You are given two reports by the government agency.  

Report 1:
CDC—an operating division of the Department of Health and Human Services (HHS)—serves as the national focal point for disease prevention and control, environmental health, and promotion and education activities designed to improve the health of Americans. The agency is also responsible for leading national efforts to detect, respond to, and prevent illnesses and injuries that result from natural causes or the release of biological, chemical, or radiological agents. To achieve its mission and goals, the agency relies on an array of partners, including public health associations and state and local public health agencies. It collaborates with these partners on initiatives such as monitoring the public’s health, investigating disease outbreaks, and implementing prevention strategies. The agency also uses its staff located in foreign countries to aid in international efforts, such as guarding against global diseases. Table 1 describes the organization of CDC. CDC is staffed by approximately 20,000 employees across the United States and around the world. For fiscal year 2017, according to agency officials, the agency’s total appropriation was approximately $12 billion, of which it reported spending approximately $424 million on information technology. In addition, the officials stated that approximately $31 million (or about 7.3 percent of the amount spent on information technology) was for information security across all CDC information technology investments. CDC relies extensively on information technology to fulfill its mission and support related administrative needs. Among the approximately 750 systems reported in its inventory, the agency has systems dedicated to supporting public health science, practice, and administration. All of these systems rely on an information technology infrastructure that includes network components, critical servers, and data centers. At CDC, the chief information officer (CIO) is responsible for establishing and enforcing policies and procedures protecting information resources. The CIO is to lead the efforts to protect the confidentiality, integrity, and availability of the information and systems that support the agency and its operations, and is to report quarterly to the HHS CIO on the overall effectiveness of CDC’s information security and privacy program, including the progress of remedial actions. The CIO designated a chief information security officer (CISO), who is to oversee compliance with applicable information security and privacy requirements of the agency. The CISO, among other things, is responsible for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, and disruption of information and information systems that support the operations and assets of the agency. To further ensure information security compliance, information systems security officers (ISSO) are responsible for managing the information security program within their respective organizations and report on security program matters to the CISO, including computer security-related incidents. ISSO responsibilities include ensuring that vendor-issued security patches are expeditiously installed and that system owners establish processes for timely removal of access privileges when a user’s system access is no longer necessary. In addition, security stewards are to perform operational security analyses supporting the efforts of the ISSO. Further, business stewards serve as program managers, accepting full accountability for the operations of the systems and ensuring that security is planned, documented, and properly resourced for each aspect of the information security program. The Federal Information Security Modernization Act (FISMA) of 2014 provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. FISMA assigns responsibility to the head of each agency for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. The law also delegates to the agency CIO (or comparable official) the authority to ensure compliance with FISMA requirements. The CIO is responsible for designating a senior agency information security officer whose primary duty is information security. The law also requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency. In addition, FISMA requires agencies to comply with National Institute of Standards and Technology (NIST) standards, and the Office of Management and Budget (OMB) requires agencies to comply with NIST guidelines. NIST Federal Information Processing Standards (FIPS) Publication 199 requires agencies to categorize systems based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation. NIST FIPS 200 requires agencies to meet minimum security requirements by selecting the appropriate security controls, as described in NIST Special Publication (SP) 800-53. This NIST publication provides a catalog of security and privacy controls for federal information systems and a process for selecting controls to protect organizational operations and assets. The publication provides baseline security controls for low-, moderate-, and high-impact systems, and agencies have the ability to tailor or supplement their security requirements and policies based on agency mission, business requirements, and operating environment. Further, in May 2017, the President issued an executive order requiring agencies to immediately begin using NIST’s Cybersecurity Framework for managing their cybersecurity risks. The framework, which provides guidance for cybersecurity activities, is based on five core security functions: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities. Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services. Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event. Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event. Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event. According to NIST, these 5 functions occur concurrently and continuously, and provide a strategic view of the life cycle of an organization’s management of cybersecurity risk. Within the 5 functions are 23 categories and 108 subcategories that include controls for achieving the intent of each function. Appendix II provides a description of the framework categories and subcategories of controls. We reported in June 2018 that CDC had implemented numerous controls over the 24 systems we reviewed, but had not always effectively implemented controls to protect the confidentiality, integrity, and availability of these systems and the information maintained on them. Deficiencies existed in the technical controls and agency-wide information security program that were intended to (1) identify risk, (2) protect systems from threats and vulnerabilities, (3) detect cybersecurity events, (4) respond to these events, and (5) recover system operations. These deficiencies increased the risk that sensitive personally identifiable and health-related information, including information regarding the transfer of biological agents and toxins dangerous to public health, could be disclosed or modified without authorization. As shown in table 2, deficiencies existed in all 5 core security function areas for the selected systems we reviewed. Controls associated with the identify core security function are intended to help an agency develop an understanding of its resources and related cybersecurity risks to its systems, assets, data, and capabilities. These controls include identifying and assessing cybersecurity risk and establishing information security policies, procedures, and plans. We reported in June 2018 that, although CDC had taken steps to implement these controls, it had not (1) categorized the risk-related impact of a key system, identified threats, or reassessed risk for systems or facilities when needed; (2) sufficiently documented technical requirements in policies, procedures, and standards; and (3) described intended controls in facility security plans. CDC Categorized Systems Based on Potential Impact of Compromise, but Did Not Appropriately Categorize a Key General Support System As discussed earlier, FIPS Publication 199 requires agencies to categorize systems based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation. For networks and other general support systems, NIST SP 800-60 notes that the categorization should be based on the high water mark of supported information systems, and on the information types processed, transmitted across the network, or stored on the network or support system. Further, CDC’s architecture design principles state that high- impact systems are to be maintained on dedicated machinery and be physically and logically secured from lower-risk systems. CDC had categorized the 24 systems we reviewed, but the assigned impact level was not always appropriate. In this regard, the agency did not ensure that high-impact systems were logically secured from a lower- risk system. Specifically, seven selected high-impact systems relied on a general support system that the agency had categorized as a moderate- impact system (i.e., a lower-risk system). As a result, the high-impact systems were relying on controls in a less secure environment. Officials from the Office of the Chief Information Officer (OCIO) explained that the categorization of the supporting system was outdated based on changes to the agency’s operating environment and that they planned to re- evaluate the assigned impact level. CDC Assessed Risk at the System Level, but Did Not Assess Threats, Document Risk-based Decisions, or Reassess Risk When Needed According to NIST SP 800-30, risk is determined by identifying potential threats to an organization and vulnerabilities in its systems, determining the likelihood that a particular threat may exploit vulnerabilities, and assessing the resulting impact on the organization’s mission, including the effect on sensitive and critical systems and data. NIST also states that assessments should be monitored on an ongoing basis to keep current on risk-impacting changes to the operating environment. CDC had developed system-level risk assessments for the 8 selected mission-essential systems, and had summarized its risks in a risk assessment report. However, only two of the eight risk assessments had identified potential threats, and only one of these assessments determined the likelihood and impact of threats to that system. Further, CDC had not always documented risks associated with less secure configuration settings or monitored its assessments to address changes to the operating environment. For example, among the 94 technical control deficiencies that we identified for the 24 systems we reviewed, OCIO officials stated that the agency had not implemented controls for 20 deficiencies due to technical constraints. However, CDC did not address risks associated with decisions not to implement controls for these reasons in the system risk assessments. OCIO officials also partially attributed 5 of the 94 technical control deficiencies to new cybersecurity threats and to threat vectors that turned initially sound architecture decisions into vulnerabilities. However, CDC had not addressed such changes in the risk assessments for the affected systems. By not assessing threats or the likelihood of their occurrence and impact and by not documenting the risks, CDC cannot have assurance that appropriate controls are in place commensurate with the level of risk. CDC Had a Process in Place to Assess Risk to Systems from an Entity-wide Perspective Beyond the system level, newly discovered threats or vulnerabilities may require an agency to make risk decisions from an entity-wide perspective. An entity-wide perspective is needed because the threats and vulnerabilities may affect more than specific systems. CDC had a process in place to assess risk from an entity-wide perspective. This process included regular meetings among OCIO and program office staff to discuss policy, threats, and incidents. Specifically, ISSOs held monthly meetings as a continuous monitoring working group to discuss policy updates. In addition, an OCIO official held quarterly briefings that included presentations on incident response tools, incident statistics, and potential threats. OCIO officials also held ad hoc meetings, as necessary, regarding vulnerability and threat concerns when the agency received email alerts from the Federal Bureau of Investigation, the Department of Homeland Security (DHS), or HHS. CDC Had Not Updated Facility Risk Assessments In addition to assessing risks for systems, agencies are to assess the risk to their facilities. The Interagency Security Committee (ISC) requires agencies to determine the security level for federal facilities, and to conduct risk assessments at least once every 5 years for Level I and Level II facilities and at least once every 3 years for Level III, Level IV, and Level V facilities. However, the two facility risk assessments that we reviewed had not been updated in a timely manner. Specifically, the risk assessments, covering Level III and Level IV facilities that house the 24 reviewed systems, had been last updated in January 2009 and March 2014—8 years earlier and just over 3 years earlier, at the time of our review in July 2017. According to a CDC physical security official, the agency had previously relied on a third-party assessor to perform the assessments. The official also said that the agency planned to conduct its own facility risk assessments and had recently developed procedures for conducting these assessments. Until it performs these assessments, CDC may not be aware of new risks to its facilities or the controls needed to mitigate the risks. