# Recent Reports

Reports News from the GAO

- Cybersecurity: Improvements Needed in Addressing Risks to Operational Technology What GAO FoundOperational technology (OT) systems and devices are used to control, among other things, distribution processes (e.g., oil and natural gas pipelines) and production systems (e.g., electric power generation). Figure 1 shows the key components of an OT system using a pipeline system as an illustrative example.Figure 1: Key Components of a Pipeline Operational Technology (OT) SystemAlthough 12 of the 13 selected nonfederal entities cited examples of positive experiences with the Cybersecurity and Infrastructure Security Agency's (CISA) OT products and services, CISA and seven of the nonfederal entities identified two types of associated challenges. Specifically:Seven selected nonfederal entities identified  negative experiences using CISA's products and services  as a challenge. For example, one nonfederal entity told GAO that vulnerabilities reported through CISA's process often take more than a year between the initial report of a vulnerability and public disclosure (see figure 2).CISA officials and one nonfederal entity identified the  insufficient CISA staff with requisite OT skills  as a challenge. For example, CISA officials stated that its four federal employees and five contractor staff on the threat hunting and incident response service are not enough staff to respond to significant attacks impacting OT systems in multiple locations at the same time.To address these types of challenges, best practices highlight the importance of (1) measuring customer service and (2) performing effective workforce planning. However, CISA has not fully addressed these practices. Until CISA does so, the agency will not be optimally positioned to deliver products and services needed to address OT risks.Figure 2: Cybersecurity and Infrastructure Security Agency (CISA) Operational Technology (OT) Cybersecurity Products and ServicesSix of the seven selected agencies cited examples of where their collaboration with CISA yielded positive outcomes to addressing cyber OT risks. However, four agencies also identified two challenges in coordinating with CISA: (1) CISA ineffectively sharing information with critical infrastructure owners and operators, and (2) CISA and the Pipeline and Hazardous Materials Safety Administration lacking a process to share cyber threat information with owners and operators.To address these types of challenges, it is important to adopt leading collaboration practices. However, CISA did not fully address any of five selected leading collaboration practices when coordinating with seven selected agencies (see table).Extent to Which the Cybersecurity and Infrastructure Security Agency (CISA) Addressed Selected Leading Collaboration Practices with Seven Selected Agencies to Mitigate Cyber Operational Technology Risks to Critical Infrastructure			Collaboration practices									CESER									DC3									FRA									NSA									PHMSA									TSA									USCG								Define common outcomes									◑									◑									◑									◑									◑									◑									◑								Ensure accountability									○									○									◑									○									◑									◑									◑								Bridge organizational cultures									◑									◑									◑									◑									◑									◑									◑								Clarify roles and responsibilities									◑									◑									◑									◑									◑									◑									◑								Develop and update written guidance and agreements									○									◑									○									○									○									○									◑					Source: GAO analysis of agency information. | GAO 24 106576Legend: ●=Generally addressed. ◑=Partially addressed. ○=Not addressed.Note: CESER (Cybersecurity, Energy Security, and Emergency Response), DC3 (Department of Defense Cyber Crime Center), FRA (Federal Railroad Administration), NSA (National Security Agency), PHMSA (Pipeline and Hazardous Materials Safety Administration), TSA (Transportation Security Administration), and USCG (U.S. Coast Guard).The practices were not fully addressed, in part, because of the lack of (1) guidance from CISA to the sector risk management agencies on how to update their plans for coordinating on critical infrastructure issues and (2) a CISA policy for developing agreements with sector risk management agencies with respect to collaboration. Until CISA takes action to address these weaknesses, it and the selected agencies will not be well-positioned to coordinate on mitigating cyber OT risks.Why GAO Did This StudyMuch of the nation's critical infrastructure relies on OT—systems that interact with the physical environment—to provide essential services. However, malicious cyber actors pose a significant threat to these systems. Federal law designates CISA as the lead agency in helping critical infrastructure owners and operators address cyber risks to OT.The National Defense Authorization Act of Fiscal Year 2022 includes a provision for GAO to report on CISA's support for industrial control systems. Federal guidance now addresses these systems under the broader category of OT. Accordingly, this report examines, among other things: (1) challenges in delivering CISA's OT products and services, and (2) challenges to collaborating between CISA and the seven selected agencies.GAO reviewed documentation describing CISA's 13 OT cybersecurity products and services. GAO also asked officials from CISA and 13 selected nonfederal entities to identify any challenges with the OT products and services. The selected entities included (1) councils representing one sector and three subsectors where OT was prevalent and the intelligence community highlighted their infrastructures as being at risk from cyber threat actors, (2) OT vendors who joined a CISA OT collaboration group, and (3) cybersecurity researchers that contributed to the development of CISA's OT advisories. GAO then compared CISA's efforts to address those challenges against leading practices regarding measuring customer service and workforce planning.In addition, GAO reviewed documentation describing CISA’s efforts to collaborate with seven selected agencies to mitigate cyber OT risks. The seven selected agencies are: (1) Department of Defense’s (DOD) Defense Cyber Crime Center (DC3); (2) DOD’s National Security Agency (NSA); (3) Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER); (4) Department of Homeland Security’s (DHS) Transportation Security Administration (TSA); (5) DHS’s U.S. Coast Guard (USCG); (6) Department of Transportation’s (DOT) Federal Railroad Administration (FRA); and (7) DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA). GAO focused on these agencies or departmental components because each was (1) within agencies designated as the lead for helping to protect the selected sector and three subsectors and (2) responsible for helping critical infrastructure owners and operators to mitigate cyber OT risks. GAO also asked officials from seven selected agencies to identify any challenges in collaborating with CISA to mitigate cyber OT risks. GAO then compared documentation from the seven agencies and CISA against five selected leading collaboration practices.
- Artificial Intelligence: Fully Implementing Key Practices Could Help DHS Ensure Responsible Use for Cybersecurity What GAO FoundTo promote transparency and inform the public about how artificial intelligence (AI) is being used, federal agencies are required by Executive Order No. 13960 to maintain an inventory of AI use cases. The Department of Homeland Security (DHS) has established such an inventory, which is posted on the Department's website.However, DHS's inventory of AI systems for cybersecurity is not accurate. Specifically, the inventory identified two AI cybersecurity use cases, but officials told us one of these two was incorrectly characterized as AI. Although DHS has a process to review use cases before they are added to the AI inventory, the agency acknowledges that it does not confirm whether uses are correctly characterized as AI. Until it expands its process to include such determinations, DHS will be unable to ensure accurate use case reporting.DHS has implemented some but not all of the key practices from GAO's AI Accountability Framework for managing and overseeing its use of AI for cybersecurity. GAO assessed the one remaining cybersecurity use case known as Automated Personally Identifiable Information (PII) Detection—against 11 AI practices selected from the Framework (see figure).Status of the Department of Homeland Security's Implementation of Selected Key Practices to Manage and Oversee Artificial Intelligence for CybersecurityGAO found that DHS fully implemented four of the 11 key practices and implemented five others to varying degrees in the areas of governance, performance, and monitoring. It did not implement two practices: documenting the sources and origins of data used to develop the PII detection capabilities, and assessing the reliability of data, according to officials. GAO's AI Framework calls for management to provide reasonable assurance of the quality, reliability, and representativeness of the data used in the application, from its development through operation and maintenance. Addressing data sources and reliability is essential to model accuracy. Fully implementing the key practices can help DHS ensure accountable and responsible use of AI.Why GAO Did This StudyExecutive Order No. 14110, issued in October 2023, notes that while responsible AI use has the potential to help solve urgent challenges and make the world more secure, irresponsible use could exacerbate societal harms and pose risks to national security. Consistent with requirements of Executive Order No. 13960, issued in 2020, DHS has maintained an inventory of its AI use cases since 2022.This report examines the extent to which DHS (1) verified the accuracy of its inventory of AI systems for cybersecurity and (2) incorporated selected practices from GAO's AI Accountability Framework to manage and oversee its use of AI for cybersecurity.GAO reviewed relevant laws, OMB guidance, and agency documents, and interviewed DHS officials. GAO applied 11 key practices from the Framework to DHS's AI cybersecurity use case—Automated PII Detection. DHS uses this tool to prevent unnecessary sharing of PII. GAO selected the 11 key practices to reflect all four Framework principles, align with early stages of AI adoption, and be highly relevant to the specific use case.
- Cybersecurity: National Cyber Director Needs to Take Additional Actions to Implement an Effective Strategy What GAO FoundThe  National Cybersecurity Strategy  and its implementation plan   jointly addressed four of six desirable characteristics identified in prior GAO work and partially addressed the other two (see figure).Extent to Which the March 2023  National Cybersecurity Strategy  and July 2023 Implementation Plan Addressed GAO's Desirable Characteristics of a National StrategyFor the partially addressed characteristics, the documents did not fully describe:Outcome-oriented performance measures.  Office of the National Cyber Director (ONCD) staff said it was not realistic to develop outcome-oriented measures at this point. However, GAO believes it is feasible to develop such measures where applicable. For example, regarding the key initiative of disrupting ransomware attempts, the Department of the Treasury already collects information on the number and dollar value of ransomware-related incidents—for 2021 the reported total dollar value was about $886 million. This demonstrates that developing such measures is feasible and can be used for measuring effectiveness.	Resources and estimated costs.  While the implementation plan outlined initiatives that require executive visibility and interagency coordination, it did not identify how much it will cost to implement the initiatives. ONCD staff said estimating the cost to implement the entire strategy was unrealistic. However, while certain initiatives may not warrant a specific cost estimate, other activities supporting some of the key initiatives with potentially significant costs justify the development of a cost estimate. Such cost estimates are essential to effectively managing programs. Without such information, uncertainty can emerge about investing in programs.Without actions to address these shortcomings, ONCD will likely lack information on plan outcomes and encounter uncertainty on funding of activities.Why GAO Did This StudyFor over 25 years GAO has identified cybersecurity as a high-risk area. During this period, the threat of cyber-based intrusions and attacks on IT systems by malicious actors has continued to grow.A national strategy to guide the government's cybersecurity activities is needed to address this threat. Recognizing the need for national cybersecurity leadership, Congress established ONCD to support the nation's cybersecurity and lead the development of a national strategy. In March 2023, the White House issued the  National Cybersecurity Strategy  to outline how the administration will manage the nation's cybersecurity. In July 2023, ONCD issued an implementation plan defining how the strategy will be executed.GAO's objective was to examine the extent to which the  National Cybersecurity Strategy  and implementation plan addressed desirable characteristics of a national strategy. To do so, GAO assessed relevant documents and other evidence against desirable characteristics of a national strategy. GAO also interviewed ONCD staff.
- Critical Infrastructure Protection: Agencies Need to Enhance Oversight of Ransomware Practices and Assess Federal Support What GAO FoundRansomware—software that makes data and systems unusable unless ransom payments are made—is having increasingly devastating impacts. For example, the Department of the Treasury reported that the total value of U.S. ransomware-related incidents reached $886 million in 2021, a 68 percent increase compared to 2020 (see figure).Treasury Reported Dollar Value of U.S. Ransomware-Related IncidentsIn addition to monetary losses, ransomware has led to other impacts, such as the inability to provide emergency care when hospital IT systems are unusable. The FBI reported that 870 critical infrastructure organizations were victims of ransomware in 2022, affecting 14 of the 16 critical infrastructure sectors. Among those incidents, almost half were from four sectors—critical manufacturing, energy, healthcare and public health, and transportation systems. The full impact of ransomware is likely not known because reporting is generally voluntary. The Department of Homeland Security is planning to issue new reporting rules by March 2024 that could provide a more complete picture of ransomware's impact.The four selected sectors' adoption of leading practices to address ransomware is largely unknown. None of the federal agencies designated as the lead for risk management for selected sectors have determined the extent of adoption of the National Institute of Standards and Technology's recommended practices for addressing ransomware. Doing so would help the lead federal agencies be a more effective partner in national efforts to combat ransomware.Most of the six selected lead federal agencies have assessed or plan to assess risks of cybersecurity threats including ransomware for their respective sectors, as required by law. Regarding lead agencies assessing their support of sector efforts to address ransomware, half of the agencies have evaluated aspects of their support. For example, agencies have received and assessed feedback on their ransomware guidance and briefings. However, none have fully assessed the effectiveness of their support to sectors, as recommended by the National Infrastructure Protection Plan. Fully assessing effectiveness could help address sector concerns about agency communication, coordination, and timely sharing of threat and incident information.Why GAO Did This StudyThe nation's 16 critical infrastructure sectors provide essential services such as electricity, healthcare, and gas and oil distribution. However, cyber threats to critical infrastructure, such as ransomware, represent a significant national security challenge.This report (1) describes the reported impact of ransomware attacks on the nation's critical infrastructure, (2) assesses federal agency efforts to oversee sector adoption of leading federal practices, and (3) evaluates federal agency efforts to assess ransomware risks and the effectiveness of related support.To do so, GAO selected four critical infrastructure sectors—critical manufacturing, energy, healthcare and public health, and transportation systems. For each sector, GAO analyzed documentation, such as incident reporting and risk analysis, and compared efforts to leading cybersecurity guidance. GAO also interviewed sector and federal agency officials to obtain information on ransomware-related impacts, practices, and support.
