implemented elements of their information security programs  For example, most of the selected agencies had conducted information security control assessments for systems, but not all assessments were comprehensive  We also reported that remedial action plans developed by the agencies did not include all the required elements, and not all agencies had developed a continuous monitoring strategy  Table 4 identifies the extent to which the selected agencies implemented key aspects of their information security programs  Accordingly, we made 19 recommendations to the four selected agencies to correct these weaknesses  Agency responses to the recommendations varied  Further, as of August 2018, 16 of the 19 recommendations had not been implemented  DOD’s monitoring of progress in implementing cyber strategies varied  In August 2017, we reported that the DOD’s progress in implementing key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, DOD Cyber Strategy, and DOD Cybersecurity Campaign—has varied  More specifically, we determined that the department had implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy and had made progress in implementing the DOD Cyber Strategy and DOD Cybersecurity Campaign  However, the department’s process for monitoring implementation of the DOD Cyber Strategy had resulted in the closure of tasks as implemented before the tasks were fully implemented  In addition, the DOD Cybersecurity Campaign lacked time frames for completion and a process to monitor progress, which together provide accountability to ensure implementation  We made two recommendations to improve DOD’s process of ensuring its cyber strategies are effectively implemented  The department partially concurred with these recommendations and identified actions it planned to take to address them  We noted that, if implemented, the actions would satisfy the intent of our recommendations  However, as of August 2018, DOD had not yet implemented our recommendations  Agencies had not fully defined the role of their Chief Information Security Officers (CISO), as required by FISMA  In August 2016, we reported that 13 of 24 agencies covered by the CFO Act had not fully defined the role of their CISO  For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place  Thus, we determined that the CISOs’ ability to effectively oversee these agencies’ information security activities can be limited  To assist CISOs in carrying out their responsibilities and better define their roles, we made a total of 34 recommendations to OMB and 13 agencies in our review  Agency responses to the recommendations varied; as of August 2018, 18 of the 34 recommendations had not been implemented  Presidential Policy Directive-41 sets forth principles governing the federal government’s response to any cyber incident, whether involving government or private sector entities  According to the directive, federal agencies shall undertake three concurrent lines of effort when responding to any cyber incident: threat response; asset response; and intelligence support and related activities  In addition, when a federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce  We have reviewed federal agencies’ preparation and response to cyber incidents and have identified the following weaknesses: The Office of Personnel Management (OPM) had not fully implemented controls to address deficiencies identified as a result of a cyber incident  In August 2017, we reported that OPM did not fully implement the 19 recommendations made by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT) after the data breaches in 2015  Specifically, we noted that, after breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy  In doing so, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches  In our August 2017 report, we determined that OPM had fully implemented 11 of the 19 recommendations  For the remaining 8 recommendations, actions for 4 were still in progress  For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed  Further, OPM had not validated actions taken to address the recommendations in a timely manner  As a result of our review, we made five other recommendations to OPM to improve its response to cyber incidents  The agency agreed with four of these and partially concurred with the one related to validating its corrective action  The agency did not cite a reason for its partial concurrence and we continued to believe that the recommendation was warranted  As of August 2018, three of the five recommendations had not been implemented  The Department of Defense (DOD) had not identified the National Guard’s cyber capabilities (e g , computer network defense teams) or addressed challenges in its exercises  In September 2016, we reported that DOD had not identified the National Guard’s cyber capabilities or addressed challenges in its exercises  Specifically, DOD had not identified and did not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident because the department has not maintained a database that identifies National Guard cyber capabilities, as required by the National Defense Authorization Act for Fiscal Year 2007  In addition, we identified three types of challenges with DOD’s cyber exercises that could limit the extent to which DOD is prepared to support civilian authorities in a cyber incident: limited access because of classified exercise environments; limited inclusion of other federal agencies and critical infrastructure owners; and inadequate incorporation of joint physical-cyber