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes policies and procedures that (1) are based on a risk assessment, (2) cost- effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements. According to NIST SP 800-53, an agency should develop policies and procedures for each of the 18 NIST families of security controls to facilitate the implementation of the controls. CDC had documented numerous policies, procedures, and standards that addressed each of the 18 control families identified in NIST SP 800-53. For example, the agency had developed policies and procedures governing physical access to CDC facilities, role-based training of personnel with significant security responsibilities, security assessment and authorization of systems, and continuity of operations, in addition to standard operating procedures that covered numerous other controls. The agency had also developed the CDC IT Security Program Implementation Standards, which describes the agency’s security program requirements and minimum mandatory standards for the implementation of information security and privacy controls. In addition, the agency had documented configuration standards, which specified minimum configuration settings, for devices such as firewalls, routers, switches, as well as Unix and Windows servers. However, these policies and standards sometimes lacked the technical specificity needed to ensure controls were in place. To illustrate, the agency had not sufficiently documented detailed guidance or instructions to address numerous technical control deficiencies we identified, such as insecure network devices, insecure database configurations, not blocking certain email attachments, and not deploying a data loss prevention capability. According to OCIO officials, the agency’s periodic reviews and updates to existing cybersecurity policies and standards did not reveal and address these issues. Nevertheless, without clear and specific guidance or instructions for implementing technical controls, the agency had less assurance that controls were in place and operating as intended. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes subordinate plans for providing adequate information security for networks, facilities, and systems or a group of information systems, as appropriate. NIST states that plans should be reviewed and updated to ensure that they continue to reflect the correct information about the systems, such as changes in system owners, interconnections, and authorization status, among other things. HHS and CDC policies require that such plans be reviewed annually. In addition, the ISC requires that agencies develop and implement an operable and effective facility security plan. CDC standards require the organization to prepare a facility security plan (or similar document). CDC had developed security plans for the 8 selected mission-essential systems. With a few exceptions, the plans addressed the applicable security controls for those systems. The agency also had reviewed and updated the plans annually. However, CDC had not developed security plans for the facilities housing resources for the selected systems. Physical security officials stated that they had not developed security plans because they did not have a sufficient number of staff to develop them. Without comprehensive security plans for the facilities, CDC’s information and systems would be at an increased risk that controls to address emergency situations would not be in place and personnel at the facilities would not be aware of their roles and responsibilities for implementing sound security practices to protect systems housed at these CDC locations. The protect core security function is intended to help agencies develop and implement the appropriate safeguards for their systems to ensure achieving the agency’s mission and to support the ability to limit or contain the impact of a potential cybersecurity event. Controls associated with this function include implementing controls to limit access to authorized users, processes or devices; encrypting data to protect its confidentiality and integrity; configuring devices securely and updating software to protect systems from known vulnerabilities; and providing training for cybersecurity awareness and performing security-related duties. Although CDC had implemented controls that were intended to protect its operating environment, we reported in June 2018 that the agency did not consistently (1) implement access controls effectively, (2) encrypt sensitive data, (3) configure devices securely or apply patches in a timely manner, or (4) ensure staff with significant security responsibilities received role-based training. A basic management objective for any agency is to protect the resources that support its critical operations from unauthorized access. Agencies accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Access controls include those related to identifying and authenticating users, authorizing access needed to perform job duties, protecting system boundaries, and physically protecting information system assets. However, CDC had not consistently implemented these controls. CDC Implemented Enterprise-wide Identification and Authentication Controls, but Did Not Consistently and Securely Configure Password Controls for Certain Accounts on Devices and Systems NIST SP 800-53 states that agencies should implement multi-factor authentication for their users of information systems. Multi-factor authentication involves using two or more factors to achieve authentication. A factor is something you know (password or personal identification number), something you have (token and personal identity verification (PIV) card), or something you are (biometric). Also, NIST and CDC policy state that information systems shall have password management controls established to include minimum password complexity requirements, password lifetime restrictions, prohibitions on password reuse, and user accounts temporarily locked out after a certain number of failed login attempts during a specified period of time. CDC had applied enterprise-wide solutions to ensure appropriate identification and multi-factor authentication of its general user community through, for example, the use of PIV cards. However, instances of weak password management controls existed for certain accounts on network devices, servers, and database systems. According to OCIO officials, password control deficiencies existed primarily due to technical constraints, administrators not being aware of technical requirements, or administrators not adequately monitoring configuration settings. Without more secure password settings, CDC’s information and systems are at an increased risk that unauthorized individuals could have guessed passwords and used them to obtain unauthorized access to agency systems and databases. CDC Authorized Users More Access than Needed to Perform Their Jobs NIST SP 800-53 states that agencies should employ the principle of least privilege, allowing only authorized access for users (or processes acting on behalf of users) that are necessary to accomplish assigned tasks. It also states that privileged accounts—those with elevated access permissions—should be strictly controlled and used only for their intended administrative purposes. CDC had implemented controls intended to ensure that users were granted the minimum level of access permissions necessary to perform their legitimate job-related functions. However, the agency had granted certain users more access than needed for their job functions, including excessive access permissions on a key server. According to OCIO officials, CDC systems had deficiencies related to restricting access primarily due to technical constraints or administrators not adequately monitoring configuration settings. By not appropriately restricting access, CDC’s information and systems are at an increased risk that individuals could deliberately or inadvertently compromise database systems or gain inappropriate access to information resources. CDC Did Not Effectively Implement Boundary Controls to Ensure Network Integrity NIST SP 800-53 states that agencies should control communications at information systems’ external boundaries. It states that, to manage risks, agencies should use boundary protection mechanisms to separate or partition computing systems and network infrastructures containing higher-risk systems from lower-risk systems. Although CDC had implemented multiple controls that were designed to protect system boundaries, the agency had not sufficiently separated higher-risk systems from lower-risk systems. According to OCIO officials, deficiencies in boundary protection controls existed due to new cybersecurity threats turning initially sound architecture decisions into vulnerabilities, technical constraints, and administrators not being aware of technical requirements or adequately monitoring configuration settings. Without stronger boundary controls, CDC’s information and systems are at an increased risk that an attacker could have exploited these boundary deficiencies and leveraged them to compromise CDC’s internal network. CDC Physically Protected Information System Assets, but Did Not Consistently Ensure Access Remained Appropriate NIST SP 800-53 states that agencies should implement physical access controls to protect employees and visitors, information systems, and the facilities in which they are located. In addition, NIST states that agencies should review access lists detailing authorized facility access by individuals at the agency-defined frequency. In its standards, CDC requires implementation of the NIST special publication and requires that access lists detailing authorized facility access by individuals be reviewed at least every 365 days. CDC had implemented physical security controls. The agency had implemented physical security measures to control access to certain areas and to ensure the safety and security of its employees, contractors, and visitors to CDC facilities. For example, CDC had issued PIV cards and Cardkey Proximity Cards to its employees and contractors, and had limited physical access to restricted areas based on the permissions it granted via these cards. However, the agency had not consistently reviewed authorized access lists. In this regard, CDC did not have a process in place for periodically reviewing the lists of individuals with access to rooms containing sensitive resources to ensure that such access remained appropriate. Without reviewing authorized access lists, CDC has reduced assurance that individual access to its computing resources and sensitive information is appropriate. NIST SP 800-53 states that agencies should encrypt passwords both while stored and transmitted, and configure information systems to establish a trusted communication path between the user and the system. Additionally, NIST requires that, when agencies use encryption, they use an encryption algorithm that complies with FIPS 140-2. CDC had used FIPS-compliant encryption for its PIV card implementation, but had not effectively implemented encryption controls in other areas. According to OCIO officials, encryption control deficiencies existed primarily due to technical constraints, administrators not being aware of a technical solution, or configuration settings not being adequately monitored. By not using encryption effectively, CDC limits its ability to protect the confidentiality of sensitive information, such as passwords. NIST SP 800-53 states that agencies should disable certain services with known security vulnerabilities. This includes configuring security control settings on operating systems in accordance with publicly available security checklists (or benchmarks) promulgated by NIST’s National Checklist Program repository. This repository contains, for example, the security configuration benchmarks established by the Center for Internet Security (CIS) for Windows servers. NIST also states that agencies should test and install newly-released security patches, service packs, and hot fixes in a timely manner. In addition, CDC policy required that software patches for remediating vulnerabilities designated as critical or high risk be applied to servers within 45 days of being notified that a patch is available or within 7 days of when an exploit is known to exist. Further, agency policy specified that administrators configure Windows servers in accordance with the CDC- approved security benchmarks. CDC had documented security configuration baselines, but had not always securely configured its systems or