- Cloud Security: Federal Authorization Program Usage Increasing, but Challenges Need to Be Fully Addressed What GAO FoundThe Office of Management and Budget (OMB) established the Federal Risk and Authorization Management Program (FedRAMP) to provide a standardized approach for authorizing the use of cloud services. From July 2019 to April 2023, the 24 Chief Financial Officers (CFO) Act agencies increased the number of authorizations by about 60 percent. These authorizations covered services ranging from a basic computer infrastructure to a more full-service model that included software applications. OMB requires agencies to use FedRAMP. However, nine agencies reported they were using cloud services that were not FedRAMP authorized. OMB has not yet implemented GAO's recommendation to adequately monitor agencies' compliance with the program.Selected agencies and cloud service providers (CSP) provided estimated costs when pursuing FedRAMP authorizations; data on actual costs were limited. The estimated costs varied widely and ranged anywhere from tens of thousands to millions of dollars. This was due, in part, to the agencies and CSPs using varying methods to determine costs. A contributing factor to the varying methods was that OMB did not provide guidance on authorization costs to be tracked and reported. The lack of consistent cost data will also hamper OMB in determining whether its goal of reducing FedRAMP costs will be achieved.The selected agencies and CSPs identified six key challenges that they faced in pursuing FedRAMP authorizations (see table).Key Challenges Faced by Agencies and Cloud Service Providers (CSP) When Pursuing Federal Risk and Authorization Management Program (FedRAMP) Authorizations			Challenges									Description								Receiving timely responses from stakeholders									Agencies and CSPs reported that they had issues with receiving timely responses from stakeholders throughout the authorization process.								Sponsoring CSPs that were not fully prepared									Agencies reported that CSPs did not fully understand the FedRAMP process and lacked complete documentation.								Lacking sufficient resources									Agencies reported that they lacked the resources (e.g., funding and staffing) needed to sponsor an authorization.								Meeting FedRAMP technical and process requirements									CSPs reported that they had to update the infrastructure to meet federal security requirements.								Finding an agency sponsor									CSPs reported that finding an agency sponsor was difficult.								Engaging with third-party assessment organizations (3PAO)									CSPs reported that they faced issues (e.g., lack of consistency) when engaging with organizations that were responsible for performing independent assessments of their cloud services—3PAOs.					Source: GAO analysis. | GAO24106591In acknowledging these challenges, OMB and the FedRAMP program management office in the General Services Administration (GSA) already have efforts underway to address them. For example, OMB released proposed new FedRAMP guidance for public comment in October 2023. GSA also intends to, among other things, issue guidance on meeting certain technical requirements. However, OMB and GSA have not finalized these guidance documents or announced a schedule for doing so. As a result, agencies and CSPs may continue facing challenges, leading to additional costs to pursue authorizations.Why GAO Did This StudyOMB established the FedRAMP program in 2011. Managed by GSA, FedRAMP aims to ensure that cloud services have adequate information security while also reducing operational costs. To accomplish this goal, FedRAMP established a standardized process for authorizing CSPs' cloud services.The James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 includes a provision for GAO to review the status of the FedRAMP program. GAO's objectives were to identify (1) the frequency and types of services agencies have used under FedRAMP; (2) the amounts of costs incurred by selected agencies and CSPs in pursuing FedRAMP authorizations; and (3) the key challenges selected agencies and CSPs face in the authorization process and determine the extent to which GSA and OMB have taken actions to address them.GAO analyzed questionnaire responses from six selected CFO Act agencies and 13 selected CSPs. GAO selected these agencies and CSPs based on several factors, including the number of authorizations agencies had sponsored, the authorization path used by the CSPs, and whether a CSP was a small business. GAO also reviewed GSA and OMB data and interviewed appropriate agency and CSP officials.
- Cyber Diplomacy: State's Efforts Aim to Support U.S. Interests and Elevate Priorities What GAO FoundThe Department of State (State) conducts a range of diplomatic and foreign assistance activities intended to support objectives identified in the 2023 National Cybersecurity Strategy. Specifically, State engages in multilateral fora and agreements that aim to strengthen norms of responsible state behaviors, deter unacceptable state behaviors, and advance cyber policies. For example, State worked with the United Nations Group of Governmental Experts and Open-Ended Working Group to develop a framework on behavior in cyberspace, including a set of peacetime norms and confidence building measures. According to State officials, establishing cyber norms, including enforcing consequences for rule-breakers, raises the cost of bad behavior in cyberspace and deters wrongdoing. State also engages in bilateral activities to promote U.S. aligned cyber norms and policies, such as working with Denmark to advance the Copenhagen Pledge on Tech for Democracy. This pledge intends to counter authoritarian repression of free speech online and advance digital freedom globally. In addition, State provides foreign assistance, such as training and technical assistance, to strengthen partner capacity all over the world.New Entities State Created to Elevate Cyber PrioritiesState established the Bureau of Cyberspace and Digital Policy (CDP) in April 2022 to elevate cyber priorities and is taking steps to address some of the challenges the new bureau faces as it works to promote U.S. cyber interests. State consolidated its efforts and leadership of cyberspace-related activities into CDP—a single unit led by an Ambassador-at-Large. Previously, several entities within State shared responsibility for cyber diplomacy. GAO found that this change has helped to better position State to achieve its cyber diplomacy goals. For example, CDP's ambassador level leadership has enabled engagement with higher levels of foreign government officials and raised the U.S. profile on cyber globally. GAO also found that State addressed relevant leading reform practices when forming the Bureau. For example, State has an implementation team dedicated to addressing capacity staffing, resources, and change management. CDP still faces challenges as it pursues cyber goals under the reformed structure, such as needing to clarify roles between the bureau and its partners. However, CDP officials identified steps that they are taking to address them.Why GAO Did This StudyThe U.S. and its allies face intensifying foreign cyber threats as international trade, communication, and critical infrastructure grow more dependent on digital technology. State and non-state actors are using cyberspace increasingly as a platform for irresponsible behavior to undermine democracies. The Department of State leads U.S. government international efforts to advance U.S. interests in cyberspace. In April 2022 State stood up CDP with a mission to address national security challenges, economic opportunities, and implications to U.S. values associated with cyberspace, digital technologies, and digital policy.The James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 includes a provision for GAO to review U.S. diplomatic efforts to advance interests in cyberspace and other related matters. This report examines, among other things, (1) activities State is undertaking to advance U.S. interests regarding cyberspace, including the use of international agreements and fora, and (2) the extent to which organizational changes have helped position or presented challenges for State to achieve its cyber diplomacy goals.To identify State's activities, GAO analyzed program documents and discussed implementation of strategic objectives with officials from State. To examine State's organizational changes, GAO analyzed documentation of State's reform plans and implementation, and evaluated the extent to which State addressed selected practices identified by GAO as important to reform.For more information, contact Latesha Love-Grayer at (202) 512-4409 or lovegrayerl@gao.gov.
- Cybersecurity: OMB Should Improve Information Security Performance Metrics What GAO FoundFederal agencies' implementation of the Federal Information Security Modernization Act of 2014   (FISMA) continued to be mostly ineffective. Although some improvement was reported from 2021 to 2022, inspectors general (IG) of 15 of the 23 civilian agencies found the information security programs to be ineffective (see figure). IGs reported various causes for the ineffective programs, including management accountability issues and gaps in standards and quality control. Addressing the causes could improve the federal government's cybersecurity posture.23 Chief Financial Officers Act of 1990 Agencies That Do or Do Not Have Effective Information Security Programs, as Reported by Inspectors General, Fiscal Years 2017 through 2022.Agency officials identified various practices that have contributed to improving the effectiveness of their agency's information security program. Specifically, officials most often highlighted internal communication; organizational characteristics, such as leadership commitment; and centralized policies and procedures as being essential to effectively implement FISMA.The Office of Management and Budget (OMB), in collaboration with other oversight groups, provides metrics to evaluate the effectiveness of federal information security programs and implementation of FISMA. However, agencies and IGs stated that some FISMA metrics are not useful because they do not always accurately evaluate information security programs. Agencies and IGs reported that metrics should be clearly tied to performance goals, account for workforce issues and agency size, and incorporate risk. Further, crafting metrics that address the key causes of ineffective programs could enhance their effectiveness. By modifying FISMA metrics in these ways, OMB could help ensure that the measures provide an accurate picture of agencies' information security performance.Why GAO Did This StudyTo protect federal information and systems, FISMA requires federal agencies to develop, document, and implement information security programs. FISMA includes a provision for GAO to periodically report on agencies' implementation of the act.GAO's objectives in this report were to identify (1) the reported effectiveness of agencies' efforts to implement FISMA; (2)&nbsp;the key practices used by agencies to meet FISMA requirements; and (3)&nbsp;how FISMA metrics could be changed to better measure the effectiveness of federal agency information security programs.To do so, GAO reviewed the 23 civilian Chief Financial Officers Act of 1990 (CFO Act) agencies' FISMA reports, agency reported performance data, and OMB documentation and guidance. The Department of Defense (DOD) was not included in GAO's analysis of performance data due to DOD's classification of the information. GAO also solicited perspectives from the 24 CFO Act agencies (including DOD) and interviewed officials with the Council of Inspectors General on Integrity and Efficiency, the Cybersecurity and Infrastructure Security Agency, and OMB.
- Medical Device Cybersecurity: Agencies Need to Update Agreement to Ensure Effective Coordination What GAO FoundAccording to the Department of Health and Human Services (HHS), available data on cybersecurity incidents in hospitals do not show that medical device vulnerabilities have been common exploits. Nevertheless, HHS maintains that such devices are a source of cybersecurity concern warranting significant attention and can introduce threats to hospital cybersecurity (see figure).Figure: Example of a Compromised Medical Device That Can Lead to Disruption of Other Devices on a Hospital NetworkNon-federal entities representing health care providers, patients, and other relevant parties identified challenges in accessing federal support to address cybersecurity vulnerabilities. Entities described challenges with (1) a lack of awareness of resources or contacts and (2) difficulties understanding vulnerability communications from the federal government. Agencies are taking steps that, if implemented effectively, can meet these challenges.Key agencies are also managing medical device cybersecurity through active coordination. Specifically, the Food and Drug Administration (FDA) and the Cybersecurity and Infrastructure Security Agency (CISA) developed an agreement addressing most leading practices for collaboration. However, this 5-year-old agreement did not address all such practices and needs to be updated to reflect organizational and procedural changes that have occurred since 2018.FDA authority over medical device cybersecurity has recently increased. Specifically, December 2022 legislation requires medical device manufacturers to submit to FDA, among other things, their plans to monitor, identify, and address cybersecurity vulnerabilities for any new medical device that is to be introduced to consumers starting in March 2023. This legislation is limited to new devices and does not retroactively apply to those devices introduced prior to March 2023, unless the manufacturer is submitting a new marketing application for changes to the device.FDA officials are implementing new cybersecurity authorities and have not yet identified the need for any additional authority. They can take measures to help ensure device cybersecurity under existing authorities such as monitoring health sector and CISA alerts, as well as directing manufacturers to communicate vulnerabilities to user communities and to remediate the vulnerabilities.According to FDA guidance, if manufacturers do not remediate vulnerabilities, FDA may find the device to be in violation of federal law and subject to enforcement actions.Why GAO Did This StudyCyber threats that target medical devices could delay critical patient care, reveal sensitive patient data, shut down health care operations, and necessitate costly recovery efforts. FDA is responsible for ensuring that medical devices sold in the U.S. provide reasonable assurance of safety and effectiveness.The Consolidated Appropriations Act, 2023, includes a provision for GAO to review cybersecurity in medical devices. This report addresses the extent to which (1) relevant non-federal entities are facing challenges in accessing federal support on medical device cybersecurity, (2) federal agencies have addressed identified challenges, (3) key agencies are coordinating on medical device cybersecurity, and (4) limitations exist in agencies' authority over medical device cybersecurity.GAO identified federal agencies with roles in medical device cybersecurity. It also selected 25 non-federal entities representing health care providers, patients, and medical device manufacturers. GAO interviewed these entities on challenges in accessing federal cybersecurity support. In addition, GAO assessed agency documentation and compared coordination efforts against leading collaboration practices; reviewed relevant legislation and guidance; and interviewed agency officials.
