*HomeU.S. Government Accountability Office*
Menu

      close


          
          
                          	
				
				
	
	
					Reports & Testimonies
									
																				
				
				
	
	
								Reports & Testimonies
													
																												
																						
							
																Recommendations Database
							
																												
																						
							
																Month in Review
							
																												
																						
							
																Order Copies
							
																												
																						
							
																Restricted Reports
							
																												
																						
							
																View Topics
							
																												
																						
							
																View Agencies
							
																												
																						
							
																Bid Protests & Appropriations Law
									
																				
				
				
	
	
								Bid Protests & Appropriations Law
													
																												
																						
							
																Bid Protests
							
																												
																						
							
																Appropriations Law
							
																												
																						
							
																Federal Vacancies Reform Act
							
																												
																						
							
																Other Legal
							
																												
																						
							
																About
									
																				
				
				
	
	
								About
													
																												
																						
							
																What GAO Does
							
																												
																						
							
																U.S. Comptroller General
							
																												
																						
							
																Careers
							
																												
																						
							
																Contact UsFor Congress
                                
                          
        
                Press Center
                                
                          
        
                Careers
                                
                          
        
                BlogSearch Breadcrumb
        Home
                            Reports & Testimonies
    Reports & Testimonies Reports & Testimonies
              
                          
                          
        
        
        Recommendations Database
              
                          
                          
        
        
        Month In Review
              
                          
                          
        
        
        Order Copies
              
                          
                          
        
        