scenarios  In our September 2016 report, we noted that DOD had not addressed these challenges  Furthermore, we stated that DOD had not addressed its goals by conducting a “tier 1” exercise (i e , an exercise involving national-level organizations and combatant commanders and staff in highly complex environments), as stated in the DOD Cyber Strategy  Accordingly, we recommended that DOD (1) maintain a database that identifies National Guard cyber capabilities and (2) conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects  The department partially agreed with our recommendations, stating that its current mechanisms and exercises are sufficient to address the issues highlighted in our report  However, we continued to believe the recommendations were valid  As of August 2018, our two recommendations had not been implemented  DOD had not identified, clarified, or implemented all components of its incident response program  In April 2016, we also reported that DOD had not clarified its roles and responsibilities for defense support of civil authorities during cyber incidents  Specifically, we found that DOD’s overarching guidance about how it is to support civil authorities as part of its Defense Support of Civil Authorities mission did not clearly define the roles and responsibilities of key DOD entities, such as DOD components, the supported command, or the dual-status commander, if they are requested to support civil authorities in a cyber incident  Further, we found that, in some cases, DOD guidance provides specific details on other types of Defense Support of Civil Authorities-related responses, such as assigning roles and responsibilities for fire or emergency services support and medical support, but does not provide the same level of detail or assign roles and responsibilities for cyber support  Accordingly, we recommended that DOD issue or update guidance that clarifies DOD roles and responsibilities to support civil authorities in a domestic cyber incident  DOD concurred with the recommendation and stated that the department will issue or update guidance  However, as of August 2018, the department had not implemented our recommendation  DHS’s NCPS had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information  In January 2016, we reported that NCPS had a limited ability to detect intrusions across all types of network types  In addition, we reported that the system’s intrusion prevention capability was limited and its information-sharing capability was not fully developed  Furthermore, we reported that DHS’s current metrics did not comprehensively measure the effectiveness of NCPS  Accordingly, we made nine recommendations to DHS to address these issues and others  The department agreed with our recommendations and has taken action to address one of them  However, as of August 2018, eight of these recommendations had not been implemented  The nation’s critical infrastructure include both public and private systems vital to national security and other efforts including providing the essential services, such as banking, water, and electricity—that underpin American society  The cyber threat to critical infrastructure continues to grow and represents a national security challenge  To address this cyber risk, the President issued Executive Order 13636 in February 2013 to enhance the security and resilience of the nation’s critical infrastructure and maintain a cyber environment that promotes safety, security, and privacy  In accordance with requirements in the executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure  This process, which involved stakeholders from the public and private sectors, resulted in NIST’s Framework for Improving Critical Infrastructure Cybersecurity  The framework is to provide a flexible and risk-based approach for entities within the nation’s 16 critical infrastructure sectors to protect their vital assets from cyber-based threats  Since then, progress has been made to protect the critical infrastructure of the nation but we have reported that challenges to ensure the safety and security of our infrastructure exist  The Department of Homeland Security (DHS) had not measured the impact of its efforts to support cyber risk reduction for high- risk chemical sector entities  In August 2018, we reported that DHS had strengthened its processes for identifying high-risk chemical facilities and assigning them to tiers under its Chemical Facility Anti- Terrorism Standards program  However, we found that DHS’s new performance measure methodology did not measure reduction in vulnerability at a facility resulting from the implementation and verification of planned security measures during the compliance inspection process  We concluded that doing so would provide DHS an opportunity to begin assessing how vulnerability is reduced—and by extension, risk lowered—not only for individual high-risk facilities but for the Chemical Facility Anti-Terrorism Standards program as a whole  We also determined that, although DHS shares some Chemical Facility Anti-Terrorism Standards program information, first responders and emergency planners may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities  This was due to first responders at the local level not having access or widely using a secure interface that DHS developed (known as the Infrastructure Protection Gateway) to obtain information about high-risk facilities and the specific chemicals they process  To address the weaknesses we identified, we