- Cybersecurity: Federal Agencies Made Progress, but Need to Fully Implement Incident Response Requirements What GAO FoundFederal agencies rely upon the following for cybersecurity incident response:tools, such as endpoint detection and response solutions;	services, such as threat hunting or cyber threat intelligence provided by the Cybersecurity and Infrastructure Security Agency (CISA) and third party firms; and	resources, such as skilled staff and funding.The 23 civilian Chief Financial Officers (CFO) Act of 1990 agencies have made progress in cybersecurity incident response preparedness by taking steps to standardize their incident response plans and demonstrating improvement in their capabilities for incident detection, analysis, and handling (see table).Executive Order 14028 Cybersecurity Incident Response Requirements and Status of Completion, as of August 2023			Requirement 									Status 								Agencies are to use the Cybersecurity and Infrastructure Security Agency playbook (issued in November 2021) for planning and conducting cybersecurity vulnerability and incident response activities for agency information systems									Agencies have incorporated or are incorporating the playbook into their plans, and all 23 agencies substantially completed the preparation phase activities.								Agencies are to deploy an endpoint detection and response initiative and work toward ensuring coverage on 80 percent of endpoints									All 23 agencies have begun to deploy an endpoint detection and response solution, and 16 agencies have reported 80 percent or greater coverage.								Agencies are to assess their event logging maturity against the maturity model in the Office of Management and Budget's M-21-31 memorandum, identify gaps associated with completing each of the requirements, and work toward reaching event logging tier 3 by August 2023									Twenty agencies did not reach the maturity level tier 3 by the deadline.					Source: GAO analysis of agency cybersecurity incident response information. | GAO-24-105658However, 20 agencies have not met requirements for investigation and remediation (event logging) capabilities. The Office of Management and Budget (OMB) required agencies to reach the advanced (tier 3) level by August 2023. The tier 3 level means that logging requirements at all criticality levels are met. However, as of August 2023, three of the 23 agencies were at tier 3. Of the remaining 20, three were at the basic (tier 1) level and 17 were at the not effective (tier 0) level. Until the agencies implement all event logging requirements, the federal government's ability to fully detect, investigate, and remediate cyber threats will be constrained.Agencies described three key challenges that hindered their abilities to fully prepare to respond to cybersecurity incidents: (1) lack of staff, (2) event logging technical challenges, and (3) limitations in cyber threat information sharing. Federal entities have ongoing efforts that can assist in addressing these challenges. These efforts include onsite cyber incident response assistance from CISA, event logging workshops and guidance, and enhancements to a cyber threat information sharing platform. In addition, there are long-term efforts planned such as implementation of the  National Workforce and Education Strategy  and a new threat intelligence platform offering from CISA, targeted to roll out its first phase to federal departments and agencies in fiscal year 2024.Why GAO Did This StudyCyber-based attacks on federal systems have become more damaging and disruptive. The Federal Information Security Modernization Act of 2014 (FISMA) requires that agency information security programs include procedures for detecting, reporting, and responding to security incidents. Executive Order (EO) 14028 builds on FISMA and establishes priorities for the federal executive branch to improve efforts to protect against and respond to persistent and malicious cyber campaigns. The EO and OMB and CISA guidance require agencies to address these priorities.GAO's objectives were to (1) describe the capabilities agencies use to prepare for and respond to cybersecurity incidents, (2) evaluate the extent to which agencies have made progress in preparing for cybersecurity incident response, and (3) describe the challenges agencies face in preparing for incident response and the efforts to address them.GAO interviewed officials and reviewed documentation from the 24 CFO Act agencies, CISA, and OMB on their capabilities, progress, and challenges in cybersecurity incident response. GAO analyzed questionnaire responses to evaluate agencies' progress in incident response preparation. The Department of Defense was excluded from some analysis because it was not subject to all requirements.
- Federal Grants: Numerous Programs Provide Cybersecurity Support to State, Local, Tribal, and Territorial Governments What GAO FoundGAO identified 27 federal grant programs managed by eight federal agencies that could be used to fund state, local, tribal, and territorial (SLTT) governments' cybersecurity. None of these grant programs were intended to primarily support cybersecurity activities and these agencies are not required to track amounts specifically used for cybersecurity activities. However, four federal agencies tracked cybersecurity-related expenditures for 10 of the 27 programs. For fiscal years 2019 through 2022, the agencies reported awarding about $827 million (see table) to support cybersecurity-related activities, such as purchasing new software and network equipment. The cybersecurity-related amounts awarded by the remaining 17 grant programs are unknown.Cybersecurity-Related Grant Award Amounts Tracked by Four Agencies, Fiscal Years 2019 through 2022			Agency 									Total cyber amount 									Number of grant programs 								Federal Emergency Management Agency									$669,858,956									5								Election Assistance Commission									$155,717,827									2								Department of the Interior									$844,106									1								Institute of Museum and Library Services									$708,926									2								Total 									$827,129,815.00 									10 					Source: GAO analysis of agency grant data. | GAO-24-106223Agencies have established policies and processes to monitor grant programs. Agency officials stated that they conduct periodic reviews of progress reports and financial reports submitted by grant recipients to ensure the appropriate usage of funds.Officials from national associations, SLTT government representatives, and agency officials did not identify challenges with applying for the identified grant programs. However, they identified challenges with the federal grant process in general. For example, officials from two national associations, one Tribal Nation, and three federal agencies said that the federal grant application process can be cumbersome for applicants, especially when the applicants are small SLTT governments with a relative lack of expertise in grant writing. Another Tribal Nation said it can be difficult to retain staff who have grant writing expertise.GAO has previously reported on a wide range of grant-related issues, including long-standing challenges with federal grants management. For example, GAO identified human capital capacity—the extent to which an organization has sufficient staff, knowledge, and technical skills to effectively meet its goals and objectives—as a key factor in successful grants management.Why GAO Did This StudySLTT governments provide essential services that are increasingly reliant on the internet, making them vulnerable to various cybersecurity-related risks. The Department of Homeland Security and other federal agencies administer grant programs for these types of governments.GAO was asked to identify federal grant programs that provide funding to improve cybersecurity for SLTT governments. The objectives for this report are to describe the (1) federal grant programs supporting SLTT governments' cybersecurity, and how much has been awarded for cybersecurity; and (2) actions taken by relevant federal agencies to monitor cybersecurity-related grants, and what challenges, if any, SLTT governments faced with the application process for cybersecurity-related grant programs.GAO collected and analyzed federal grant data to determine what federal agencies and programs may support SLTT governments' cybersecurity from fiscal years 2019 through 2022. Using these data, GAO identified federal agencies that administer relevant grant programs and interviewed agency officials about these programs. GAO also reviewed federal requirements and policies regarding agencies' responsibilities for monitoring cybersecurity-related grants. Finally, GAO interviewed officials from national associations that represent SLTT governments, Tribal Nations, and agencies to obtain their perspectives on challenges SLTTs faced when applying for federal cybersecurity-related grants.For more information, contact David B. Hinchman at (214) 777-5719 or hinchmand@gao.gov or Tina Won Sherman at (202) 512-8461 or shermant@gao.gov.
- Cybersecurity: State Needs to Expeditiously Implement Risk Management and Other Key Practices What GAO FoundThe Department of State has documented a cybersecurity risk management program that meets federal requirements. Specifically, the department has identified risk management roles and responsibilities and developed a risk management strategy. However, State has not fully implemented its program to identify and monitor risk to assets and the information maintained on its systems, as shown in the figure below.Examples of State's Progress in Implementing Its Cybersecurity Risk Management ProgramUntil the department implements required risk management activities, it lacks assurance that its security controls are operating as intended. Moreover, State is likely not fully aware of information security vulnerabilities and threats affecting mission operations.State's incident response processes for detecting, responding to, and recovering from cybersecurity incidents generally align with federal guidance by requiring the department to establish an incident handling capability for its information systems. For example, State's Cyber Incident Response Team and other units within its Monitoring and Incident Response Division provide the capability to identify active and potential threats to the department's network security 24 hours a day, 7 days a week.However, the department has not fully implemented processes that support its incident response program. For example, State has not fully updated and tested information system contingency plans to ensure continuity of operations nor configured its centralized inventory management database to identify asset inventory information from all available data sources.Further, State has not adequately secured its IT infrastructure to support its incident response program. This includes replacing the 23,689 hardware systems and 3,102 occurrences of network and server operating system software installations that have reached end-of-life. Certain installations of operating system software had reached end-of-life over 13 years ago.Without fully implemented incident response processes and an adequately secured IT infrastructure to support State's incident response program by, among other things, updating outdated or unsupported products, State's IT infrastructure is vulnerable to exploits. Furthermore, the department risks being unable to fully detect, investigate, and mitigate cybersecurity-related incidents.In the last several years, State has taken a number of steps to clarify and strengthen the role of the Chief Information Officer (CIO). For example, in October 2020, State issued a memo and matrix outlining the roles and responsibilities for cybersecurity of State's CIO and others.Nevertheless, the ability of State's CIO to secure the department's IT systems is limited due to shared management responsibilities and a lack of communication. In State's IT structure, the CIO manages State's main network and sets department-wide standards, but bureaus perform many activities independently, purchasing much of their own equipment, managing many of their own IT systems, and obtaining their own funding. In addition, a lack of communication among the CIO, Information Resource Management, and the bureaus also hampers the CIO's ability to secure the department's IT systems. For example, this created confusion among information system security officers about the applicability of IT-related requirements. State's IT structure, insulated culture (i.e., bureaus operating independently), and the lack of communication between the CIO and the bureaus is responsible for many of the deficiencies identified in this report, as shown in the figure below.Examples of Deficiencies at State Due to Its IT Structure and Insulated CultureIn October 2021, the CIO noted that the roles and responsibilities matrix needed to be updated to better reflect the specific cyber functions and activities that department leadership and bureaus engage in throughout State. Until State addresses these and other deficiencies, the CIO faces challenges managing and overseeing the department's cybersecurity program, including risk management and incident response, and the department's systems remain vulnerable.Why GAO Did This StudyThe security of State's IT systems is vital to promoting an open, interoperable, and reliable information and communications infrastructure in the department.GAO was asked to review State's cybersecurity practices. This report assesses the extent to which (1) State has implemented a cybersecurity risk management program; (2) State has a process and supporting infrastructure to detect, respond to, and recover from cybersecurity incidents; and (3) State's Chief Information Officer (CIO) is able to secure its IT systems department-wide.To conduct this work, GAO reviewed federal laws and guidance and compared them to department policies. GAO also analyzed samples of IT risk, incident response, and configuration data for selected enterprise-wide systems and 16 embassies and consular locations. Additionally, GAO interviewed State officials from the Bureau of Information Resource Management and the Bureau of Diplomatic Security with primary responsibility for managing and securing State's IT systems and networks. GAO also met with high-level officials at the Bureau of Consular Affairs, given that it operates more IT systems than any other bureau.This is a public version of a sensitive report with limited distribution. In response to a request from State officials, GAO excluded from this public report information deemed sensitive, such as specific post locations, system names, and technologies as well as a specific weakness.