applied patches. In addition, the agency had not consistently configured security settings in accordance with prescribed security benchmarks or applied patches in a timely manner. For example: CDC had configured Windows servers to run unnecessary services. CDC had configured only about 62 percent of the security settings in accordance with prescribed benchmark criteria on the Windows and infrastructure servers supporting five systems that we reviewed. During our site visit in April 2017, CDC had not installed 21 updates on about 20 percent of the network devices, including 17 updates that the vendor considered to be critical or high-risk. The oldest of the missing updates dated back to January 2015. CDC had not updated database software supporting two selected systems to a more recent version that addressed vulnerabilities with a medium severity rating. According to OCIO officials, CDC had deficiencies in configuration and patching primarily due to administrators not being aware that there was a technical solution or did not adequately monitor configuration settings. By not securely configuring devices and installing updates and patches in a timely manner, the agency is at increased risk that individuals could have exploited known vulnerabilities to gain unauthorized access to agency computing resources. According to NIST SP 800-53, agencies should provide adequate security training to individuals in a role such as system/network administrator and to personnel conducting configuration management and auditing activities, tailoring the training to their specific roles. In addition, one of the cybersecurity cross-agency priority goals requires that agencies implement training that reduces the risk that individuals will introduce malware through email and malicious or compromised web sites. Consistent with NIST SP 800-53, CDC policy required network users to receive annual security awareness training. Accordingly, for fiscal year 2017, all CDC staff completed the required annual security awareness training. CDC policy also required that those staff identified as having significant security responsibilities receive role-based training every 3 years. However, not all staff with significant security responsibilities received role-based training within the defined time frames. The agency used a tracking system to monitor the status of role-based training for 377 individuals who had been identified as having significant security responsibilities. As of May 2017, 56 (about 15 percent) of the 377 individuals had not completed the training within the last 3 years, and 246 (about 65 percent) of them had not taken training within the last year. In addition, CDC had not identified at least 30 other staff with significant security responsibilities who required role-based training. Specifically, none of the 18 security and database administrators for four selected systems were included among the individuals being tracked, although these administrators had significant security responsibilities. Further, the agency provided us with a list of 42 individuals whose job series indicated that they required role-based training. However, 12 of the 42 were not included among the tracked individuals. Furthermore, given the number of deficiencies identified and the rapidly evolving nature of cyber threats, CDC’s requirement that staff take role-based training only once every 3 years is not sufficient for individuals with significant cybersecurity responsibilities. According to OCIO officials, managers are responsible for identifying those individuals with significant security responsibilities. The process used to track training was manual and required an individual’s manager to specify training requirements. The officials noted that the agency plans to implement a new HHS annual role-based training requirement in fiscal year 2018 and that they intend to work to enhance oversight as the new requirement is implemented. The officials also stated that at least 10 of the 94 technical control-related deficiencies identified in our June 2018 report had resulted, at least in part, from staff not being aware of control requirements or solutions to address the deficiencies. As a result, CDC’s information and systems are at increased risk that staff may not have the knowledge or skills needed to appropriately protect them. The detect core security function is intended to allow for the timely discovery of cybersecurity events. Controls associated with this function include logging and monitoring system activities and configurations, assessing security controls in place, and implementing continuous monitoring. In June 2018, we reported that, although CDC had implemented controls intended to detect the occurrence of a cybersecurity event, it had not sufficiently implemented logging and monitoring capabilities or effectively assessed security controls. NIST SP 800-53 states that agencies should enable system logging features and retain sufficient audit logs to support the investigations of security incidents and the monitoring of select activities for significant security-related events. In addition, National Archives and Records Administration records retention guidance states that system files containing information requiring special accountability that may be needed for audit or investigative purposes should be retained for 6 years after user accounts have been terminated or passwords altered, or when an account is no longer needed for investigative or security purposes, whichever is later. NIST also states that agencies should monitor physical access to facilities where their information systems reside to detect physical security incidents. Further, NIST SP 800-53 states that agencies should monitor and control changes to configuration settings. Although CDC had implemented centralized logging and network traffic monitoring capabilities, the capabilities were limited. For example, the agency’s centralized logging system used for security monitoring had a limited storage capacity and did not meet the National Archives and Records Administration requirements. In addition, CDC had not centrally collected and monitored security event data for many key assets connected to the network. As a result, increased risk existed that CDC would not have been able to detect anomalous activities that may have occurred from malware attacks over time. OCIO officials stated that, as a compensating measure, the agency prevents direct communications between workstations. However, such a measure does not allow the agency to detect potentially inconsistent activities that may have occurred from malware attacks within the same data center. CDC also had not consistently reviewed physical access logs to detect suspicious physical access activities, such as access outside of normal work hours and repeated access to areas not normally accessed. Program offices responsible for 7 of the 8 selected mission-essential systems did not conduct such a review. According to OCIO officials, the offices were not aware of the need for a review. However, without reviewing physical access logs, CDC has reduced assurance that the agency would detect suspicious physical access activities. Further, CDC had not routinely monitored the configuration settings of its systems to ensure that the configurations were securely set. For example, for at least 41 of 94 technical control deficiencies we identified, OCIO officials cited quality control gaps where the change management process or system administrators had not discovered deficiencies resulting from insecure configuration settings. Without an effective monitoring process in place for system configurations, the agency was not aware of insecure system configurations. FISMA requires each agency to periodically test and evaluate the effectiveness of its information security policies, procedures, and practices. The law also requires agencies to test the management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems at a frequency depending on risk, but no less than annually. In addition, NIST SP 800- 53A identifies three assessment methods—interview, examine, and test— and describes the potential depth and coverage for each. Assessing a control’s effectiveness based on an interview is likely less rigorous than examining a control; similarly, examining a control is likely less rigorous than testing the control’s functionality. CDC had not sufficiently tested or assessed the effectiveness of the security controls for the 8 mission-essential systems that we reviewed. Although CDC annually assessed security controls of selected systems, the agency had only examined control descriptions in security plans to ensure accuracy. At least once every 3 years, the agency selected controls for a more in-depth assessment of the 8 mission-essential systems we reviewed. However, CDC had assessed only 191 (about 7 percent) of 2,818 controls described in the security plans for the selected systems. In addition, the agency used methods for assessing controls that were often not rigorous enough to identify the control deficiencies that we identified. For example, as depicted in figure 1, CDC relied exclusively on interviews—a less rigorous method—to assess 20 percent of the 191 controls it assessed for the selected systems. The security control tests and assessments were insufficient in part because CDC had not developed comprehensive security assessment plans or had not consistently implemented the plans for the 8 selected mission-essential systems we reviewed. For example, one system’s assessment plan indicated that five controls should be assessed using a testing methodology; instead, however, the assessor conducted interviews to determine whether controls were effective or not. OCIO officials stated that the security control test and assessment process is manual and staffing is limited. They stated that the agency intends to rely increasingly on automated tools—such as the tools implemented by the Continuous Diagnostics and Mitigation program—for performing the assessments. Nevertheless, by not assessing controls in an in-depth and comprehensive manner, CDC has limited assurance that the security controls are in place and operating as intended. Further, without developing and implementing comprehensive assessment plans, assessments may not be performed with sufficient rigor to identify control deficiencies. The respond core security function is intended to support the ability to contain the impact of a potential cybersecurity event. Controls associated with this function include implementing an incident response capability and remediating newly-identified deficiencies. Although CDC had implemented controls for incident response to detect cybersecurity events, we reported in June 2018 that the agency had not maintained adequate information to support its incident response capability or taken timely corrective actions to remediate identified control deficiencies. NIST SP 800-53 and SP 800-61 state that agencies should develop and document an incident response policy with corresponding implementation procedures and an incident response plan, and keep them updated according to agency requirements. NIST also states that agencies should implement an incident handling capability, including an incident response team that consists of forensic/malicious code analysts. In addition, agencies are to provide incident response training for the team and test the incident response capability to determine the effectiveness of the response. Further, NIST states that agencies are to monitor incidents by tracking and documenting them and maintain records about each incident, including forensic analysis. Finally, National Archives and Records Administration guidance states that records and data relevant to security incident investigations should be retained for 3 years. CDC had implemented an incident response capability. The agency had developed policy, procedures, and a plan that addressed incident response, and updated them annually. CDC had an incident response team that managed all of the incident handling and response efforts for the agency, and conducted forensic analyses for reported security incidents. Team members had undergone training, such as an advanced network forensic and analysis course offered by a private firm. In addition, the agency had periodically tested its incident handling capability by conducting penetration testing exercises. These exercises allowed the team to test its real-time response capabilities. CDC’s incident response procedures state that incident tickets should include a description of actions taken, response time, and whether actions have been completed or not. The agency’s procedures also require that computers affected by an incident be removed from the network immediately. Nevertheless, CDC had shortcomings in implementing its incident response capability and monitoring procedures. For the 11 security incidents CDC considered most significant over a 19-month period ending in March 2017, the agency had not consistently described the actions taken, the response times, or whether remedial actions had been completed. The agency also had not maintained audit log records for its security incidents. For example, the agency described recommended actions for 10 of the 11 incidents, but did not describe the actions that had been taken. In addition, although incident response team officials told us that all incident ticket records had been saved, CDC had not retained system log data that supported incident resolution for at least five of the incidents. The agency’s policy did not address record retention in accordance with National Archives and Records Administration guidance. Further, for two of the security incidents, the security incident tickets did not clearly indicate when two compromised workstations had been removed from the network. According to OCIO officials, shortcomings in fully documenting incidents resulted from the organization being understaffed, primarily due to budget limitations and the inability to hire qualified personnel. Without effectively tracking and documenting information system security incidents, CDC’s systems are at increased risk that the impact of security incidents would not be fully addressed. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in information security policies, procedures, or practices. NIST SP 800-53 states that agencies are to develop a plan of action and milestones (POA&M) for an information system to document the agency’s planned remedial actions to correct identified deficiencies. CDC policy was consistent with the NIST guidelines. CDC had developed POA&Ms for deficiencies identified by its security control assessments, but had not remediated the deficiencies in a timely manner. For each of the 8 selected mission-essential systems, the agency had created plans for correcting control deficiencies. However, the agency did not implement several remedial actions by their due date. For example, expected completion dates had passed for correcting deficiencies associated with 4 of the 8 selected mission-essential systems. For these 4 systems, the completion dates were 1 to 8 months beyond the due dates at the time of our review in September 2017. According to Office of the Chief Information Security Officer officials, program offices that own the systems did not always communicate updates on the status of remedial actions for their respective systems, noting that deficiencies may have been corrected. Without effective communication to update its POA&Ms, CDC was not in a position to effectively manage its remedial actions and correct known deficiencies in a timely manner. The recover core security function is intended to support timely recovery of normal operations to reduce the impact from a cybersecurity event. Controls associated with this function include developing and testing contingency plans to ensure that, when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected. Losing the capability to process, retrieve, and protect electronically maintained information can significantly affect an agency’s ability to accomplish its mission. If contingency planning is inadequate, even relatively minor interruptions can result in lost or incorrectly processed data, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete information. NIST SP 800-53 states that agency systems should have a contingency plan that includes the identification of key personnel and the systems’ essential mission functions and addresses full information system restoration. For high-impact systems, NIST specifies that agencies test contingency plans at an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats. In addition, NIST states that organizations should initiate corrective actions based on testing if they are needed. As we reported in June 2018, CDC had developed and fully tested contingency plans for each of the 8 selected mission-essential systems that we reviewed. Each plan identified key personnel and their contact information, essential mission functions of the systems, and instructions on how to fully restore the systems in the event of a disruption. Additionally, between January 2015 and May 2017, CDC had tested whether the 8 systems could be recovered at their respective alternate sites, and had initiated corrective actions based on the results of the tests. However, the alternate site for 6 of the 8 selected mission-essential systems was located in relatively close proximity to the main processing site. Although 2 systems had alternate sites located in another state, the alternate site for the other 6 systems was within the same metropolitan area. As a result, an event such as a natural disaster or substantial power outage could affect both the main and alternate sites for these systems, potentially rendering CDC unable to complete functions associated with its mission. Prompt restoration of service is necessary because the required recovery time for these systems ranged from 4 to 24 hours. Security plans for 3 of the systems recognized the hazards of having the sites within the same geographical region, but stated that CDC had accepted this risk. According to OCIO officials, having a site further away was cost prohibitive; however, the officials had not documented this analysis or the associated risk of having the agency’s processing sites located within the same geographical area. Without documenting the analysis and associated risk, CDC had less assurance that senior leadership was aware of the risk of agency systems being unavailable. As a consequence, senior leadership may not agree whether acceptance of the risk was warranted. An underlying reason for the information security deficiencies in selected systems was that, although the agency had developed and documented an agency-wide information security program, it had not consistently or effectively implemented elements of the program. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for information systems. As discussed previously in this report, CDC had implemented aspects of each of these elements. For example, the agency had conducted risk assessments, developed security plans, assessed security controls, developed remedial action plans, and developed and tested contingency plans for each of the 8 selected mission-essential systems. In addition, the agency had documented numerous policies and procedures and ensured that staff had completed annual security awareness training. However, CDC’s program had shortcomings. For example, as discussed earlier in this report, CDC had not consistently or effectively: addressed threats, technical constraints, and the changing threat environment in its system risk assessments, or assessed the risk of having alternate processing sites within close proximity to each other; documented detailed technical requirements in policies and procedures, or facility controls in facility security plans; tracked and trained staff with significant security responsibilities; monitored configuration settings and comprehensively assessed remediated deficiencies in a timely manner; or documented its cost analysis and associated risk of having an alternate processing site within the same geographical region as its primary processing site. Until CDC addresses these shortcomings and consistently and effectively implements all elements of its information security program, the agency will lack reasonable assurance that its computing resources are protected from inadvertent or deliberate misuse. In our June 2018 report, we made 195 recommendations to CDC to strengthen its technical security controls and bolster its agency-wide information security program. Specifically, we recommended that the agency take 184 actions to resolve technical control deficiencies by implementing stronger access controls, encrypting sensitive data, configuring devices securely, applying patches in a timely manner, strengthening firewall rules, and implementing logging and monitoring controls more effectively, among other actions. We also made 11 recommendations for CDC to improve its information security program by, among other things, assessing risks as needed, documenting more detailed technical requirements, monitoring and assessing controls more comprehensively, and remediating deficiencies in a timely manner. Since the issuance of our June 2018 report, CDC has made significant progress in implementing the recommendations we made to resolve the technical security control deficiencies in the information systems we reviewed and to improve its information security program. In this regard, the agency has implemented many of the recommendations for improving technical security controls for the systems we reviewed and has developed plans to implement recommendations for enhancing its information security program. Specifically, as of August 3, 2018, CDC had fully implemented 102 (55 percent) of the 184 recommendations we made to fortify the technical security controls over the systems we reviewed. In addition, the agency had partially implemented 20 (11 percent) of the 184 recommendations. In these instances, CDC had made progress toward implementing the recommendations, but had not completed all of the necessary corrective actions for us to close the recommendations. Therefore, these recommendations remain open. Further, CDC did not provide any evidence that it had implemented the remaining 62 technical control- related recommendations. Table 3 summarizes the status of CDC’s efforts to implement the 184 recommendations that we made to resolve the technical control deficiencies, as of August 3, 2018. By implementing 102 recommendations, CDC (as of August 3, 2018) reduced some of the risks associated with certain key activities. Specifically, these efforts included protecting network boundaries and logging and monitoring security events for indications of inappropriate or unusual activity on systems—that we highlighted in our June 2018 report as being particularly vulnerable and requiring the agency’s greater priority and attention. In addition, the agency had implemented several of our recommendations to rectify a number of the security control deficiencies. These efforts included strengthening firewall rules, implementing stronger access controls, configuring devices securely, and expanding its audit monitoring capabilities. In addition, CDC had developed a plan of action and milestones (POA&M) for each of the identified technical control deficiencies and related recommendations that remained open as of August 3, 2018. The POA&Ms assigned organization responsibilities, identified estimated costs, identified points of contact, and established time frames for resolving the deficiencies and closing the related recommendations. The agency’s plans called for it to implement the majority of the remaining open technical control-related recommendations by September 2019, and all recommendations by September 2020, as shown in figure 2. Our June 2018 report also included 11 recommendations to CDC to improve its information security program. In particular, we recommended that the agency, among other things, evaluate system impact level categorizations to ensure they reflect the current operating environment; update risk assessments to identify threats and the likelihood of impact of the threat on the environment; and update the facility risk assessments. In addition, we recommended that the agency take the necessary steps to make sure staff with significant security roles and responsibilities are appropriately identified and receive role-based training; monitor the configuration settings of agency systems to ensure the settings are set as intended; update security control assessments to include an assessment of controls using an appropriate level of rigor; and remediate POA&Ms in a timely manner. Further, we recommended that the agency document the cost-benefit analysis with associated risk of having an alternate site within the same geographical region as the main site. As of August 3, 2018, the agency had partially implemented 1 of the 11 information security program-related recommendations, but had not provided any evidence that it had implemented the remaining 10 recommendations. Regarding the partially implemented recommendation, CDC had provided role-based training to all personnel performing significant security responsibilities. However, the agency still needed to establish and automate the identification process and the tracking of training records for individuals needing specialized security role-based training. CDC had developed plans to fully implement this recommendation and each of the remaining 10 information security program-related recommendations by July 2019. Fully implementing the open recommendations is essential to ensuring that the agency’s systems and sensitive information are not at increased and unnecessary risk of unauthorized use, disclosure, modification, or disruption. We received written comments on a draft of this report from CDC. In its comments, which are reprinted in appendix III, the agency stated that it recognizes the risks associated with operating a large, global information technology enterprise and has implemented processes, procedures, and tools to better ensure the prevention, detection, and correction of potential incidents. CDC also said cybersecurity remains a high priority and that it takes the responsibilities for protecting public health information and data entrusted to it seriously. To strengthen its cybersecurity program, the agency stated that it is restructuring and streamlining the cyber program and IT infrastructure of its Office of the Chief Information Officer. Further, CDC stated that it has leveraged GAO’s limited official use only report, issued in June 2018, to accelerate its implementation, infrastructure, and software deployments to complete phrases one and two of DHS’s Continuous Diagnostics and Mitigation program. The agency also said it concurred with, and highlighted a number of actions that it had planned or begun taking to remediate, the 11 security program recommendations that we made to CDC in our June 2018 report. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and the department’s Office of the Inspector General, the Director of CDC, and interested congressional parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or Dr. Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. GAO staff who made key contributions to this report are listed in appendix IV. Our objective was to assess the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems. In June 2018, we issued a report which detailed the findings from our work in response to this objective. In the report, we made 184 recommendations to CDC to resolve the technical security control deficiencies in the information systems we reviewed and 11 additional recommendations to improve its information security program. We designated that report as “limited official use only” (LOUO) and did not release it to the general public because of the sensitive information it contained. This report publishes the findings discussed in our June 2018 report, but we have removed all references to the sensitive information. Specifically, we deleted the names of the information systems and computer networks that we examined, disassociated identified control deficiencies from named systems, deleted certain details about information security controls and control deficiencies, and omitted an appendix that was contained in the LOUO report. The appendix contained sensitive details about the technical security control deficiencies in the CDC’s information systems and computer networks that we reviewed, and the 184 recommendations we made to mitigate those deficiencies. We also provided a draft of this report to CDC officials to review and comment on the sensitivity of the information contained herein and to affirm that the report can be made available to the public without jeopardizing the security of CDC’s information systems and networks. In addition, this report addresses a second objective that was not included in the June 2018 report. Specifically, this objective was to determine the extent to which CDC had taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement that we identified in the earlier report. As noted in our June 2018 report, we determined the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems. To do this, we initially gained an understanding of the overall network environment, identified interconnectivity and control points, and examined controls for the agency’s networks and facilities. We conducted site visits at two CDC facilities in Atlanta, Georgia. To evaluate CDC’s controls over its information systems, we used our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information. We based our assessment of controls on requirements identified by the Federal Information Security Modernization Act of 2014 (FISMA), which establishes key elements for an effective agency-wide information security program; NIST guidelines and standards; Department of Health and Human Services and CDC policies, procedures, and standards; and standards and guidelines from relevant security organizations, such as the National Security Agency, the Center for Internet Security, and the Interagency Security Committee. We had reviewed a non-generalizable sample of the agency’s information systems, focusing on those systems that (1) collect, process, and maintain private or potentially-sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; and (3) were assigned a Federal Information Processing Standard rating of moderate or high impact. Based on these criteria, we had selected eight mission-essential systems for our review. Of these systems, the agency had categorized 7 as high-impact systems and 1 as a moderate-impact system. For these 8 selected mission- essential systems, we had reviewed information security program-related controls associated with risk assessments, security plans, security control assessments, remedial action plans, and contingency plans. To assess the safeguards CDC implemented for its systems, we had examined technical security controls for 24 CDC systems, including systems the agency designated as high-value assets. These included 10 key systems, 8 of which were high- and moderate-impact mission- essential systems just described, 1 additional high-impact system, 1 additional moderate-impact system, and 14 general support systems. We selected the additional high-impact system because the agency re- categorized it as a high-impact system during our review. We selected the additional moderate-impact system because the agency used it to control physical access to highly sensitive CDC biologic lab facilities, including facilities that handle dangerous and exotic substances that cause incurable and deadly diseases. We selected 10 key systems, 8 of which were mission-essential systems, for review that (1) collect, process, and maintain private or potentially sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; (3) could have a catastrophic or severe impact on operations if compromised; or (4) could be of particular interest to potential adversaries. We also selected 14 general support systems that were part of the agency’s network infrastructure supporting the 10 key systems. To review controls over the 10 key systems and 14 general support systems, we had examined the agency’s network infrastructure and assessed the controls associated with system access, encryption, configuration management, and logging and monitoring. For reporting purposes, we had categorized the security controls that we assessed into the five core security functions described in the National Institute of Standards and Technology’s (NIST) cybersecurity framework. The five core security functions are: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities. Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services. Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event. Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event. Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event. These core security functions are described in more detail in appendix II. For the identify core security function, we had examined CDC’s reporting for its hardware and software assets; analyzed risk assessments for the eight selected mission-essential systems to determine whether threats and vulnerabilities were being identified; reviewed risk assessments for two facilities; analyzed CDC policies, procedures, and practices to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; and analyzed security plans for the eight selected systems to determine if those plans had been documented and updated according to federal guidance. We also evaluated the risk assessments for two facilities that housed the 8 mission-essential selected systems. For the protect core security function, we had examined access controls for the 24 systems. These controls included the complexity and expiration of password settings to determine if password management was being enforced; administrative users’ system access permissions to determine whether their authorizations exceeded the access necessary to perform their assigned duties; firewall configurations, among other things, to determine whether system boundaries had been adequately protected; and physical security controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft. We also had examined configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted. In addition, we had examined configuration settings for routers, network management servers, switches, firewalls, and workstations to determine if settings adhered to configuration standards, and inspected key servers and workstations to determine if critical patches had been installed and/or were up-to-date. Further, we had examined training records to determine if employees and contractors had received security awareness training according to federal requirements, and whether personnel who have significant security responsibilities had received training commensurate with those responsibilities. For the detect core security function, we had analyzed centralized logging and network traffic monitoring capabilities for key assets connected to the network; analyzed CDC’s procedures and results for assessing security controls to determine whether controls for the eight selected mission- essential systems had been sufficiently tested at least annually and based on risk. We also had reviewed the agency’s implementation of continuous monitoring practices to determine whether the agency had developed and implemented a continuous monitoring strategy to manage its information technology assets and monitor the security configurations and vulnerabilities for those assets. For the respond core security function, we had reviewed CDC’s implementation of incident response practices, including an examination of incident tickets for 11 incidents; and had examined the agency’s process for correcting identified deficiencies for the eight selected mission-essential systems. For the recover core security function, we had examined contingency plans for eight selected mission-essential systems to determine whether those plans had been developed and tested. In assessing CDC’s controls associated with this function, as well as the other four core functions, we had interviewed Office of the Chief Information Officer officials, as needed. Within the core security functions, as appropriate, we had evaluated the elements of CDC’s information security program based on elements required by FISMA. For example, we analyzed risk assessments, security plans, security control assessments, and remedial action plans for each of the 8 selected mission-essential systems. In addition, we had assessed whether the agency had ensured staff had completed security awareness training and whether those with significant security responsibilities received commensurate training. We also had evaluated CDC’s security policies and procedures. To determine the reliability of CDC’s computer-processed data for training and incident response records, we had evaluated the materiality of the data to our audit objective and assessed the data by various means, including reviewing related documents, interviewing knowledgeable agency officials, and reviewing internal controls. Through a combination of methods, we concluded that the data were sufficiently reliable for the purposes of our work. To accomplish our second objective—on CDC’s actions to address the previously identified security program and technical control deficiencies and related recommendations—we requested that the agency provide a status report of its actions to implement each of the recommendations. For each recommendation that CDC indicated it had implemented as of August 3, 2018, we examined supporting documents, observed or tested the associated security control or procedure, and/or interviewed the responsible agency officials to assess the effectiveness of the actions taken to implement the recommendation or otherwise resolve the underlying control deficiency. Based on this assessment and CDC status reports, we defined the status of each recommendation into the following 3 categories: closed-implemented—CDC had implemented the recommendation; open-partially implemented—CDC had made progress toward, but had not completed, implementing the recommendation; and open-not implemented—CDC had not provided evidence that it had acted to implement the recommendation. We conducted this performance audit from December 2016 to December 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The National Institute of Standards and Technology’s cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover. Within the five functions are 23 categories and 108 subcategories, as described in the table. In addition to the individuals named above, Gary Austin, Jennifer R. Franks, Jeffrey Knott, and Chris Warweg (assistant directors); Chibuikem Ajulu-Okeke, Angela Bell, Sa’ar Dagani, Nancy Glover, Chaz Hubbard, George Kovachick, Sean Mays, Kevin Metcalf, Brandon Sanders, Michael Stevens, Daniel Swartz, and Angela Watson made key contributions to this report. Edward Alexander, Jr. and Duc Ngo (assistant directors); David Blanding, and Christopher Businsky also provided assistance.