recommended that DHS take actions to (1) measure reduction in vulnerability of high-risk facilities and use that data to assess program performance, and (2) encourage access to and wider use of the Infrastructure Protection Gateway among first responders and emergency planners  DHS concurred with both recommendations and outlined efforts underway or planned to address them  The federal government had identified major challenges to the adoption of the cybersecurity framework  In February 2018, we reported that there were four different challenges to adopting the cybersecurity framework, including limited resources and competing priorities, reported by entities within their sectors  We further reported that none of the 16 sector-specific agencies were measuring the implementation by these entities, nor did they have qualitative or quantitative measures of framework adoption  While research had been done to determine the use of the framework in the sectors, these efforts had yielded no real results for sector wide adoption  We concluded that, until sector-specific agencies understand the use of the framework by the implementing entities, their ability to understand implementation efforts would be limited  Accordingly, we made a total of nine recommendations to nine sector-specific agencies to address these issues  Five agencies agreed with the recommendations, while four others neither agreed nor disagreed; as of August 2018, all five recommendations had not been implemented  Agencies had not addressed risks to their systems and the information they maintain  In January 2018, we reported that the Department of Defense (DOD) and Federal Aviation Administration (FAA) identified a variety of operations and physical security risks related to Automatic Dependent Surveillance-Broadcast Out technology that could adversely affect DOD missions  These risks came from information broadcast by the system itself, as well as from potential vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary-surveillance radars  However, DOD and FAA had not approved any solutions to address the risks they identified to the system  Accordingly, we recommended that DOD and FAA, among other things, take action to approve one or more solutions to address Automatic Dependent Surveillance- Broadcast Out-related security risks  DOD and FAA generally agreed with our recommendations; however, as of August 2018, they had not been implemented  Major challenges existed to securing the electricity grid against cyber threats  In October 2015, we testified on the status of the electricity grid’s cybersecurity, reporting that entities associated with the grid have encountered several challenges  We noted that these challenges included implementation monitoring, built-in security features in smart grid systems, and establishing metrics for cybersecurity  We concluded that continued attention to these issues and cyber threats in general was required to help mitigate these risks to the electricity grid  DHS and other agencies needed to enhance cybersecurity in the maritime environment  In October 2015, we testified on the status of the cybersecurity of our nation’s ports, concluding that steps needed to be taken to enhance their security  Specifically, we noted that DHS needed to include cyber risks in its risk assessments that are already in place as well as addressing cyber risks in guidance for port security plans  We concluded that, until DHS and the other stakeholders take steps to address cybersecurity in the ports, risk of a cyber-attack with serious consequences are increased  Sector-specific agencies were not properly addressing progress or metrics to measure their progress in cybersecurity  In November 2015, we reported that sector-specific agencies were not comprehensively addressing the cyber risk to the infrastructure, as 11 of the 15 sectors had significant cyber risk  Specifically, we noted that these entities had taken actions to mitigate their cyber risk; however, most had not identified incentives to promote cybersecurity in their sectors  We concluded that while the sector-specific agencies have successfully disseminated the information they possess, there was still work to be done to properly measure cybersecurity implementation progress  Accordingly, we made seven recommendations to six agencies to address these issues  Four of these agencies agreed with our recommendation, while two agencies did not comment on the recommendations  As of August 2018, all seven recommendations had not been implemented  Advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases  In addition, lower data storage costs have made it less expensive to store vast amounts of data  Also, ubiquitous Internet and cellular connectivity make it easier to track individuals by allowing easy access to information pinpointing their locations  the effectiveness of these procedures  Based on a survey of the schools, the majority of the schools had policies in place for records retention but the way these policies were implemented was highly varied for paper and electronic records  We also found that the oversight of the school’s programs was lacking, as Federal Student Aid conducts reviews but does not consider information security as a factor for selecting schools  out provisions of the Patient Protection and Affordable Care Act  We made three recommendations to CMS related to defining procedures for overseeing the security of state-based marketplaces and requiring continuous monitoring