- Critical Infrastructure Protection: National Cybersecurity Strategy Needs to Address Information Sharing Performance Measures and Methods What GAO FoundThe nation's 16 critical infrastructure sectors rely on electronic systems to provide essential services such as electricity, communications, and financial services. Federal entities have key roles in helping to protect these sectors.The Office of the National Cyber Director (ONCD) is to advise the President on cybersecurity policy and strategy, and lead the coordination of implementation of the March 2023  National Cybersecurity Strategy.	The Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is to coordinate the overall federal effort to promote the security of the nation's critical infrastructure, including the sharing of threat information.	The FBI is to lead counterterrorism and counterintelligence investigations and related law enforcement activities across the critical infrastructure sectors and share related cyber threat information.	CISA and 12 other agencies are sector risk management agencies responsible for providing specialized expertise for protecting the cybersecurity of their assigned sectors (e.g., Department of Energy and the energy sector), to include the sharing of sector-specific threat information.The 14 federal agencies in GAO's review—CISA, FBI, and the other 12 sector risk management agencies—reported relying on 11 methods to facilitate sharing of cyber threat information with critical infrastructure owners and operators. As shown in figure 1, these agencies used each of the 11 methods to varying degrees (see the numbers next to each method).Figure 1: Number of Methods Used by 14 Federal Agencies Sharing Cyber Threat InformationThe 14 agencies varied in the number of information sharing methods that they each used. Specifically, four agencies—the Department of Defense, the Department of Energy, CISA, and FBI—used more than half of the 11 sharing methods and 10 agencies used fewer than half of the 11 sharing methods.The agencies took two different approaches to using the 11 sharing methods. Specifically, two agencies—CISA and FBI—used a centralized approach to share information with each of the 16 critical infrastructure sectors. The other 12 remaining federal agencies shared sector-specific threat information.Six challenges to effective sharing of cyber threat information were identified by at least a third of the 21 entities in GAO's review (14 federal agencies and seven nonfederal entities) (see figure 2).Figure 2: Six Challenges to Cyber Threat Information Sharing Identified by Federal Agencies and Nonfederal EntitiesAlthough 13 of the 14 federal agencies reported that they have taken initial actions to address these threat sharing challenges, all 14 agencies also acknowledged that these challenges have not been fully resolved for their sectors. In March and July 2023, the White House issued its  National Cybersecurity Strategy  and accompanying implementation plan to articulate the administration's plan for addressing the nation's long-standing cybersecurity challenges—including those pertaining to information sharing. The implementation plan includes   eight initiatives that, if effectively implemented, could help agencies make progress in addressing the cyber threat information sharing challenges. For example, the implementation plan includes an initiative focused on removing barriers to delivering cyber threat intelligence. This initiative could help agencies make progress in addressing the challenge of limited sharing of classified or sensitive information.GAO's prior work emphasizes the importance of (1) identifying outcome-oriented performance measures and (2) assessing whether existing processes are optimal for addressing challenges.The implementation plan does not identify outcome-oriented performance measures to assess the effectiveness of the steps taken under the eight information sharing initiatives described in the plan.	The long-standing nature of the cyber threat sharing challenges raises questions about whether the mix of centralized and sector-specific sharing approaches is optimal. Although the implementation plan calls for CISA to assess whether new or improved sharing methods are needed, it does not include an assessment of whether existing sharing methods should be retired in favor of centralized or sector-specific sharing approaches.Until the ONCD and CISA take steps to resolve these weaknesses, the long-standing cyber threat sharing challenges will likely continue to persist.Why GAO Did This StudyCyber threats to the nation's critical infrastructure sectors are significant. As such, it is important that federal agencies and critical infrastructure owners and operators share cyber threat information. ONCD and CISA lead federal efforts to coordinate on national cyber policy and the security of critical infrastructure.This report examines, among other things, (1) how federal agencies and critical infrastructure owners and operators share cyber threat information and (2) challenges to cyber threat information sharing and the extent to which federal agencies have taken action to address them.To do so, GAO reviewed documentation from 14 federal agencies, including CISA, and seven nonfederal entities with responsibility for sharing cyber threat information. In addition, GAO interviewed relevant officials from these federal agencies and nonfederal entities regarding challenges to sharing cyber threat information.Using information compiled from interviews, GAO then presented the cyber threat information challenges frequently identified by the relevant entities to the 14 federal agencies and ONCD. GAO also asked for and reviewed documentation on actions the 14 agencies and ONCD have taken or plan to take to address the challenges.In addition, GAO compared the  National Cybersecurity Strategy  and accompanying implementation plan with its prior work on leading practices for national strategies and business process reengineering.
- Homeland Security: Office of Intelligence and Analysis Should Improve Privacy Oversight and Assessment of Its Effectiveness What GAO FoundGAO found that the Department of Homeland Security (DHS) Office of Intelligence and Analysis collected input from its mission centers and partners to prioritize threats and guide intelligence production during fiscal years 2019 to 2022. Specifically, the office (1) integrated Intelligence Community priorities into a single framework; (2) coordinated with DHS intelligence components to prioritize threats identified in that framework; and (3) solicited input from state, local, and other partners to refine priorities and inform product development.GAO also found that the Office of Intelligence and Analysis is not fully implementing activities intended to monitor whether personnel are following its policies to protect the privacy, civil rights, and civil liberties of U.S. persons, including U.S. citizens and lawful permanent residents. For example, the office has not conducted two required monitoring activities: audits of information systems and audits of bulk data.Audits Required by the Intelligence Oversight Guidelines&nbsp;aBulk data are large quantities of data acquired without the use of discriminants (e.g., specific identifiers or search terms), most of which does not have intelligence value.The office has not identified who is responsible for conducting these audits. By doing so, and by ensuring that relevant staff conduct these audits, the office will be better positioned to address any failures to protect privacy, civil rights, and civil liberties within its information systems and bulk data transfers.The Office of Intelligence and Analysis tracks 13 performance measures, but it lacks information about its effectiveness because the performance measures do not clearly align with its strategic goals. For example, the office does not have a performance measure relating to its strategic goal of protecting privacy and civil liberties or of promoting technological innovation. Developing performance measures that clearly align with its strategic goals would give leadership information about the office's overall effectiveness.In addition, officials said the office intends to use data from questionnaires attached to its intelligence products to better understand its customer interests. However, the office has not assessed whether these data are fulfilling its intent. By conducting such an assessment, the office may be better positioned to produce intelligence that aligns with the interests and needs of its customers.Why GAO Did This StudyThe DHS Office of Intelligence and Analysis provides information to DHS components and other partners to identify and mitigate threats to homeland security. Because such reporting can involve information about U.S. persons, the office issued Intelligence Oversight Guidelines that identify safeguards to protect privacy, civil rights, and civil liberties.GAO was asked to review how the office sets priorities; protects privacy, civil rights, and civil liberties; and assesses its effectiveness. This report examines (1) how the office prioritizes threats, (2) the extent to which it monitors implementation of its Intelligence Oversight Guidelines, and (3) the extent to which it assesses its effectiveness.GAO assessed the office's monitoring activities against its guidelines, reviewed performance information, and interviewed officials and a nongeneralizable selection of partners. This included eight DHS intelligence components, seven state and local agencies, and three private-sector partners, selected on the basis of geographic location and other factors.
- Security of Taxpayer Information: IRS Needs to Address Critical Safeguard Weaknesses What GAO FoundThe Internal Revenue Service (IRS) has implemented access controls and other safeguards to help mitigate risks to taxpayer information. However, continuing weaknesses pose a risk. Among its safeguards, in July 2022, IRS began requiring certain employees to seek senior executive approvals to gain access to taxpayer information. IRS employees also met the agency-wide 97 percent completion goal for training on protecting taxpayer information. However, IRS did not have a training goal for contractors, who had training completion rates well below employee completion rates—less than 75 percent. For example, 66 percent of the approximately 14,000 contractors assigned the Insider Threat Awareness training completed the course. As a result, IRS contractors are at increased risk of being unprepared to handle taxpayer information.IRS Contractor and Employee Training Completion Rate, Fiscal Year 2021In certain circumstances, IRS faces challenges ensuring taxpayer information it shares—as authorized by law—is properly protected. Federal tax law gives IRS the authority to inspect safeguards for agencies that receive taxpayer information from IRS in certain circumstances. However, in other cases where IRS shares taxpayer information pursuant to different statutory authority, it does not have direct authority to inspect agency safeguards. For these cases, Congress could provide IRS with direct authority to inspect agencies' safeguards, which would give IRS additional assurance that information will be protected sufficiently.IRS policy requires the agency to maintain an inventory of its systems that store taxpayer information and to mitigate weaknesses in systems that lead to a higher risk of unauthorized disclosure of federal tax information or UNAX—the willful unauthorized access, attempted access, or inspection of federal tax information. However, as of December 2022, IRS omitted seven tax processing systems from its inventory. This limits its monitoring of UNAX prevention efforts.GAO found that multiple IRS offices oversee contractors but IRS does not have overall oversight efforts related to IRS contractor UNAX. As a result, IRS has limited insight into contractor UNAX trends and assumes greater risk of missing opportunities to improve the agency's prevention efforts.Weaknesses in IRS's information security controls present risks to taxpayer information. For example, IRS did not assess the risks of its method for transferring taxpayer information to contractors. Until IRS remediates these weaknesses, it will have limited assurance that taxpayer information is protected appropriately.GAO and the Treasury Inspector General for Tax Administration (TIGTA) have previously reported on deficiencies in IRS's safeguards over taxpayer information. They have both made recommendations aimed at improving these safeguards. Since fiscal year 2010, GAO has made 451 recommendations to strengthen IRS safeguards for taxpayer information in areas such as governance for protecting taxpayer information; authentication and access to tax processing systems; and IRS monitoring of programs that process taxpayer information.GAO's recommendations cover the five National Institute of Standards and Technology (NIST) cybersecurity core functions that provide a strategic view of life cycle management of cybersecurity risk. A majority of the recommendations cover the  protect  core function (74 percent)—actions related to developing and implementing appropriate safeguards. The remaining recommendations are in the other core functions—  identify,  detect,  recover, and  respond.IRS had implemented 83 percent of GAO recommendations as of March 2023.Status of GAO Recommendations Related to Protecting Taxpayer Information and NIST Cybersecurity Core Function, Fiscal Years 2010–March 2023Since fiscal year 2019, TIGTA has made 246 recommendations to IRS related to protecting taxpayer information. As of April 2023, according to IRS, it has taken steps to address 202 of them—including implementing controls to manage IT supply chain risks—reducing the risk for disruptions to IRS's operations.While IRS has taken substantial action to implement GAO recommendations, IRS did not always do so timely. For example, five recommendations have been open for more than 7 years. Additionally, IRS has yet to implement two recommendations GAO identified as high priority—updating a system modernization plan to more fully assess risk and developing a guidance structure to better protect taxpayer information while at third-party providers. Addressing the remaining GAO recommendations could help IRS better manage system security risks, implement safeguards to ensure protected service delivery, and identify cybersecurity events and incidents.Why GAO Did This StudyThe U.S. tax system is based largely on voluntary compliance. One factor that may influence taxpayers' willingness to voluntarily comply is the confidence that IRS is protecting their personal and financial information.GAO was asked to review IRS's safeguards for taxpayer information. This report evaluates the extent to which IRS is following its tax safeguards for protecting taxpayer information.To address this objective, GAO analyzed mandatory training and UNAX data for IRS employees and contractors, reviewed IRS and TIGTA documentation, and interviewed IRS and TIGTA officials at selected offices. In addition, GAO reviewed federal law authorizing other federal agencies to receive taxpayer information.GAO also identified and tested selected management, operational, and technical controls on selected IRS systems that store or process taxpayer information, and observed controls in operation. GAO also has ongoing work assessing IRS's efforts to protect the confidentiality of taxpayer information, including its implementation of technical controls and breach response processes. GAO will publish this work in a subsequent report with limited distribution.Further, GAO reviewed previously issued reports and recommendations, including those issued by TIGTA. GAO categorized them according to the five core security functions described in the NIST cybersecurity framework.