        Restricted Reports
                                      
                                                            Filter Reports & Testimonies
        Skip to search results
    
    Publicly Released DatePast 6 MonthsPast Year
Custom Date Range
    
      StartEnd
By Topics(-)
Information Security
  (639)< Clear
  (2061)Agriculture and Food
  (3)Auditing and Financial Management
  (142)Budget and Spending
  (55)Business Regulation and Consumer Protection
  (9)Economic Development
  (21)Education
  (10)Employment
  (89)Energy
  (8)Equal Opportunity
  (7)Financial Markets and Institutions
  (48)GAO Mission and Operations
  (7)Government Operations
  (125)Health Care
  (41)Homeland Security
  (141)Housing
  (3)Human Capital
  (46)Information Management
  (40)Information Technology
  (124)International Affairs
  (10)Justice and Law Enforcement
  (181)National Defense
  (57)Natural Resources and Environment
  (10)Retirement Security
  (10)Science and Technology
  (11)Space
  (13)Tax Policy and Administration
  (37)Telecommunications
  (115)Transportation
  (21)Veterans
  (31)Worker and Family Assistance
  (7)
By Agency NameBureau of Indian Affairs
  (3)Bureau of Land Management
  (1)Centers for Disease Control and Prevention
  (1)Consumer Financial Protection Bureau
  (1)Department of Agriculture
  (13)Department of Commerce
  (60)Department of Defense
  (99)Department of Education
  (14)Department of Energy
  (37)Department of Health and Human Services
  (26)Department of Homeland Security
  (118)Department of Housing and Urban Development
  (7)Department of Justice
  (50)Department of Labor
  (4)Department of State
  (30)Department of the Air Force
  (13)Department of the Army
  (7)Department of the Interior
  (9)Department of the Navy
  (9)Department of the Treasury
  (51)Department of Transportation
  (28)Department of Veterans Affairs
  (43)Environmental Protection Agency
  (15)Executive Office of the President
  (92)Federal Aviation Administration
  (14)Federal Bureau of Investigation
  (13)Federal Communications Commission
  (5)Federal Deposit Insurance Corporation
  (19)Federal Emergency Management Agency
  (3)Federal Energy Regulatory Commission
  (8)Federal Trade Commission
  (7)Food and Drug Administration
  (2)Forest Service
  (2)General Services Administration
  (24)Internal Revenue Service
  (40)National Aeronautics and Space Administration
  (14)National Institutes of Health
  (1)National Oceanic and Atmospheric Administration
  (1)National Science Foundation
  (6)Nuclear Regulatory Commission
  (4)Office of Management and Budget
  (123)Office of Personnel Management
  (23)Small Business Administration
  (7)Social Security Administration
  (11)Transportation Security Administration
  (4)United States Coast Guard
  (9)United States Customs and Border Protection
  (6)United States Immigration and Customs Enforcement
  (8)United States Postal Service
  (9)United States Securities and Exchange Commission
  (18)GAO’s reports and testimonies give Congress, federal agencies, and the public timely, fact-based, non-partisan information that can improve government operations and save taxpayers billions of dollars.Jump To:
    Jump ToElder Abuse
          Services for Older Adults
          State and Local-Level Drivers and Trends
          State and Local Fiscal Projections
          Federal Borrowing
          Managing the Debt
          Summary of Funding Provisions
          Auditing the Government's Books
          Unpacking the Financial Report
          Highlights
          Recommendations
          Background
          About This Work
          About This Work
          Trends
          About the Center
          Why It's High Risk
          What Remains To Be Done
          Key Reports
          Newest COVID-Related Reports
          AI Use Cases
          Flood Insurance
          Past Pandemic-Related Reports
          CARES Act Oversight Reports
          All COVID-19 Reports
          Report Suspected Fraud
          Subjects
          How to Get Notified
          Past Reports
          Public Health Threats
          Explore the FY 2022 and 2023 Funds
          Lessons Learned
          Agency Reports
          Recent Reports
          Recommendations
          Supplemental Material
          Full Report
          Additional Data
          View Decision
          Downloads
          Previously Identified Actions
          Related Pages
          Associated Agencies
          Tough Choices and Opportunities Ahead
          Americas Fiscal Future Key Areas
          Retirement Security Key Areas
          Current List
          About The High Risk List
          Area Ratings
          Previous High Risk Products
          Search Federal Vacancies
          Past Federal Vacancies
          Violation Letters
          About the Yellow Book
          Advisory Council
          Related Resources
          Comment Letters
          Related Publications
          Contacts and Resources
          Major Issues Facing the Nation
          Meeting Strategic Challenges
          Additional Resources
          Resources
          GAO Contacts
          Mission Teams
          Operations and Staff Offices
          Organization Chart
          Why a Career at GAO?
          Am I Qualified?
          Company Culture
          Reasonable Accommodations
          Video Gallery
          Paid Internships
          Student Volunteers
          Professional Development Program
          Advancement
          Executive Candidate Program
          Summer Associates
          Externships
          Benefits
          Contacts
                    Most Recent Reports**1 - 20 of 639 Reports**
	
	