 

 Report 2:
In March 2015, Saudi Arabia established a coalition of nations (hereinafter referred to as the Saudi-led coalition or the coalition) to engage in military operations in Yemen against the Ansar Allah/Houthi movement and loyalists of the previous president of Yemen, the late Ali Abdullah Saleh. During 2014, the United States joined Saudi Arabia in demanding that Houthi forces reverse their campaign to occupy the Yemeni capital of Sanaa, but the rapid onset of hostilities in March 2015 forced the Obama Administration to react quickly. At the start of the Saudi-led intervention on March 25, 2015, the Administration announced that the United States would provide "logistical and intelligence support" to the coalition's operations without taking "direct military action in Yemen in support of this effort." Soon thereafter, a joint U.S.-Saudi planning cell was established to coordinate military and intelligence support for the campaign. At the United Nations Security Council, the United States supported the passage of Resolution 2216 (April 2015), which, among other things, required member states to impose an arms embargo against the Houthi-Saleh forces and demanded that the Houthis withdraw from all areas seized during the current conflict. Since the March 2015 Saudi-led coalition intervention in Yemen, Congress has taken an active role in debating and overseeing U.S. policy in the Arabian Peninsula. Members have considered legislative proposals seeking to reduce Yemeni civilian casualties resulting from the coalition's operations; improve deteriorating humanitarian conditions; end restrictions on the flow of goods and humanitarian aid; combat Iranian support for the Houthis; preserve maritime security in the Bab al Mandab Strait; and/or support continued Saudi-led coalition and U.S. efforts to counter Al Qaeda and Islamic State forces in Yemen. Beyond Yemen, many Members have appeared to view the conflict through the prism of a broader regional rivalry between Saudi Arabia and Iran, and the U.S. effort to limit Iran's malign regional influence. Others lawmakers have viewed the Yemen conflict as indicative of what they perceive as problems in the U.S.-Saudi relationship, a concern that deepened after the killing of Saudi journalist Jamal Khashoggi by Saudi government personnel in October 2018. Congress has considered but has not enacted proposals to curtail or condition U.S. defense sales to Saudi Arabia. Responding to the Saudi-led intervention in Yemen also appears to be reinvigorating some Members' interest in strengthening the role of Congress in foreign policy vis-à-vis the executive branch. Debate in Congress over Yemen has featured bipartisan statements of interest in asserting the prerogatives of the legislative branch to limit executive branch power, specifically using war powers legislation and the appropriations and authorization processes to curb U.S. military involvement in support of coalition operations. Congressional scrutiny of U.S. policy in Yemen also has led to legislative changes to global authorities, such as the Department of Defense's authority to enter into and use acquisition and cross servicing agreements with partner militaries. Congressional interest in the Yemen conflict has evolved and grown gradually and was not widespread at the outset of the coalition's March 2015 intervention in Yemen. In early to mid-2015, congressional interest in U.S. foreign policy in the Middle East centered on the Iran nuclear deal and Operation Inherent Resolve against the Islamic State in Iraq and Syria. Several months after the March 2015 intervention, the Saudi-led coalition had not achieved a conclusive victory and what modest gains had been made on the ground were offset by mounting international criticism of growing civilian casualties from coalition air strikes. In Congress, several lawmakers began to express concern about the deteriorating humanitarian situation in Yemen. In late September 2015, Representative Ted W. Lieu wrote a letter to the Joint Chiefs of Staff advocating for a halt to U.S. support for the Saudi-led coalition until it instituted safeguards to prevent civilian casualties. In October 2015, 10 Members of Congress wrote a letter to President Obama urging him to "work with our Saudi partners to limit civilian casualties to the fullest extent possible." In October 2015, Senator Markey stated that "I fear that our failure to strongly advocate diplomacy in Yemen over the past two years, coupled with our failure to urge restraint in the face of the crisis last spring, may put the viability of this critical [U.S.-Saudi] partnership at risk." By the fall of 2015, as the Obama Administration tried to balance its concern for adhering to the laws of armed conflict with its support for Gulf partners, lawmakers began to express their concern over U.S. involvement in the coalition's intervention by scrutinizing U.S. arms sales to Saudi Arabia. When the Administration informally notified Congress of a proposed sale of precision guided munitions (PGMs) to Saudi Arabia, some Senators sought to delay its formal notification. After the formal notification in November 2015, Senate Foreign Relations Committee (SFRC) leaders jointly requested that the Administration notify Congress 30 days prior to associated shipments, marking the first use of this prior notification request authority. At that time, no related joint resolutions of disapproval on proposed sales of PGMs to the kingdom were introduced, but the delay and additional notification request demonstrated congressional concern. By the one-year anniversary of the Saudi-led intervention in Yemen, a more defined opposition to U.S. support for the coalition had begun to coalesce amid repeated international documentation of human rights abuses and errant coalition airstrikes. In April 2016, legislation was introduced that sought to place conditions on future proposed sale notifications, previously approved sales, or transfers of PGMs to Saudi Arabia. Proposed amendments to FY2017 defense legislation would have added some similar conditions on the use of funds to implement sales of PGMs or prohibited the transfer of cluster munitions to Saudi Arabia. The PGM amendment was not considered, but the cluster munitions amendment was narrowly defeated in a June 2016 House floor vote. In the spring and summer of 2016, the United Nations held multiple rounds of peace talks in Kuwait aimed at brokering an end to the conflict. From April 2016 to August 2016, the Saudi-led coalition had largely spared Yemen's capital Sanaa from aerial strikes as part of its commitment to the cessation of hostilities. When U.N.-mediated peace talks collapsed in August 2016, the Saudi-led coalition resumed bombing and the war intensified. During the summer of 2016, the Obama Administration reduced some U.S. support for Saudi Arabia's air campaign in Yemen by withdrawing U.S. personnel assigned to a joint U.S.-Saudi planning cell. Nevertheless, overall U.S.-Saudi cooperation continued and, in August 2016, the Obama Administration notified Congress of a proposed sale of M1A2S tanks to Saudi Arabia. In response, some lawmakers wrote to request that President Obama withdraw the proposal, citing concerns about Yemen. In September 2016, joint resolutions of disapproval of the proposed tank sale were introduced in the Senate ( S.J.Res. 39 ) and House ( H.J.Res. 98 ). On September 21, 2016, the Senate voted to table a motion to discharge the SFRC from further consideration of S.J.Res. 39 (71-27, Record Vote 145). During debate over the motion, many Senators argued in favor of continued U.S. support for Saudi Arabia, with Senator Lindsey Graham remarking "To those who want to vote today to suspend this aid to Saudi Arabia, people in Iran will cheer you on." In the wake of an October 2016 Saudi airstrike on a funeral hall in Sanaa that killed 140 people, the Obama Administration initiated a review of U.S. security assistance to Saudi Arabia. Based on that review, it put a hold on a planned sale of precision guided munitions (PGMs) to Saudi Arabia and limited intelligence sharing, but maintained counterterrorism cooperation and refueling for coalition aircraft. In the final months of the Obama Administration, U.S. Armed Forces briefly exchanged fire with forces party to the conflict. In October 2016, Houthi-Saleh forces launched anti-ship missiles at U.S. Navy vessels on patrol off the coast of Yemen. The attacks against the U.S. ships marked the first time U.S. Armed Forces had come under direct fire in the war. The Obama Administration responded to the attacks against U.S. naval vessels by directing the Armed Forces to fire cruise missiles against Houthi-Saleh radar installations. The Obama Administration described the U.S. strikes as self-defense and indicated that it did not want to deepen its direct involvement in the conflict. In August and November 2016, then-Secretary of State John Kerry made several attempts to broker a peace initiative in Oman, but his efforts were rejected by the parties themselves. By the end of 114 th Congress, the war in Yemen was becoming a more significant foreign policy issue for lawmakers. While a growing number of Members were becoming critical of the U.S. role in supporting the Saudi-led coalition amid a deteriorating humanitarian situation in Yemen, more lawmakers still viewed the conflict through a regional lens rather than as a localized affair. Amid significant congressional opposition to the 2015 nuclear agreement with Iran (Joint Comprehensive Plan of Action or JCPOA), some Members viewed Iran's support for the Houthi movement and the broader conflict in Yemen as an example of Iran's malign regional activities not directly addressed by the JCPOA. As the Houthis targeted Gulf state infrastructure on land and vessels at sea, their behavior was touted as evidence of Iran's growing capabilities to threaten U.S. and Gulf security. Just as some Members considered the Yemen conflict primarily a proxy war between the Iran-backed Houthis and the Saudi-led coalition, others viewed it as a test of long-standing U.S. commitments to supporting Saudi Arabian security. Supporters of the relationship, while acknowledging that Saudi Arabia's conduct of the war was at times problematic, argued that to curtail U.S. arms sales or other defense support to the kingdom would weaken a vital partner that was under threat from a hostile nonstate actor on its southern border. Others lawmakers charged that continued U.S. support for the coalition was not improving coalition behavior but damaging the U.S. reputation for upholding commitments to international law and human rights. Legislation seeking to limit U.S. arms sales to Saudi Arabia was not enacted in the 114 th Congress, but marked the beginning of the broader congressional debate that has continued. As the Trump Administration prepared to assume office, human rights organizations and aid groups were pressing Congress to become more attuned to the growing humanitarian crisis in Yemen. Though the Obama Administration had taken some steps, particularly in late 2016, to limit U.S.