- Cybersecurity Workforce: National Initiative Needs to Better Assess Its Performance What GAO FoundThe National Institute of Standards and Technology's (NIST) National Initiative for Cybersecurity Education (NICE) program has taken steps to strengthen the cybersecurity workforce. For example:The program established an inventory or “framework” of necessary skills and work roles associated with cybersecurity and expanded it with stakeholder input.	The program formed public and private collaborations to connect the cybersecurity community and promote cybersecurity training and education. This included working groups and communities of interest run in part by volunteers. These groups created projects based on one of the NICE program's strategic goals or the needs of a specific cybersecurity community.	The program holds periodic webinars, quarterly forums, and multiple annual conferences to share information on cybersecurity issues.In focus group discussions with program volunteers from industry, academia, and government, participants cited what they regarded as successes, including robust community benefits. However, some participants noted challenges with the program, such as an unclear scope.NIST's process for assessing the NICE program included fully implementing the practice of involving stakeholders. However, other key practices for establishing a program-level performance process were not fully implemented. Specifically, of nine selected key performance assessment practices, NIST fully implemented one, partially implemented five, and did not implement three (see figure).National Institute of Standards and Technology (NIST) Implementation of Selected Key Practices for Establishing a Program Performance ProcessFor example, NIST did not develop performance measures for the program. According to program officials, they relied on the program's volunteer working groups to develop such measures. However, the variability in skills and approaches of the volunteers made it too difficult to accomplish. As a result, NIST was unable to demonstrate program progress. Without reliable data to manage the NICE program's performance, NIST is not in a position to effectively and efficiently identify obstacles or opportunities to sustain and improve the initiative.Why GAO Did This StudyA well-trained cybersecurity workforce is essential for government functioning. To bolster that workforce, NIST has developed the National Initiative for Cybersecurity Education (NICE). This program's mission is to foster more education and training through collaborative partnerships with private industry, academia, and government agencies.GAO was asked to review the progress the NICE program is making against its stated goals and objectives. This report examines (1) the actions NIST has taken through the NICE program to strengthen the cybersecurity workforce and (2) the extent to which NIST established a process to assess the program's performance.GAO analyzed documents related to NIST's program performance assessments and compared these to selected key performance practices identified in legislation and prior GAO work. GAO also conducted focus group interviews with active program participants about their experiences. Additionally, GAO interviewed NIST officials responsible for the program.
- Cybersecurity: Launching and Implementing the National Cybersecurity Strategy What GAO FoundThe fiscal year 2021 national defense authorization act established the Office of the National Cyber Director (ONCD) and the Senate confirmed a National Cyber Director in June 2021 to serve as the principal advisor to the President on cybersecurity policy and strategy. In March 2023, the White House issued the National Cybersecurity Strategy, describing five pillars supporting the nation's cybersecurity:Defend critical infrastructure	Disrupt and dismantle threat actors	Shape market forces to drive security and resilience	Invest in a resilient future	Forge international partnershipsIn April 2023, GAO reported that the goals and strategic objectives included in the document provide a good foundation for establishing a more comprehensive strategy. Specifically, the strategy fully addressed three of six desirable characteristics of a national strategy. However, it only partially addressed the remaining three. These includegoals, subordinate objectives, activities, and performance measures;	resources, investments, and risk management; and	organizational roles, responsibilities, and coordination.ONCD stated it plans to work with federal agencies to develop a plan to implement the strategy, including milestones or performance measures, and to identify budget priorities. It is critical that these details be issued expeditiously so agencies can begin planning and allocating resources to properly execute the strategy. Until the federal government issues the implementation plan and ensures its strategy documents fully address the desirable characteristics of a national strategy, the nation will lack a clear roadmap for overcoming its cyber challenges.Additionally, the newly established National Cyber Director position has been vacant since the Director resigned in February 2023. As of July 2023, an acting official continues to carry out the duties. This vacancy leaves unfilled a key leadership role needed to coordinate federal efforts to address cybersecurity threats and challenges. Further, sustained leadership in this position is essential to ensuring strategy execution and accountability.Why GAO Did This StudyFederal agencies and our nation's critical infrastructure—such as energy, transportation, communications, and financial services—rely on information systems to carry out fundamental operations. Because of the increasing threats to federal information systems, critical infrastructure, and the privacy of personally identifiable information, GAO has designated ensuring the nation's cybersecurity as a government-wide high risk issue. This designation emphasizes the urgency with which the federal government needs to undertake efforts to address the nation's cybersecurity challenges. Accordingly, Congress established the Office of the National Cyber Director in the White House with the authority to implement and encourage action in support of the nation's cybersecurity. One of this office's responsibilities is developing and implementing a comprehensive national strategy to address cybersecurity threats and challenges. This product summarizes recent GAO reports that assessed the federal government's efforts to establish a national cybersecurity strategy and plans for implementing it.For more information, contact Marisol Cruz Cain at (202) 512-5017 or CruzCainM@gao.gov.
- Cybercrime: Reporting Mechanisms Vary, and Agencies Face Challenges in Developing Metrics What GAO FoundFederal agencies use a variety of mechanisms to collect and report data on cybercrime. The mechanisms used depend on whether the agency's mission related to cybercrime is identification, investigation, or prosecution. (See figure.)Types of Agency Mechanisms Used for Reporting CybercrimeNote: GAO identified 12 agencies, including the Department of Justice, Federal Bureau of Investigation, and Internal Revenue Service; the entire list is included in the report.Strengths of these mechanisms included specific functionality for capturing cybercrime attributes to facilitate information sharing. Limitations included variations in how systems classify and track cybercrime and the absence of a central mechanism that collects data on cybercrime. These are partly due to the lack of an official or commonly agreed-on definition of cybercrime.Agencies also identified differences between data reported on cybercrime (including cyber-enabled crime) and other types of crime. For example, cybercrime may not be consistently tracked because it is not always associated with a specific type of offense. In addition, victims may be hesitant to report cybercrime because of lack of familiarity or reputational concerns.Agencies identified challenges in defining shared metrics. These include measuring the extent and impact of cybercrime, agreeing on a definition of cybercrime, and coordinating among law enforcement agencies at various levels. The Department of Justice (DOJ) effectively developing a cybercrime taxonomy and category in its national crime reporting system should help address these challenges. GAO intends to monitor future efforts, including those to develop cybercrime categories and ensure consistent reporting.Why GAO Did This StudyCybercrime (including cyber-enabled crime) generally consists of criminal activities that target a computer or network for damage or infiltration or use the internet to conduct criminal activity. Cybercrime in the United States is increasing, resulting in billions of dollars in losses and threatening public safety. However, the United States lacks comprehensive cybercrime data and monitoring, leaving the country less prepared to combat cybercrime. The Better Cybercrime Metrics Act, enacted in 2022, requires DOJ to develop a taxonomy for types of cybercrime and cyber-enabled crime and establish a category in its National Incident-Based Reporting System to collect reports for cybercrime from law enforcement. The act also includes a provision for GAO to report on existing cybercrime reporting mechanisms.The objectives of this review were to focus on (1) existing mechanisms used to report cybercrime and cyber-enabled crime, including reported strengths and limitations; (2) differences between data reported on cybercrime or cyber-enabled crime and other types of crime; and (3) challenges selected agencies reported in defining shared metrics for cybercrime. GAO identified agencies with key responsibilities for identifying, investigating, and prosecuting cybercrime. GAO reviewed documentation on agency mechanisms for reporting cybercrime data, such as case management systems. It also interviewed agency officials regarding these mechanisms, differences between cybercrime and other types of crime, and challenges in establishing shared metrics.For more information, contact Marisol Cruz Cain at (202) 512-5017 or cruzcainm@gao.gov&nbsp;or Gretta L. Goodwin at (202) 512-8777 or goodwing@gao.gov.
- Cybersecurity: Interior Needs to Address Threats to Federal Systems and Critical Infrastructure What GAO FoundMalicious threat actors continue to present risks to federal systems and the nation's critical infrastructure. Such attacks can result in serious harm to human safety, the environment, and the economy. The table below describes common cyber threat actors.Common Cyber Threat Actors			Threat actor 									Description 								Nations									Nations—including nation-states, state-sponsored, and state-sanctioned groups or programs—use cyber tools as part of their efforts to further economic, military, and political goals.								Transnational criminal groups									Transnational criminal groups, including organized crime organizations, seek to use cyberattacks for monetary gain.								Hackers and hacktivists									Hackers break into networks for reasons including the challenge, revenge, stalking, or monetary gain. In contrast, hacktivists are ideologically motivated actors who use cyberattack tools to further political goals.								Insiders									Insiders are individuals (such as employees, contractors, or vendors) with authorized access to an information system or enterprise and who have the potential to cause harm, wittingly or unwittingly.					Source: GAO analysis. | GAO-23-106869Cyberattacks can disrupt or damage critical infrastructure, including facilities and assets supporting offshore oil and gas production. For example, the May 2021 ransomware attack on the Colonial Pipeline Company resulted in a temporary disruption in the delivery of gasoline and other petroleum products.In October 2022, GAO reported that Interior's Bureau of Safety and Environmental Enforcement had taken few actions to address cybersecurity risks to offshore oil and gas infrastructure. GAO recommended that the bureau immediately develop and implement a strategy to address such risks.Interior's Office of Inspector General (OIG) has identified weaknesses in the department's cybersecurity program and practices. For example:In January 2023, Interior's OIG found that the department's management practices and password complexity requirements were insufficient to protect active user passwords, including accounts with elevated privileges. The OIG made eight recommendations to help the department strengthen its IT security.	In April 2023, the OIG released a summary of a contractor's independent audit of the department's information security program. The summary indicated that the program did not fully comply with applicable federal requirements and guidelines.Likewise, GAO has reported on gaps in Interior's approach to cybersecurity risk management. For instance:In September 2022, GAO reported on the 24 Chief Financial Officer Act agencies' implementation of programs to protect the privacy of personal information. GAO found that Interior had not fully incorporated privacy into its organization-wide risk management strategy. GAO recommended that Interior take steps to do so.Why GAO Did This StudyMore than a quarter of a century has passed since GAO first designated information security as a government-wide high-risk area in 1997. Since then, challenges related to ensuring the cybersecurity of the nation have led GAO to expand this high-risk area to include the protection of cyber critical infrastructure and the privacy of personal information.The Department of the Interior is responsible for safeguarding its information systems and sensitive data by establishing an effective information security program. The department also has regulatory oversight of critical infrastructure supporting offshore oil and gas production, including identifying and helping to address cyber-based risks.GAO was asked to testify on threats and cybersecurity risks at the Department of the Interior. This statement summarizes types of threat actors and cyberattacks that could compromise federal systems and critical infrastructures, such as those Interior oversees. It also discusses cybersecurity reports and recommendations from GAO and Interior's Office of Inspector General.This statement is based on prior GAO work at Interior and other federal agencies. GAO also reviewed Interior OIG reports and other public information sources.
- Cloud Security: Selected Agencies Need to Fully Implement Key Practices What GAO FoundThe four selected agencies—the Departments of Agriculture, Homeland Security (DHS), Labor, and the Treasury—varied in their efforts to implement the six key cloud security practices that GAO evaluated. Specifically, three agencies fully implemented three practices for most or all of their selected systems, while another agency fully implemented four practices for most or all of its systems. However, the agencies partially implemented or did not implement the other practices for the remaining systems (see figure).Agencies' Implementation of the Key Cloud Security Practices for Each of the Selected SystemsFor example, the agencies partially implemented the practice regarding continuous monitoring for some or all of the systems. Although the agencies developed a plan for continuous monitoring, they did not always implement their plans. In addition, agencies partially implemented or did not implement the practice regarding service level agreements for some of the systems. Specifically, agencies' service level agreements did not consistently define performance metrics, including how they would be measured, and the enforcement mechanisms.Agency officials cited several reasons for their varied implementation of the key practices, including acknowledging that they had not documented their efforts to address the requirements. Until these agencies fully implement the cloud security key practices identified in federal policies and guidance, the confidentiality, integrity, and availability of agency information contained in these cloud systems is at increased risk.Why GAO Did This StudyCloud computing provides agencies with potential opportunities to obtain IT services more efficiently; however, if not effectively implemented, it also poses cybersecurity risks. To facilitate the adoption and use of cloud services, the Office of Management and Budget and other federal agencies have issued policies and guidance on key practices that agencies are to implement to ensure the security of agency systems that leverage cloud services (i.e., cloud systems).This report evaluates the extent to which selected agencies have effectively implemented key cloud security practices. To do so, GAO selected 15 cloud systems across four agencies (Agriculture, DHS, Labor, and Treasury), representing a broad range of services. GAO selected these agencies based on several factors, including the number of reported IT investments leveraging cloud computing. GAO compared relevant agency documentation against six key practices identified in federal policies and guidance. GAO rated each agency as having fully, partially, or not implemented each practice for the selected systems.