	
	  **Released on   Mar 7, 2024**
          Cybersecurity: Improvements Needed in Addressing Risks to Operational Technology
    GAO-24-106576
      Published:   Mar 7, 2024
. 
        Publicly Released:   Mar 7, 2024
.
    Operational technology systems control processes or production, and are often used in critical infrastructure—e.g., a system of sensors, controllers, and actuators that open and close the valves in oil pipelines. Cyberattacks pose a significant threat to these systems. The Cybersecurity and Infrastructure Security Agency provides technical assistance to help critical infrastructure owners and operators address those cyber risks. But owners and operators had some challenges...
      **Released on   Feb 7, 2024**
          Artificial Intelligence: Fully Implementing Key Practices Could Help DHS Ensure Responsible Use for Cybersecurity
    GAO-24-106246
      Published:   Feb 7, 2024
. 
        Publicly Released:   Feb 7, 2024
.
    While responsible use of artificial intelligence can improve security, irresponsible use may pose risks. We looked at what the Department of Homeland Security is doing to ensure responsible use of its AI for cybersecurity. DHS created a public inventory of "AI use cases"—how it uses AI. But DHS doesn't verify whether each case is correctly characterized as AI. Of the 2 cybersecurity cases in the...
      **Released on   Feb 1, 2024**
          Cybersecurity: National Cyber Director Needs to Take Additional Actions to Implement an Effective Strategy
    GAO-24-106916
      Published:   Feb 1, 2024
. 
        Publicly Released:   Feb 1, 2024
.
    Cyberattacks threaten federal information systems and the nation's critical infrastructure. The Office of the National Cyber Director leads national cyber policy and strategy. The Office has a plan to implement the White House's National Cybersecurity Strategy . As of January 2024, the strategy and plan provide a good foundation, but the Office still needs to include more details in the plan to ensure that the...
      **Released on   Jan 30, 2024**
          Critical Infrastructure Protection: Agencies Need to Enhance Oversight of Ransomware Practices and Assess Federal Support
    GAO-24-106221
      Published:   Jan 30, 2024
. 
        Publicly Released:   Jan 30, 2024
.
    Ransomware—software that makes data and systems unusable unless ransom is paid—can severely impact government operations and critical infrastructure. Such attacks have led to significant financial losses, health care disruptions, and more. Most federal agencies that lead and manage risk for 4 critical sectors—manufacturing, energy, healthcare and public health, and transportation systems—have assessed or plan to assess risks associated with ransomware. But agencies haven't fully gauged...
      **Released on   Jan 18, 2024**
          Cloud Security: Federal Authorization Program Usage Increasing, but Challenges Need to Be Fully Addressed
    GAO-24-106591
      Published:   Jan 18, 2024
. 
        Publicly Released:   Jan 18, 2024
.
    The Office of Management and Budget established the FedRAMP program to authorize secure cloud services for federal use. From 2019-23, agencies increased FedRAMP use—authorizations were up 60%. But some agencies reported using services that weren't FedRAMP-authorized. OMB still hasn’t fully implemented our previous recommendation to monitor program use. OMB is proposing new guidance that aims to help reduce the cost of pursuing FedRAMP authorizations. Some...
      **Released on   Jan 11, 2024**
          Cyber Diplomacy: State's Efforts Aim to Support U.S. Interests and Elevate Priorities
    GAO-24-105563
      Published:   Jan 11, 2024
. 
        Publicly Released:   Jan 11, 2024
.
    The U.S. and its allies face growing foreign cyber threats as international trade, communication, and critical infrastructure are increasingly dependent on the internet. In 2022, the State Department created the Bureau of Cyberspace and Digital Policy to consolidate its efforts and leadership of cyber-related activities into a single unit led by an Ambassador-at-Large. In doing so, State raised the profile of cyberspace as a diplomatic...
      **Released on   Jan 9, 2024**
          Cybersecurity: OMB Should Improve Information Security Performance Metrics
    GAO-24-106291
      Published:   Jan 9, 2024
. 
        Publicly Released:   Jan 9, 2024
.
    We reviewed how 23 civilian federal agencies implemented the Federal Information Security Modernization Act of 2014. Their implementation continued to be mostly ineffective. For example, inspectors general found that only 8 of 23 agencies had effective security programs in FY 2022. Agency officials identified practices—such as commitment from leadership—that could make the security programs more effective. Agencies and IGs also suggested FISMA metrics need to...
      **Released on   Dec 21, 2023**
          Medical Device Cybersecurity: Agencies Need to Update Agreement to Ensure Effective Coordination
    GAO-24-106683
      Published:   Dec 21, 2023