-coalition cooperation and restrict deliveries of PGMs to Saudi Arabia, nongovernmental groups deemed such action as insufficient. According to Human Rights Watch, "Whatever conditionality the Obama administration thought it had created—in holding up the transfer of precision munitions near the tail end of Obama's term and suspending cluster munition transfers earlier—ultimately did not have meaningful impact in reining in the continued Saudi-led coalition attacks on civilians." From the beginning of his Administration, President Donald Trump has signaled strong support for the Saudi-led coalition's operations in Yemen as a bulwark against Iranian regional interference. He initiated a review of U.S. policy toward Yemen, including President Obama's October 2016 restrictions on U.S. arms sales and intelligence sharing to the coalition. On March 19, 2017, just prior to his visit to Saudi Arabia, President Trump notified Congress that he was proceeding with three proposed direct commercial sales of precision guided munitions technology deferred by the Obama Administration, subject to congressional review. In May 2017, the Administration officially notified Congress of its intention to proceed with proposed sales of precision guided munitions technologies that the Obama Administration had deferred, while announcing plans to increase training for Saudi Arabia's air force on both targeting and the Law of Armed Conflict. Congress debated another resolution of disapproval ( S.J.Res. 42 ) of these proposed PGM sales in June 2017 (see below). After completing the policy review in July 2017, President Trump directed his Administration "to focus on ending the war and avoiding a regional conflict, mitigating the humanitarian crisis, and defending Saudi Arabia's territorial integrity and commerce in the Red Sea." As President Trump entered office, the dynamics of the conflict in Yemen were changing, and the coalition launched a new offensive along Yemen's 280-mile western coastal plain ultimately aimed at taking the strategic Houthi-held port city of Hudaydah. In early 2017, the coalition's gradual advance toward Hudaydah, coupled with an ongoing deterioration in humanitarian conditions, sparked some Members of Congress to implore the Administration to improve aid access and negotiate a cease-fire. In March 2017, several House Members wrote a letter to then-Secretary of State Rex Tillerson urging him to "use all U.S. diplomatic tools to help open the Yemeni port of Hodeida [Hudaydah] to international humanitarian aid organizations." A month later, another group of House Members wrote to President Trump stating that Congress should approve any new U.S. support to the coalition amid its offensive against Hudaydah. On June 13, 2017, the Senate debated another resolution ( S.J.Res. 42 ) to disapprove of three direct commercial sales of PGMs to Saudi Arabia. During Senate floor consideration over the motion to discharge the Senate Foreign Relations Committee from further consideration of S.J.Res. 42 , Members once again weighed various issues, such as the U.S.-Saudi bilateral relationship, countering Iran, and limiting U.S. involvement in the war in Yemen. Some lawmakers suggested that U.S. arms sales and military support to the coalition had enabled alleged violations of international humanitarian law, while others argued that U.S. support to the coalition improved its effectiveness and helps minimize civilian casualties. For example, during floor debate, Senator Graham argued that "If we are worried about collateral damage in Yemen, I understand the concern. Precision weapons would help that cause, not hurt it." Senator Murphy retorted, saying "What we are asking for is to hold off on selling these precision-guided munitions until we get some clear promise—some clear assurance—from the Saudis that they are going to use these munitions only for military purposes and that they are going to start taking steps—real steps, tangible steps—to address the humanitarian crisis." On June 13, 2017, the Senate voted to reject the motion to discharge the Senate Foreign Relations Committee from further consideration (47-53, Record Vote 143), and a companion resolution was not taken up in the House ( H.J.Res. 102 ). Representative Ro Khanna introduced a concurrent resolution ( H.Con.Res. 81 ) pursuant to the War Powers Resolution ( P.L. 93-148 ) in a bid to end U.S. support for the coalition's military intervention. After consultation between House leaders and supporters of the resolution on a compromise approach, the House agreed to delay expedited consideration of the resolution until after the November 2016 election and then adopted a nonbinding alternative ( H.Res. 599 , 366-30, 1 Present, Roll no. 623). In his first year in office, while President Trump sought to improve relations with Saudi Arabia, counter Iran, and increase U.S. counterterrorism activity in Yemen, his Administration also at times took strong positions on the need for members of the coalition to improve humanitarian access, pursue a settlement to the conflict, and take measures to prevent civilian casualties. After a Houthi-fired missile with alleged Iranian origins landed deep inside Saudi Arabia in November 2017, the coalition instituted a full blockade of all of Yemen's ports, including the main port of Hudaydah, exacerbating the country's humanitarian crisis. The White House issued four press statements on the conflict between November 8 and December 8, including a statement on December 6 in which President Trump called on Saudi Arabia to "completely allow food, fuel, water, and medicine to reach the Yemeni people who desperately need it. This must be done for humanitarian reasons immediately." On December 20, 2017, the Saudi-led coalition announced that it would end its blockade of Hudaydah port for a 30-day period and permit the delivery of four U.S.-funded cranes to Yemen to increase the port's capability to off-load commercial and humanitarian goods. The next day, the White House issued a statement welcoming "Saudi Arabia's announcement of these humanitarian actions in the face of this major conflict." As the Saudi-led coalition intervention entered its fourth year, some in the Senate also proposed use of the War Powers Resolution as a tool for ending U.S. support for the coalition's military intervention. On February 28, 2018, Senator Bernie Sanders introduced S.J.Res. 54 , a joint resolution to "direct the removal of United States Armed Forces from hostilities in the Republic of Yemen that have not been authorized by Congress (except for those U.S. forces engaged in counterterrorism operations directed at al Qaeda or associated forces)." Efforts in the Senate followed a late 2017 attempt in the House (see Table 1 below), in which a concurrent resolution directing the President to remove U.S. forces from Yemen was tabled in favor of a House-passed nonbinding resolution. Throughout 2018, between Congress and the Trump Administration and within Congress itself, there was disagreement as to whether U.S. forces assisting the Saudi-led coalition have been introduced into active or imminent hostilities for purposes of the War Powers Resolution. Some Members claimed that by providing support to the Saudi-led coalition, U.S. forces have been introduced into a "situation where imminent involvement in hostilities is clearly indicated" based on the criteria of the War Powers Resolution. The Trump Administration disagreed. In February 2018, the Acting Department of Defense General Counsel wrote to Senate leaders describing the extent of current U.S. support , and reported that "the United States provides the KSA-led coalition defense articles and services, including air-to-air refueling; certain intelligence support; and military advice, including advice regarding compliance with the law of armed conflict and best practices for reducing the risk of civilian casualties." On March 20, 2018, the Senate considered S.J.Res. 54 on the floor. During debate, arguments centered on a number of issues, ranging from concern over exacerbating Yemen's humanitarian crisis to reasserting the role of Congress in authorizing the use of armed force abroad. After then-Foreign Relations Committee Chairman Senator Bob Corker promised to propose new legislation and hold hearings scrutinizing U.S. policy in Yemen, a majority of Senators voted to table a motion to discharge the Foreign Relations committee from further consideration of S.J.Res. 54 . Senator Robert Menendez made remarks expressing conditional support for Senator Corker's approach, a view shared by some other Senators who voted to table the motion. The Foreign Relations Committee held a hearing on Yemen a month later. In parallel testimony before Congress, U.S. defense officials stated that while the United States refueled Saudi aircraft and provided advice on targeting techniques, CENTCOM did not track coalition aircraft after they were refueled and did not provide advice on specific targets. Then-Assistant Secretary of Defense for International Security Affairs Robert S. Karem testified that "It's correct that we do not monitor and track all of the Saudi aircraft aloft over Yemen." During the same hearing, U.S. officials acknowledged that pressure from Congress has altered how the Administration deals with the coalition over the Yemen conflict. Acting Assistant Secretary of State for Near Eastern Affairs David Satterfield told Senator Todd Young and the SFRC the following: Senator, your efforts, the efforts of your colleagues in this body and on this Committee have been exceedingly helpful in allowing the Administration to send a message from whole of government regarding the very specific concerns we have over any limitations, restrictions, constraints on the ability of both humanitarian and commercial goods specifically to include fuel to have unrestricted and expeditious entry into Yemen. And that messaging which comes from us, the Executive Branch, also comes from this body is extremely important. After the promised hearing, the Senate Foreign Relations Committee also proposed new legislation to place conditions on U.S. assistance to the coalition. In May, the committee reported S.J.Res. 58 to the Senate; it would have prohibited the obligation or expenditure of U.S. funds for in-flight refueling operations of Saudi and Saudi-led coalition aircraft that were not conducting select types of operations if certain certifications cannot be made and maintained. The Senate Armed Services Committee incorporated the provisions of the SFRC-reported text of S.J.Res. 58 as Section 1266 of the version of the FY2019 National Defense Authorization Act (NDAA) that it reported to the Senate on June 5, 2018 ( S. 2987 ). The provision was modified further and passed by both the House and Senate as Section 1290 of the conference version of the FY2019 NDAA ( H.R. 5515 ). It was signed into law as P.L. 115-232 in mid-August, giving the Administration until mid-September 2018 to make certain certifications. In a statement accompanying the President's signing of P.L. 115-232 into law, President Trump objected to provisions such as Section 1290, stating the Administration's view that such provisions "encompass only actions for which such advance certification or notification is feasible and consistent" with "[his] exclusive constitutional authorities as Commander in Chief and as the sole representative of the Nation in foreign affairs." As Congress continued to question the role of the United States in supporting coalition operations in Yemen, the pace and scale of fighting on the ground increased dramatically by the summer of 2018. On June 12, 2018, the Saudi-led coalition launched "Operation Golden Victory," aimed at retaking the Red Sea port city of Hudaydah. As coalition forces engaged Houthi militants in and around Hudaydah, humanitarian organizations warned that if port operation ceased, famine could become widespread throughout northern Yemen. On June 12, nine Senators wrote a letter to Secretary of State Pompeo and then-Secretary of Defense Mattis saying, "We are concerned that pending military operations by the