- Cybersecurity: DOT Defined Roles and Responsibilities, but Additional Oversight Needed What GAO FoundConsistent with federal guidance, U.S. Department of Transportation (DOT) policy documents cybersecurity roles and responsibilities for senior officials. The policy also describes roles and responsibilities for senior managers at the nine component mission-oriented operating administrations (see figure).Department of Transportation (DOT) Mission-Oriented Operating AdministrationsDOT's Office of the Chief Information Officer (CIO) regularly communicates with component agencies by sharing information through daily cyber operations meetings and periodic informational emails. Further, component agency managers stated that the office provides access to cybersecurity tools for incident and vulnerability management and other technical assistance. DOT also supported managers by providing cybersecurity role-based training. However, the DOT Inspector General (IG) reported deficiencies in the clarity of training requirements, such as the required number of hours, and the monitoring of training completion. The IG's 2019 and 2021 recommendations to address these deficiencies are not yet implemented.To provide oversight, DOT policy requires annual reviews of component agency cybersecurity programs. However, the reviews have not been effective in taking needed actions to implement the 63 unresolved cybersecurity recommendations as reported by the IG in a September 2022 report. Using the reviews to address the recommendations could improve the department's cybersecurity program.To assess managers' performance, DOT established performance plans for its component agency senior IT managers. However, while DOT's strategic plan identified cybersecurity as an organizational objective, 15 of 18 managers' performance plans did not include cybersecurity-related expectations. Further, the department CIO did not always participate in evaluating the performance of component agency CIOs. This is inconsistent with department regulations and results in less assurance that component agencies are aligned with the department in carrying out cybersecurity-related responsibilities.Why GAO Did This StudyDOT was established in part to build, maintain, and oversee a vast national transportation system. To support its mission, the department relies on information systems to secure sensitive information.The Infrastructure Investment and Jobs Act includes a provision for GAO to report on the cybersecurity roles and responsibilities of senior IT officials at DOT and its component operating administrations.This report examines the extent to which DOT (1) has defined cybersecurity roles and responsibilities for department and component agency senior officials and managers; (2) provides cybersecurity support to components, and (3) provides oversight of component cybersecurity activities and managers.To do so, GAO analyzed department policies, processes, and documentation. It also reviewed federal guidance and GAO and IG reports, and interviewed cognizant officials.
- DHS Annual Assessment: Major Acquisition Programs Are Generally Meeting Goals, but Cybersecurity Policy Needs Clarification What GAO FoundThe Department of Homeland Security (DHS) invests billions of dollars annually to acquire systems that help secure the border, advance marine safety, screen travelers, improve disaster response, and execute a wide variety of other operations.Most Programs Met Established Cost and Schedule Goals in Fiscal Year 2022As of September 2022, 18 of the 25 selected DHS acquisition programs that GAO reviewed had a department-approved acquisition program baseline—a summary of measurable estimates indicating how the system will perform, when it will be delivered, and what it will cost. Most of the other programs were not yet required by policy to have an approved program baseline.Of these 18 programs, three started the fiscal year either behind their approved schedule or over their approved budget, putting them in breach status. However, all three completed the process needed to get back on track, including revising their baseline estimates. By the end of fiscal year 2022, those programs met their revised cost and schedule goals. Four other programs also revised or were revising their baselines in fiscal year 2022 due to changes in the projects' scope, such as a change in the quantity being acquired.In addition, eight of the 25 DHS acquisition programs completed the operational test and evaluation phase of the acquisition process during fiscal year 2022, according to a DHS official. After completing operational test and evaluation, those programs are on track to begin production and deliver new capabilities.Five Programs Sought COVID-19 Baseline AdjustmentsCOVID-19 affected some of the 25 major acquisition programs GAO reviewed in a variety of ways, including supply chain issues and inflation. As of September 2022:Five programs were seeking approval to adjust their schedule or cost baselines due to COVID-19 effects. These programs have requested flexibilities offered in a July 2022 DHS memorandum to address the effects of COVID-19.Five other programs reported COVID-19 cost or schedule effects in fiscal year 2022, but were able to manage them within their baselines.The remaining 15 programs did not report schedule or cost effects related to COVID-19.Selected Programs Have Not Prepared Cybersecurity Memorandums Ahead of Acquisition Decision EventsIn addition, since the department's acquisition cybersecurity instruction was issued, none of the seven programs that had subsequent acquisition decision events completed a cybersecurity risk recommendation memorandum (CRRM). The instruction requires that major acquisition programs consider cybersecurity throughout the acquisition life cycle. Specifically, major acquisition programs are required to present a CRRM at acquisition decision events to identify the programs' cybersecurity status and their risk recommendation (high, medium, low).Cybersecurity Risk Recommendation Memorandum Required in the Acquisition Life CycleDHS officials told GAO that a CRRM was not applicable to them for various reasons. In one instance, a program provided documentation that this requirement was waived by DHS. The other six programs reported that other documentation was used instead, that the memorandum was not applicable to their program, or that they simply did not develop one. The instruction does not clarify when the CRRM requirement might be waived, is not applicable, or when or what other documentation may be used in its place. If DHS does not clarify when exemptions apply, programs may not prepare the memorandums when they are needed. As a result, DHS, in its oversight role, may not have information to effectively assess cybersecurity risk and ensure that risk mitigations are adequate.Why GAO Did This StudyTo help execute its many critical missions, DHS plans to spend more than $4 billion on its portfolio of major acquisition programs—those with life-cycle costs over $300 million—in fiscal year 2023.For some DHS major acquisition programs, COVID-19 or changes implemented to address it have affected workforce availability or led to supply chain issues. In addition, DHS's major acquisition programs increasingly rely on software and IT systems, and cyberattacks can target any IT system.The Explanatory Statement accompanying the DHS Appropriations Act, 2015, included a provision for GAO to review DHS's major acquisitions on an ongoing basis.This report, GAO's eighth review, assesses the extent to which selected programs are (1) meeting baseline goals, (2) mitigating COVID-19 effects on delivery of capabilities, and (3) executing cybersecurity activities.This is a public version of a sensitive report that issued in March 2023. Information that DHS deemed sensitive has been omitted.How GAO Did This Study GAO assessed 25 major acquisition programs, including DHS's largest programs and those that GAO or DHS identified as at risk of poor outcomes to determine program status as of September 30, 2022. GAO assessed their progress in meeting cost, schedule and performance goals; and reviewed policy, memorandums, and information about the cost and schedule effects of COVID-19. GAO also reviewed DHS acquisition cybersecurity policy and assessed programs' cybersecurity risk management activities; and interviewed DHS officials.
- Cybersecurity: VA Needs to Address Privacy and Security Challenges What GAO FoundFederal law and policy establish requirements for protecting personally identifiable information (PII) and securing federal systems and information. Federal guidance also includes key practices for establishing privacy programs. GAO reported in 2022 that federal agencies, including the Department of Veterans Affairs (VA), varied in the extent to which they established privacy policies and procedures and implemented key practices. While VA partially addressed privacy practices, gaps remain. For example, it had not fully defined the role of privacy officials in carrying out risk management steps for authorizing systems that contained PII. Without fully incorporating these practices, VA will have less assurance that it is consistently and effectively implementing privacy protections. In addition, privacy officials at all 24 Chief Financial Officers Act of 1990 agencies, including VA, reported experiencing challenges in implementing their privacy programs.GAO and the VA Office of Inspector General (OIG) have highlighted security challenges that VA has faced in safeguarding its information and information systems. For example, in 2019, GAO reported that VA did not fully address four cybersecurity practices in establishing a cyber-risk management program. Further, in 2022, the VA OIG reported that the department faced challenges implementing components of its information security program. The report had 26 recommendations for improvement, including implementing needed access and configuration management controls. In addition, an Office of Management and Budget report to Congress summarizing fiscal year 2021 agency cybersecurity performance noted that an independent assessment had concluded that VA's program was not effective.Why GAO Did This StudyIn providing health care and other benefits to veterans and their dependents, VA relies on IT systems and networks to receive, process, and maintain sensitive data, including veterans' medical records and associated PII. VA maintains these data in a variety of systems, including its legacy electronic health record system.Federal systems and networks, including those of VA, are often interconnected with other internal and external systems and networks. This increases the risk of cyberattacks. Since 1997, GAO has designated information security as a government-wide high-risk area—a designation that remains today.GAO was asked to review VA (1) privacy practices and challenges, and (2) security challenges. To address both objectives, GAO summarized results and challenges from its previously issued products. GAO also reviewed VA OIG reports on cybersecurity. In addition, GAO incorporated information on the department's actions to implement prior privacy and security recommendations.
- Critical Infrastructure Protection: Time Frames to Complete CISA Efforts Would Help Sector Risk Management Agencies Implement Statutory Responsibilities What GAO FoundThe William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 expanded and added responsibilities for Sector Risk Management Agencies (SRMAs). These agencies engage with their public and private sector partners to promote security and resilience within their designated critical infrastructure sectors. Some officials from these agencies described to GAO new activities to address the responsibilities set forth in the act, and many reported having already conducted related activities. For example, the act added risk assessment and emergency preparedness as responsibilities not previously included in a key directive for SRMAs. New activities officials described to address these responsibilities included developing a communications risk register and developing emergency preparedness exercises.The Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has identified and undertaken efforts to help SRMAs implement their statutory responsibilities. For example, CISA officials stated they are updating key guidance documents, including the 2013 National Infrastructure Protection Plan and templates for revising sector-specific guidance documents. CISA officials also described efforts underway to improve coordination with sector partners, such as reconvening a leadership council. SRMA officials for a majority of critical infrastructure sectors reported that additional guidance and improved coordination from CISA would help them implement their statutory responsibilities. However, CISA has not developed milestones and timelines to complete its efforts. Establishing milestones and timelines would help ensure CISA does so in a timely manner.Why GAO Did This StudyCritical infrastructure provides essential functions––such as supplying water, generating energy, and producing food––that underpin American society. Disruption or destruction of the nation's critical infrastructure could have debilitating effects. CISA is the national coordinator for infrastructure protection.The William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 includes a provision for GAO to report on the effectiveness of SRMAs in carrying out responsibilities set forth in the act. This statement addresses (1) how the act changed agencies' responsibilities, and the actions agencies have reported taking to address them; and (2) the extent to which CISA identified and undertook efforts to help agencies implement their responsibilities set forth in the act.This statement is based on GAO's February 2023 report on SRMA efforts to carry out critical infrastructure protection responsibilities and CISA's efforts to help SRMAs implement those responsibilities. For that report, GAO analyzed the act and relevant policy directives, collected written responses from all 16 sectors using a standardized information collection tool, reviewed other DHS documents, and interviewed CISA officials.