. 
        Publicly Released:   Dec 21, 2023
.
    Cybersecurity vulnerabilities that threaten medical devices aren't commonly exploited but still pose risks to hospital networks—and patients, according to a federal study. The Food and Drug Administration has primary responsibility for medical device cybersecurity. FDA formally collaborates with the Cybersecurity and Infrastructure Security Agency on security guidance for device manufacturers, public alerts about current vulnerabilities, and more. However, the agencies' formal agreement is 5 years...
      **Released on   Dec 4, 2023**
          Cybersecurity: Federal Agencies Made Progress, but Need to Fully Implement Incident Response Requirements
    GAO-24-105658
      Published:   Dec 4, 2023
. 
        Publicly Released:   Dec 4, 2023
.
    Federal agencies have made progress in preparing for and responding to cyber threats. For instance, agencies have improved their ability to detect, analyze, and handle incidents like ransomware attacks and data breaches. However, some agencies have not met the federal requirements for event logging—i.e., ensuring that cybersecurity incidents are tracked and that these tracking logs are appropriately retained and managed. Information from federal IT logs...
      **Released on   Nov 16, 2023**
          Federal Grants: Numerous Programs Provide Cybersecurity Support to State, Local, Tribal, and Territorial Governments
    GAO-24-106223
      Published:   Nov 16, 2023
. 
        Publicly Released:   Nov 16, 2023
.
    State, local, Tribal, and territorial governments increasingly rely on the internet to deliver essential services to the public—making them vulnerable to various cybersecurity risks. Federal funding could be used to help these governments improve their cybersecurity through 27 grant programs managed by eight federal agencies. None of them are specifically intended to fund cybersecurity, but they can be used that way. Four agencies tracked cybersecurity...
      **Released on   Sep 28, 2023**
          Cybersecurity Program Audit Guide
    GAO-23-104705
      Published:   Sep 28, 2023
. 
        Publicly Released:   Sep 28, 2023
.
    Federal cybersecurity is an urgent priority because it protects critical infrastructure, federal operations, and individuals' personal data. This guide gives analysts and auditors the methodologies, techniques, and audit procedures they need to evaluate the components of agencies' cybersecurity programs and systems. These components include risk management and incident response, among others. Over the last 3 decades, we've made thousands of recommendations to improve federal cybersecurity...
          Cybersecurity: State Needs to Expeditiously Implement Risk Management and Other Key Practices
    GAO-23-107012
      Published:   Sep 28, 2023
. 
        Publicly Released:   Sep 28, 2023
.
    The State Department carries out American diplomacy and helps shape U.S. foreign policy. Securing the IT systems that support State's mission is crucial to its ability to manage its cybersecurity risks. But State hasn't fully implemented its cybersecurity risk program. We found that it needs to: Implement processes to detect and respond to cybersecurity incidents Update hardware and software that aren't supported by vendors Strengthen...
      **Released on   Sep 26, 2023**
          Critical Infrastructure Protection: National Cybersecurity Strategy Needs to Address Information Sharing Performance Measures and Methods
    GAO-23-105468
      Published:   Sep 26, 2023
. 
        Publicly Released:   Sep 26, 2023
.
    Protecting critical infrastructure—like water and electricity—from cyberattacks is a national priority. Federal agencies and critical infrastructure owners and operators must share information to tackle increasingly complex cyber threats. Long-standing challenges, such as security concerns and timeliness, make this harder. For example, representatives from a nonfederal partner said the FBI briefed them on a cyber threat about 5 months after it was identified. We recommended monitoring...
      **Released on   Sep 12, 2023**
          Homeland Security: Office of Intelligence and Analysis Should Improve Privacy Oversight and Assessment of Its Effectiveness
    GAO-23-105475
      Published:   Aug 28, 2023
. 
        Publicly Released:   Sep 12, 2023
.
    The DHS Office of Intelligence and Analysis collects and shares homeland security data with its partners in law enforcement, the intelligence community, and the private sector. While doing so, it's important to protect U.S. citizens and residents' rights and privacy. But the office hasn't done some required audits that would ensure that its personnel are following policies to protect these rights. For example, auditing the...
      **Released on   Sep 11, 2023**
          Security of Taxpayer Information: IRS Needs to Address Critical Safeguard Weaknesses
    GAO-23-105395
      Published:   Aug 14, 2023
. 
        Publicly Released:   Sep 11, 2023
.