UAE and its Yemeni partners will exacerbate the humanitarian crisis by interrupting delivery of humanitarian aid and damaging critical infrastructure. We are also deeply concerned that these operations jeopardize prospects for a near-term political resolution to the conflict." Several weeks later, Senator Robert Menendez, the ranking member on the Senate Foreign Relations Committee, placed a hold on a potential U.S. sale of precision guided munitions to Saudi Arabia and the United Arab Emirates. In a June 28 letter to Secretary of State Pompeo and Secretary of Defense Mattis, Senator Menendez said, I am not confident that these weapons sales will be utilized strategically as effective leverage to push back on Iran's actions in Yemen, assist our partners in their own self-defense, or drive the parties toward a political settlement that saves lives and mitigates humanitarian suffering…. Even worse, I am concerned that our policies are enabling perpetuation of a conflict that has resulted in the world's worst humanitarian crisis. On August 9, the coalition conducted an airstrike that hit a bus in a market near Dahyan, Yemen, in the northern Sa'ada governorate adjacent to the Saudi border. The strike reportedly killed 51 people, 40 of whom were children. The coalition claims that its airstrike was a "legitimate military operation" and conducted in response to a Houthi missile attack on the Saudi city of Jizan a day earlier that killed a Yemeni national in the kingdom. The U.S. State Department called on the Saudi-led coalition to conduct a "thorough and transparent investigation into the incident." Several Members of Congress wrote to the Administration seeking additional information regarding U.S. operations in the wake of the August 2018 coalition strike at Dahyan. Several Senators also submitted an amendment to the FY2019 Defense Department appropriations act ( H.R. 6157 ) that would have prohibited the use of funds made available by the act to support the Saudi-led coalition operations in Yemen until the Secretary of Defense certifies in writing to Congress that the coalition air campaign "does not violate the principles of distinction and proportionality within the rules for the protection of civilians." The provision did not apply to support for ongoing counterterrorism operations against Al Qaeda and the Islamic State in Yemen. On September 12, Secretary of State Mike Pompeo issued a certification that would allow the use of FY2019 defense funds to support in-flight refueling of coalition aircraft to continue, per the terms of Section 1290 (see discussion above) of the FY2019 National Defense Authorization Act (NDAA, P.L. 115-232 ). Some Members of Congress criticized the Administration's actions, asserting that the coalition has not met the act's specified benchmarks for avoiding civilian casualties in Yemen. On September 26, several House Members introduced H.Con.Res. 138 , which sought to direct the President to remove U.S. Armed Forces from hostilities in Yemen, except for Armed Forces engaged in operations authorized under the 2001 Authorization for Use of Military Force, within 30 days unless and until a declaration of war or specific authorization for such use has been enacted into law. In response to a similar initiative in the Senate, the Administration submitted a detailed argument expressing its view that U.S. forces supporting Saudi-led coalition operations are not engaged in hostilities in Yemen. By late 2018, the prospect of widespread famine in Yemen coupled with international reprobation over the killing of Jamal Khashoggi pressured the Administration and the coalition to accelerate moves toward peace talks. On October 30, then-Secretary of Defense James Mattis and Secretary of State Mike Pompeo called for all parties to reach a cease-fire and resume negotiations. On November 9, Secretary Mattis further announced that effective immediately, the coalition would use its own military capabilities—rather than U.S. capabilities—to conduct in-flight refueling in support of its operations in Yemen. Though fighting continued along several fronts, on December 13, 2018, Special Envoy of the United Nations Secretary-General for Yemen Martin Griffiths brokered a cease-fire centered on the besieged Red Sea port city of Hudaydah (Yemen's largest port). As part of the U.N.-brokered deal (known as the Stockholm Agreement), the coalition and the Houthis agreed to redeploy their forces outside Hudaydah city and port. The United Nations agreed to chair a Redeployment Coordination Committee (RCC) to monitor the cease-fire and redeployment. The international community praised the Stockholm Agreement as a first step toward broader de-escalation and a possible road map to a comprehensive peace settlement. Also on December 13, 2018, the Senate amended and passed S.J.Res. 54 (56-41), which, among other things, directed the President to remove U.S. forces from hostilities in Yemen, except U.S. forces engaged in operations directed at Al Qaeda or associated forces. In the House, lawmakers twice narrowly approved rules resolutions containing provisions that made similar resolutions directing the President to remove U.S. forces from hostilities in Yemen ineligible for expedited consideration ( H.Res. 1142 and H.Res. 1176 ). On December 13, the Senate also passed S.J.Res. 69 , which, among other things, expresses the sense of the Senate that Saudi Crown Prince Mohammed bin Salman is responsible for the murder of the journalist Jamal Khashoggi and that there is no statutory authorization for United States involvement in hostilities in the Yemen civil war. The 115th Congress frequently debated the extent and terms of the United States' involvement in the ongoing conflict in Yemen. Lawmakers questioned the extent to which successive Administrations have adhered to existing law related to providing security assistance, including sales or transfers of defense goods and defense services, while upholding international human rights standards (e.g., 22 U.S.C. §2754 or 22 U.S.C. §2304). They also enacted new legislation that would condition or prohibit the use of U.S. funds for some activities related to Yemen and extend legislative oversight over the executive branch's policy toward the war in Yemen. While the House and its Rules Committee voted to make resolutions with respect to war powers and Yemen ineligible for expedited consideration, the Senate passage of S.J.Res. 54 at the conclusion of the 115 th Congress demonstrated growth in congressional opposition to U.S. involvement in the Saudi-led coalition intervention in Yemen relative to previous years. Over time, the balance of votes shifted in favor of measures that could be described as critical or restrictive of U.S. support for Saudi-led coalition operations with regard to arms sales, oversight measures, and war powers measures. Nevertheless, after nearly four years of conflict, it remains difficult to identify the locus of congressional consensus about Yemen. Many in the House and Senate state that they seek to preserve cooperative U.S.-Saudi relations in broad terms and express concern about Iranian activities in Yemen, while also expressing support for expanded humanitarian access and efforts to bring the conflict to a close. Some lawmakers express opposition to the intervention and U.S. involvement on moral grounds, citing errant coalition airstrikes and the prospect of a looming famine. Others argue the conflict's continuation creates opportunities for Iran and Sunni Islamist extremist groups to expand their influence and operations in Yemen. Still others may have come to oppose continued U.S. support for the intervention based on factors not directly related to Yemen itself, including the opaque mechanisms used by the executive branch to support the coalition and/or anger with the Saudi government over the killing of Jamal Khashoggi. It remains to be seen whether recent congressional consideration of Yemen legislation is a harbinger of broader efforts by Members of Congress to reassert congressional prerogatives toward U.S. foreign policy writ large. Measures to enhance oversight over U.S. support to the Saudi-led coalition and U.S. strategy toward Yemen have received broad bipartisan support, while proponents of other recently considered arms sales and war powers measures have used mechanisms to ensure privileged consideration of their proposals. The 116 th Congress may continue to debate U.S. support for the Saudi-led coalition and Saudi Arabia's conduct of the war in Yemen. It is uncertain whether lawmakers may also broaden the scope of their oversight activities beyond the current conflict to more fully address the root causes of Yemen's chronic instability. Even if the United States is no longer an active supporter of coalition military efforts, Yemen itself has been devastated by years of war and remains the world's worst humanitarian crisis. Experts expect Yemen to require sustained international attention and financial assistance in order to help local actors reach and sustain a political settlement. This suggests that Congress may grapple with questions about the conduct of U.S. diplomacy, the provision of U.S. security support, and the investment of U.S. assistance and defense funds for years to come.

Question: Write a one-page summary of the report 1.

Answer: CDC is responsible for detecting and responding to emerging health threats and controlling dangerous substances. In carrying out its mission, CDC relies on information technology systems to receive, process, and maintain sensitive data. Accordingly, effective information security controls are essential to ensure that the agency's systems and information are protected from misuse and modification. GAO was asked to examine information security at CDC. In June 2018, GAO issued a limited official use only report on the extent to which CDC had effectively implemented technical controls and an information security program to protect the confidentiality, integrity, and availability of its information on selected information systems. This current report is a public version of the June 2018 report. In addition, for this public report, GAO determined the extent to which CDC has taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement. For this report, GAO reviewed supporting documents regarding CDC's actions on previously identified recommendations and interviewed personnel at CDC. As GAO reported in June 2018, the Centers for Disease Control and Prevention (CDC) implemented technical controls and an information security program that were intended to safeguard the confidentiality, integrity, and availability of its information systems and information. However, GAO identified control and program deficiencies in the core security functions related to identifying risk, protecting systems from threats and vulnerabilities, detecting and responding to cyber security events, and recovering system operations (see table below). GAO made 195 recommendations to address these deficiencies. As of August 2018, CDC had made significant progress in resolving many of the security deficiencies by implementing 102 of 184 (about 55 percent) technical control recommendations, and partially implementing 1 of 11 information security program recommendations made in the June 2018 report. The figure shows the status of CDC's efforts to implement the 195 recommendations. Additionally, CDC has created remedial action plans to implement the majority of the remaining open recommendations by September 2019. Until CDC implements these recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and destruction.