of state marketplace controls  HHS concurred with our recommendations  As of August 2018, two of the recommendations had not yet been implemented  Poor planning and ineffective monitoring had resulted in the unsuccessful implementation of government initiatives designed to protect federal data  In July 2017, we reported that government initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have had limited success  Specifically, in agencies’ response to our questionnaire on SSN reduction efforts, the 24 agencies covered by the Chief Financial Officers Act reported successfully curtailing the collection, use, and display of SSNs  Nevertheless, all of the agencies continued to rely on SSNs for important government programs and systems, as seen in figure 10  Given that access to data is so pervasive, personal privacy hinges on ensuring that databases of personally identifiable information (PII) maintained by government agencies or on their behalf are protected both from inappropriate access (i e , data breaches) as well as inappropriate use (i e , for purposes not originally specified when the information was collected)  Likewise, the trend in the private sector of collecting extensive and detailed information about individuals needs appropriate limits  The vast number of individuals potentially affected by data breaches at federal agencies and private sector entities in recent years increases concerns that PII is not being properly protected  The emergence of IoT devices can facilitate the collection of information about individuals without their knowledge or consent  In May 2017, we reported that the IoT has become increasingly used to communicate and process vast amounts of information using “smart” devices (such as a fitness tracker connected to a smartphone)  However, we noted that this emerging technology also presents new issues in areas such as information security, privacy, and safety  Smartphone tracking apps can present serious safety and privacy risks  In April 2016, we reported on smartphone applications that facilitated the surreptitious tracking of a smartphone’s location and other data  Specifically, we noted that some applications could be used to intercept communications and text messages, essentially facilitating the stalking of others  While it is illegal to use these applications for these purposes, stakeholders differed over whether current federal laws needed to be strengthened to combat stalking  We also noted that stakeholders expressed concerns over what they perceived to be limited enforcement of laws related to tracking apps and stalking  In particular, domestic violence groups stated that additional education of law enforcement officials and consumers about how to protect against, detect, and remove tracking apps is needed  The Federal Bureau of Investigation (FBI) has not ensured privacy and accuracy related to the use of face recognition technology  In May 2016, we reported that the Department of Justice had not been timely in publishing and updating privacy documentation for the FBI’s use of face recognition technology  Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems  Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate  We recommended that the department ensure required privacy-related documents are published and that the FBI test and review face recognition systems to ensure that they are sufficiently accurate  Of the six recommendations we made, the Department of Justice agreed with one, partially agreed with two, and disagreed with three  We continued to believe all the recommendations made were valid  As of August 2018, the six recommendations had not been implemented  In addition to the contacts named above, Jon Ticehurst, Assistant Director; Kush K  Malhotra, Analyst-In-Charge; Chris Businsky; Alan Daigle; Rebecca Eyler; Chaz Hubbard; David Plocher; Bradley Roach; Sukhjoot Singh; Di’Mond Spencer; and Umesh Thakkar made key contributions to this report 

ground_truth: Cluster munitions are air-dropped or ground-launched weapons that release a number of smaller submunitions intended to kill enemy personnel or destroy vehicles. Cluster munitions were developed in World War II and are part of many nations' weapons stockpiles. Cluster munitions have been used frequently in combat, including the early phases of the current conflicts in Iraq and Afghanistan. Cluster munitions have been highly criticized internationally for causing a significant number of civilian deaths, and efforts have been undertaken to ban and regulate their use. The Department of Defense (DOD) continues to view cluster munitions as a military necessity but in 2008 instituted a policy to reduce the failure rate of cluster munitions to 1% or less after 2018. In November 2017, a new DOD policy was issued that essentially reversed the 2008 policy. Under the new policy, combatant commanders can use cluster munitions that do not meet the 1% or less unexploded submunitions standard in extreme situations to meet immediate warfighting demands. In addition, the new policy does not establish a deadline to replace cluster munitions exceeding the 1% rate and states that DOD "will retain cluster munitions currently in active inventories until the capabilities they provide are replaced with enhanced and more reliable munitions." Potential issues for Congress include cluster munitions in an era of precision weapons, other weapons in lieu of cluster munitions, and the potential impact of DOD's 2017 revised cluster munitions policy.