- Electronic Health Record Modernization: VA Needs to Address Change Management Challenges, User Satisfaction, and System Issues What GAO FoundThe Department of Veterans Affairs (VA) organizational change management activities for the Electronic Health Record Modernization (EHRM) program were partially consistent with seven leading practices and not consistent with one leading practice (see table).Extent to Which the Electronic Health Record Modernization (EHRM) Program's Activities Were Consistent with Organizational Change Management Leading Practices			Leading practice 									GAO assessment 								Developing a vision for change									Partially consistent								Identifying and managing stakeholders									Partially consistent								Communicating effectively									Partially consistent								Assessing the readiness for change									Partially consistent								Increasing workforce skills and competencies									Not consistent								Identifying and addressing potential barriers to change									Partially consistent								Establishing targets and metrics for change									Partially consistent								Assessing the results of change									Partially consistent					Source: GAO analysis of Department of Veterans Affairs (VA) data. | GAO-23-106685Legend: Consistent – VA provided evidence that it conducted organizational change management activities mostly consistent with leading practices. Partially consistent – VA provided evidence that it conducted organizational change management activities consistent with some of the leading practice criteria, but some key parts were not followed. Not consistent – VA did not provide sufficient evidence that it followed leading practices.Until the program fully implements the eight leading practices for change management, future deployments are at risk of continuing change management challenges. These challenges hinder effective use of the new electronic health record (EHR) system, impede users' knowledge of new workflows, and limit the utility of system improvements.Most users have expressed dissatisfaction with the new system. VA's 2021 and 2022 surveys showed that users were not satisfied with the system's performance or training. About 6 percent (120 of 2,066) of users agreed that the system enabled quality care. In addition, about 4 percent (92 of 2,074) of users agreed that the system made them as efficient as possible. Further, VA has not established targets (i.e., goals) to assess user satisfaction. Until it does so, VA lacks a basis for determining when satisfaction has sufficiently improved for the system to be deployed at additional sites. Such a basis helps ensure that the system is not deployed prematurely, which could risk patients' safety.VA did not adequately identify and address system issues. Specifically, VA did not ensure that trouble tickets for the new EHR system were resolved within timeliness goals. It subsequently worked with the contractor to reduce the number of tickets that were over 45 days old. Nevertheless, the overall number of open tickets has steadily increased since 2020. Accordingly, it is critical that system issues be resolved in a timely manner. Additionally, although VA has assessed the system's performance at two sites, as of January 2023, it had not conducted an independent operational assessment. Without such an independent assessment, VA will be limited in its ability to (1) validate that the system is operationally suitable and effective, and (2) identify, track, and resolve key operational issues.Why GAO Did This StudyVA uses the Veterans Health Information Systems and Technology Architecture (VistA), which includes the department's legacy EHR system, to provide health care to its patients. In June 2017, VA initiated the EHRM program to replace VistA because it is technically complex, costly to maintain, and does not fully support the need to exchange health data with other organizations. Specifically, VA began to acquire the same EHR system DOD was acquiring. VA has reported obligating about $9.42 billion on EHRM from fiscal year 2018 through the first quarter of fiscal year 2023.GAO was asked to testify on its recently completed review to determine the extent to which VA has (1) used organizational change management strategies for the EHRM program consistent with leading practices, (2) assessed satisfaction with the new system, and (3) identified and addressed EHR system issues. GAO identified leading change management practices and evaluated VA's activities against these practices. It also reviewed results of surveys that VA conducted to determine users' satisfaction with the new EHR, conducted interviews with selected users, and interviewed officials on user satisfaction goals. Further, GAO analyzed system trouble ticket data and compared them to VA's service level agreement with its contractor.
- Science & Tech Spotlight: Securing Data for a Post-Quantum World Why This MattersWhile the emergence of quantum computers offers potential benefits, these computers could undermine the security of current encryption methods that protect sensitive information. If encryption methods able to withstand the capabilities of quantum computing are not developed and deployed soon, secure data could be decrypted as soon as the 2030s.The TechnologyWhat is it?  Quantum computing poses risks to the security of sensitive data, which researchers are working to address. Governments, organizations, and individuals rely on cryptography to keep sensitive and personally identifiable information secure.   Cryptography protects information by transforming it using mathematical functions, collectively referred to as encryption. Current, widely used encryption methods rely on complex mathematics that are nearly impossible for normal, or classical, computers to break in reasonable time frames.Quantum computers, in contrast, could break certain types of widely used encryption methods, such as those used for secure website connections, in exponentially shorter times because of key differences in information processing. As described in an earlier  GAO report  , classical computers process information through bits that can only be 0 or 1 (like an on/off switch). A quantum computer, however, processes information using quantum bits, or qubits, which can be any combination of 0s and 1s simultaneously due to properties of nature at small scales.Quantum computers that could break current encryption methods— known as cryptographically relevant quantum computers (CRQCs)—may not exist for another 10 to 20 years, according to some experts. The largest quantum computer currently developed only has a small fraction of the necessary qubits for a CRQC. However, data encrypted with current methods can be downloaded and saved for future decryption by CRQCs. For example, technology designs relevant for long periods are at risk if a bad actor steals them and later decrypts them with a CQRC. In other words, if the migration time plus the time data must be securely retained is longer than the time it takes for CRQC development, then data will be unprotected (see fig. 1).Figure 1. A possible scenario of how migration to post-quantum cryptography may affect the safety of sensitive information. The faster this migration occurs; the sooner data can be secured. To combat the threat of CRQCs, researchers are developing and standardizing new encryption methods collectively referred to as post-quantum cryptography (PQC). These new methods are intended to withstand attacks from both quantum and classical computers.How does it work?  Cryptography protects sensitive data using a series of characters called a “key” which can be public or private. Senders and receivers use keys to lock (encrypt) and unlock (decrypt) the transmitted data.   There are three main types of cryptography: private-key, public-key, and digital signatures. Experts generally agree that encryption methods for private-key cryptography are less susceptible to attack by CRQCs and easier to make more secure by using larger key sizes. In contrast, experts generally agree that current encryption methods commonly used for public-key cryptography and digital signatures are susceptible to attack by CRQCs. Public-key cryptography includes the encryption of e-mail and other digital transactions and digital signatures include the virtual signing and authentication of documents (see fig. 2).Figure 2. Illustration of the two types of cryptography most susceptible to cryptographically relevant quantum computers. The mathematical structure underlying current encryption methods commonly used for public-key cryptography and digital signatures could be broken with a CRQC. For example, the Rivest-Shamir-Adleman (RSA) algorithm—a widely used public-key encryption method for exchanging of sensitive information, such as bank transfers—would take billions of years for a classical computer to decrypt, but only hours or days for a CRQC.Options for replacing current public-key encryption methods fall under different families of challenging mathematical problems that should not be susceptible to decryption by classical or quantum computers. Lattice-based encryption, for example, relies on geometry in a highly multidimensional space. This results in a system that should be much more difficult to decrypt, according to experts.How mature is it?  PQC methods have been developed and are undergoing standardization for implementation. A National Institute of Standards and Technology (NIST) public initiative has been developing replacements for at-risk encryption methods since 2016. In July 2022, NIST selected four PQC algorithms the agency will standardize. The National Security Agency plans to incorporate the algorithms into its commercial national security algorithm suite once NIST releases the standards, anticipated in 2024. NIST is also collaborating with expert and standards groups, such as the International Organization for Standardization, which are developing their own PQC standards. Other countries are also working on their own PQC methods.Why now?  While experts do not agree on when a CRQC will be developed, they do agree that the time to prepare for PQC is now. The Office of Management and Budget issued guidance in 2022 on how to identify and prioritize at-risk encryption methods and information for an efficient transition to PQC once the NIST standards are available. For example, sensitive information with long security lifetimes, such as personally identifiable information, would be prioritized in the transition.Organizations that are unaware of the extent of cryptography use in their systems may need to make unexpected infrastructural changes. For example, PQC may require upgraded microprocessors. Further, in a 2022 national security memorandum, the White House outlined the need for growing an informed PQC workforce in the U.S., as well as the need for ensuring interoperability between federal agencies during the PQC transition. The White House has called for federal agencies to complete the transition to PQC by 2035, but this may not be soon enough to keep data safe from future decryption.OpportunitiesEnhanced data security.  Even if a CRQC is never developed, creating more complex encryption methods could make sensitive and personally identifiable information more secure.	Modernized infrastructure.  The technology updates needed for transition to PQC may result in modernized infrastructure that is more agile for future updates than systems that have encryption methods incorporated into their hardware.ChallengesLengthy transition.  Identifying and replacing affected technologies may take a long time, and the longer the transition to PQC takes, the more that sensitive information will be at risk.  	Cost and complexity.  Transitioning to infrastructure supportive of new encryption methods will be expensive and complex. Organizations may face challenges in planning for incurred costs and in remaining operational during the infrastructure changeover.  	Workforce gaps.  The U.S. requires more data security and quantum computing expertise than is currently available. For example, one study predicts that fewer than 50 percent of quantum computing jobs may be filled by 2025.	Information sharing.  As organizations adopt PQC, some—such as those in law enforcement and national security—may hesitate to share information with those that have not transitioned to PQC.Policy Context and QuestionsWhat additional steps could policymakers take to protect against decryption of sensitive data by quantum computers?	What additional planning may be needed to upgrade infrastructure to support PQC?	What actions could help build a workforce capable of understanding, implementing, and advancing PQC as needed?For more information, contact Brian Bothwell at (202) 512-6888 or bothwellb@gao.gov&nbsp;and&nbsp;Marisol Cruz Cain at (202) 512-5017 or CruzCainM@gao.gov.
- Global Cybercrime: Federal Agency Efforts to Address International Partners' Capacity to Combat Crime What GAO FoundThe Departments of State, Justice (DOJ), and Homeland Security (DHS) officials, and experts from international entities identified six mutual challenges in building global capacity to combat cybercrime. These included a lack of dedicated resources, difficulties in retaining highly trained staff, and inconsistent definitions of “cybercrime.” The expert panel also identified challenges in working with the U.S. government, including obstacles in obtaining information, lack of collaboration, and lack of dedicated funding streams.State, DOJ, and DHS have conducted a variety of activities to build foreign nations' capacity to combat cybercrime. These activities include engaging in information sharing with foreign partners and providing cyber training to foreign law enforcement officers. Agencies' activities can be grouped into four categories.Four Categories of Activities to Build Capacity to Combat CybercrimeThese agencies have documented accomplishments for many activities, such as nations joining international treaties aimed at combatting cybercrime. Further, State's plans include an evaluation of a regional forensics training center. This planned evaluation would meet the department's requirements. However, State has not conducted a comprehensive evaluation of the agencies' collective efforts. State is in the best position to conduct such an evaluation since it is authorized to provide foreign assistance funding to help build key allies' and partners' capacity to combat cybercrime. Until State conducts this comprehensive evaluation, the overall impact and results of federal assistance to global partners will likely remain unknown.Why GAO Did This StudyThe U.S. and its global partners are experiencing the effects of a massive cybercrime wave, which is growing in frequency and scale. In 2021, the Federal Bureau of Investigation received a record number of cybercrime complaints, over 840,000, with potential losses exceeding $6.9 billion. Further, in 2022, the intelligence community noted an increase in ransomware attacks by transnational criminals, which threaten to cause disruptions of critical services worldwide.GAO was asked to review federal efforts to build the capacity of allies and partner nations to combat cybercrime. This report's specific objectives were to (1) describe challenges in building global capacity to combat cybercrime, and (2) determine actions selected federal agencies are taking to build foreign nations' capacity to combat cybercrime and the extent to which they are evaluating the effectiveness of their efforts.GAO interviewed agency officials and convened a panel of experts representing entities focused on capacity building to combat global cybercrime. GAO also analyzed documentation from State, DOJ, and DHS, which provide the majority of U.S. capacity building assistance.