    Your tax returns are filled with sensitive personal and financial data—which you expect the IRS to protect. However, recent disclosures of sensitive taxpayer data have made headlines. We, and the Treasury Inspector General for Tax Administration, have also raised concerns about IRS's ability to safeguard taxpayer information. In this review, we found weaknesses in training, information systems, contractor oversight, information-sharing, and more. Of the related...
      **Released on   Jul 27, 2023**
          Cybersecurity Workforce: National Initiative Needs to Better Assess Its Performance
    GAO-23-105945
      Published:   Jul 27, 2023
. 
        Publicly Released:   Jul 27, 2023
.
    The National Institute of Standards and Technology leads a national initiative to help agencies and private sector organizations strengthen their cybersecurity workforces. NIST has documented the skills needed for a cybersecurity workforce; set up collaborative, public-private groups to build a cybersecurity community; and held meetings and conferences to share information. Having a well-trained cybersecurity workforce is a key government priority. So, it's important that NIST...
      **Released on   Jun 29, 2023**
          Cybersecurity: Launching and Implementing the National Cybersecurity Strategy
    GAO-23-106826
      Published:   Jun 29, 2023
. 
        Publicly Released:   Jun 29, 2023
.
    Federal agency information systems and national critical infrastructure are vulnerable to cyberattacks. This Snapshot covers the status of the National Cybersecurity Strategy. The strategy's goals and strategic objectives provide a good foundation, but the Administration needs to establish specific objectives and performance measures, resource requirements, and roles and responsibilities. It will be difficult to implement the strategy when the specific details have yet to be...
      **Released on   Jun 20, 2023**
          Cybercrime: Reporting Mechanisms Vary, and Agencies Face Challenges in Developing Metrics
    GAO-23-106080
      Published:   Jun 20, 2023
. 
        Publicly Released:   Jun 20, 2023
.
    Cybercrime, such as hacking and ransomware attacks, is increasing in the United States—leading to billions of dollars in losses and threatening public safety. Several federal agencies work to detect, investigate, and prosecute cybercrimes. Agencies vary in how they collect data on these crimes, and there is no official definition of cybercrime. As a result, this data may not be consistent or complete. In 2022, Congress...
      **Released on   Jun 7, 2023**
          Cybersecurity: Interior Needs to Address Threats to Federal Systems and Critical Infrastructure
    GAO-23-106869
      Published:   Jun 7, 2023
. 
        Publicly Released:   Jun 7, 2023
.
    The Department of the Interior protects and manages a number of the nation's natural resources. For example, it oversees safety and environmental standards at offshore oil and gas facilities. We testified that Interior could improve its cybersecurity programs and practices, including those at offshore facilities. A cyberattack on one of these facilities could do significant damage and disrupt oil and gas supplies. We've previously recommended...
      **Released on   May 18, 2023**
          Cloud Security: Selected Agencies Need to Fully Implement Key Practices
    GAO-23-105482
      Published:   May 18, 2023
. 
        Publicly Released:   May 18, 2023
.
    Cloud services—on-demand access to shared resources such as networks, servers, and data storage—can help federal agencies deliver better IT services for less money. But without effective security measures, these services can make agencies vulnerable to risks such as cyberattacks. We looked at how four agencies implemented key cloud security practices—like having a plan to respond to incidents. While the agencies implemented some of the security...
    
		Go back to search filters
	  1
              2
              3
              4
              5
              6
              7
              8
              9
                          ...
                          Next
                          Last
 Receive GAO Updates
  Stay informed as we add new reports & testimonies.

  Federal Depository Library Program member and GPO digital preservation partner.

    GAO Logo
      U.S. Government Accountability Office


                                   Column 1
                            Press Center
                              Contact Us
                              Inspector General
                              Restricted Reports
                              Column 2
                            Copyright & Terms of Use
                              Privacy Policy
                              Accessibility
                              Sitemap
                              Column 3
                            FOIA Requests
                              Scam Alerts
                              No FEAR Act Data
                              Health Care Advisory Committees