- Cybersecurity High-Risk Series: Challenges in Protecting Privacy and Sensitive Data OverviewWe have made 236 recommendations in public reports since 2010 with respect to protecting cyber critical infrastructure. Until these are fully implemented, federal agencies will be more limited in their ability to protect private and sensitive data entrusted to them. For more information on this report, visit https://www.gao.gov/cybersecurity.Improve Federal Efforts to Protect Privacy and Sensitive DataIn September 2022, our review of 24 agencies found that most had generally established policies and procedures for key privacy program activities. These activities included, among other things, developing system-of-records notices that identify types of personal data collected, conducting privacy impact assessments, and documenting privacy program plans. Agencies varied in establishing policies and procedures for coordinating privacy programs with other agency functions. Further, many agencies did not fully incorporate privacy into their risk management strategies, provide for privacy officials’ input into the authorization of systems containing PII, or develop a continuous monitoring strategy for privacy. Without fully establishing these elements of their privacy programs, agencies have less assurance that they are consistently implementing privacy protections.Extent to Which 24 Chief Financial Officers Act of 1990 Agencies Addressed Key Practices for Establishing a Privacy Program ➢ We recommended that Congress consider legislation to designate a dedicated, senior-level privacy official at agencies that lacked one. We also made recommendations to the Office of Management and Budget to facilitate information sharing to help agencies address selected challenges and better implement privacy impact assessments. Finally, we made recommendations to 23 of the 24 agencies we reviewed to fully implement all of the key practices for their privacy programs.Appropriately Limit the Collection and Use of Personal Information and Ensure that it is Obtained with Appropriate Knowledge or ConsentIn June 2021, we reported on the results of our survey of 42 federal agencies that employ law enforcement officers about their use of facial recognition technology. Twenty reported owning systems with facial recognition technology or using systems owned by other entities, such as other federal, tribal, state, local, and territorial governments and non-government entities.Types of Photos Used by Federal Agencies That Employ Law Enforcement Officers Agencies reported using the technology to support several activities (e.g., criminal investigations) and in response to COVID-19 (e.g., to verify an individual’s identity remotely). All 14 agencies that we reviewed reported using the technology to support criminal investigations also reported using systems owned by non-federal entities. However, only one of those 14 was aware of what non-federal systems employees used. By having a mechanism to track what non-federal systems employees use and assessing privacy and accuracy-related risks, agencies can better mitigate risks to themselves and the public.➢ We recommended that 13 federal agencies implement a mechanism to track what non-federal systems with facial recognition technology employees use and assess the risks of using these systems.In January 2022, we reported that the five federal financial regulators we reviewed had built more than 100 information system applications that regularly collect and use extensive amounts of PII to fulfill their regulatory missions. These regulators collect PII directly from individuals and financial institutions and share it with entities such as banks or service providers, contractors and other third parties, and other federal and state regulators. Regulators use the PII to conduct supervisory examinations of financial institutions and to receive and respond to complaints or inquiries from customers.Collection, Use, and Sharing of Personally Identifiable Information (PII) at Selected Federal Financial RegulatorsWe reported that the financial regulators we reviewed created privacy programs that generally take steps to protect PII in accordance with key practices in federal guidance. However, four of the regulators did not fully implement key practices in other privacy protection areas. For example, these regulators did not document steps taken to minimize the collection and use of PII. Until these regulators take steps to mitigate these weaknesses, the PII they collect, use, and share could be at increased risk of compromise.➢ We made several recommendations that federal financial regulators better ensure the privacy of the PII that they collect, use, and share.For more information about this Snapshot, contact: Marisol Cruz Cain, Director, Information Technology &amp; Cybersecurity, cruzcainm@gao.gov, (202) 512-5017.
- Cybersecurity High-Risk Series: Challenges in Protecting Cyber Critical Infrastructure OverviewWe have made 106 recommendations in public reports since 2010 with respect to protecting cyber critical infrastructure. Until these are fully implemented, federal agencies will be more limited in their ability to protect private and sensitive data entrusted to them. For more information on this report, visit https://www.gao.gov/cybersecurity.Strengthen the Federal Role in Protecting Cyber Critical InfrastructureThe U.S. grid’s distribution systems—which carry electricity from transmission systems to consumers and are regulated primarily by states—are increasingly at risk from cyberattacks. Distribution systems are growing more vulnerable, in part because of industrial control systems’ increasing connectivity. As a result, threat actors can use multiple techniques to access those systems and potentially disrupt operations.Examples of Techniques for Gaining Initial Access to Industrial Control Systems We reported in March 2021 that DOE, as the lead federal agency for the energy sector, developed plans to help combat these threats and implement the national cybersecurity strategy for the grid. However, DOE’s plans do not address distribution systems’ vulnerabilities related to supply chains. By not having plans that address the improvement to grid distribution systems’ cybersecurity, DOE’s plans will likely be of limited use in prioritizing federal support to states and industry.➢&nbsp;We recommended that, in developing plans to implement the national cybersecurity strategy for the grid, DOE coordinate with DHS, states, and industry to more fully address risks to the grid’s distribution systems from cyberattacks.The communications sector is an integral component of the U.S. economy and faces serious physical, cyber-related, and human threats that could affect the operations of local, regional, and national level networks, according to CISA and sector stakeholders. In addition to managing federal coordination during incidents impacting the communications sector, CISA shares information with sector stakeholders to enhance their cybersecurity and improve interoperability, situational awareness, and preparedness for responding to and managing incidents.Examples of Potential Security Threats to the Communications Sector In November 2021, we reported that CISA had not assessed the effectiveness of its programs and services supporting the security and resilience of the communications sector. By completing such an assessment, CISA would be better positioned to determine which programs and services are most useful or relevant in supporting the sector’s security and resilience. We also reported that CISA had not updated its 2015 Communications Sector-Specific Plan. Developing and issuing a revised plan would help CISA to address emerging threats and risks to the communications sector.➢ We recommended that CISA assess the effectiveness of its programs and services to support the communications sector and, in coordination with public and private communications sector stakeholders, produce a revised Communications Sector-Specific Plan.Ransomware is a form of malicious software that threat actors use in a multistage attack to encrypt files on a device and render data and systems unusable. These threat actors then demand ransom payments in exchange for restoring access to the locked data and systems.Four Stages of a Common Ransomware Attack In September 2022, we reported that CISA, FBI, and Secret Service provide assistance in preventing and responding to ransomware attacks on tribal, state, local, and territorial government organizations. However, the agencies could improve their efforts by fully addressing six of seven key practices for interagency collaboration in their ransomware assistance to state, local, tribal, and territorial governments. For instance, existing interagency collaboration on ransomware assistance to tribal, state, local, and territorial governments was informal and lacked detailed procedures.➢ We recommended that DHS and the Department of Justice address identified challenges and incorporate key collaboration practices in delivering services to state, local, tribal, and territorial governments.For more information about this Snapshot, contact: Marisol Cruz Cain, Director, Information Technology &amp; Cybersecurity, cruzcainm@gao.gov, (202) 512-5017.
- Cybersecurity High-Risk Series: Challenges in Securing Federal Systems and Information OverviewWe have made about 712 recommendations in public reports since 2010 with respect to securing federal systems and information. Until these are fully implemented, federal agencies will be more limited in their ability to protect private and sensitive data entrusted to them. For more information on this report, visit https://www.gao.gov/cybersecurity.Improve Implementation of Government-Wide Cybersecurity InitiativesFederal law assigned five key cybersecurity responsibilities to the Cybersecurity and Infrastructure Security Agency (CISA), including securing federal information and systems, and coordinating federal efforts to secure and protect against critical infrastructure risk. To implement these responsibilities, CISA undertook an organizational transformation initiative aimed at unifying the agency, improving mission effectiveness, and enhancing the workplace experience. In March 2021, we reported that CISA had only completed 37 of 94 planned implementation tasks. Critical transformation tasks such as finalizing the mission-essential functions of CISA’s divisions and defining incident management roles and responsibilities across the agency had not yet been completed.&nbsp;Five Key Responsibilities Assigned to the Cybersecurity and Infrastructure Security Agency ➢ We recommended that CISA establish expected completion dates, plans for developing performance measures, and an overall deadline for the completion of the transformation initiative, as well as develop a strategy for comprehensive workforce planning.Address Weaknesses in Federal Agency Information Security ProgramsTo protect federal information and systems, the Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies to develop, document, and implement information security programs. Congress included a provision in FISMA for GAO to periodically report on agencies’ implementation of the act. In March 2022, we reported on the information security programs of 23 federal civilian agencies, including annually required program reviews to be conducted by agency inspectors general (IG). Among other things, we noted that IGs determined that 16 (or 70 percent) of the 23 agencies had ineffective programs for fiscal year 2020.Number of the 23 Civilian Agencies with Effective and Not Effective Agency-Wide Information Security Programs, as Reported by Inspectors General for Fiscal Years 2017-2020  We found that OMB’s guidance to IGs on conducting agency evaluations was not always clear, leading to inconsistent application and reporting by IGs. Further, we reported that the binary effective/not effective scale resulted in imprecise ratings that did not clearly distinguish among the differing levels of agencies’ performance. By clarifying its guidance and enhancing its rating scale, OMB could help ensure more a more consistent approach and nuanced picture of agencies’ cybersecurity programs.➢ We recommended that OMB, in consultation with others, clarify its guidance to IGs and create a more precise overall rating scale.Enhance the Federal Response to Cyber IncidentsDOD and our nation's defense industrial base (DIB) are dependent on information systems to carry out their operations. These systems continue to be the target of cyberattacks, as demonstrated by over 12,000 cyber incidents DOD has experienced since 2015.Cyber Incidents Reported by Department of Defense's Cybersecurity Service Providers from Calendar Years 2015 through 2021In November 2022, we reported DOD has taken steps to combat these attacks and the number of cyber incidents had declined in recent years. However, we found that the department (1) had not fully implemented its processes for managing cyber incidents, (2) did not have complete data on cyber incidents that staff report, and (3) did not document whether it notifies individuals whose personal data is compromised in a cyber incident.In addition, according to officials, DOD has not yet decided whether DIB cyber incidents detected by cybersecurity service providers should be shared with all relevant stakeholders. Until DOD examines whether this information should be shared with all relevant parties, opportunities could be lost to identify system threats and improve system weaknesses.➢ We recommended the Department of Defense improve the sharing of DIB-related cyber incident information and document when affected individuals are notified of a PII breach of their data.For more information about this Snapshot, contact: Marisol Cruz Cain, Director, Information Technology &amp; Cybersecurity, cruzcainm@gao.gov, (202) 512-5017.
- Cybersecurity High-Risk Series: Challenges in Establishing a Comprehensive Cybersecurity Strategy and Performing Effective Oversight OverviewWe have made about 335 recommendations in public reports since 2010 with respect to establishing a comprehensive cybersecurity strategy and performing oversight. Until these are fully implemented, federal agencies will be more limited in their ability to protect private and sensitive data entrusted to them. For more information on this report, visit https://www.gao.gov/cybersecurity.Develop and Execute a More Comprehensive Federal Strategy for National Cybersecurity and Global CyberspaceThe White House’s September 2018 National Cyber Strategy and the National Security Council’s accompanying June 2019 Implementation Plan detail the executive branch’s approach to managing the nation’s cybersecurity. In September 2020, we reported that the strategy and implementation plan addressed some, but not all, of the desirable characteristics of national strategies. In June 2021, the Senate confirmed the first National Cyber Director to head the Office of the National Cyber Director and serve as the principal advisor to the President on cybersecurity policy and strategy.Extent to Which National Cyber Strategy and Implementation Plan Addressed the Desirable Characteristics of a National Strategy➢We recommended that the National Security Council work with relevant federal entities to update cybersecurity strategy documents to include goals, performance measures, and resource information, among other things. As of August 2022, according to the Office of the National Cyber Director, the development of a national cybersecurity strategy by the administration is underway.Mitigate Global Supply Chain RisksFederal agencies face numerous information and communications technology (ICT) supply chain risks, which could lead to disrupted mission operations, theft of intellectual property, and harm to individuals. In December 2020, our review of 23 civilian agencies found that none had fully implemented all of the seven foundational practices for supply chain risk management and that 14 had not implemented any of the practices.Extent to Which the 23 Civilian Agencies Implemented Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Practices➢We recommended that the 23 agencies fully implement foundational practices in their organization-wide approaches to ICT supply chain risk management.Develop a Government-wide Reform Plan that Addresses the Cybersecurity Workforce ShortageIn April 2020, we examined the extent to which reform plans from the Office of Management and Budget (OMB) and lead agencies addressed key practices for effectively implementing government-wide reforms such as those addressing the cybersecurity workforce shortage. We found that OMB and the Department of Homeland Security (DHS) partially addressed most key practices, including training employees to fill vacant cybersecurity positions and streamlining hiring processes. However, neither agency had established a dedicated implementation team or a government-wide implementation plan, among other practices.Extent to Which the Government-wide Plan to Solve the Cybersecurity Workforce Shortage Addressed Key Reform Practices➢We made several recommendations aimed at addressing continuing cybersecurity workforce challenges, including developing a government-wide workforce plan and related supporting practices. Government-wide leadership responsibility for cyber workforce issues transitioned in 2022 from OMB and DHS to the Office of the National Cyber Director. The office has committed to developing a national strategy that addresses key issues.Ensure the Security of the Emerging TechnologiesSecure Internet-connected DevicesThe nation’s critical infrastructure sectors rely on electronic systems, including Internet of Things (IoT) and operational technology (OT) devices and systems. In December 2022, we reported that the Departments of Energy, Health and Human Services, Homeland Security, and Transportation had cybersecurity initiatives underway intended to help protect three sectors. However, none of these agencies developed metrics to assess their efforts to mitigate sector risks or conducted IoT and OT cybersecurity risk assessments.Overview of Connected IT, Internet of Things (IoT), and Operational Technology➢We made eight recommendations to the Departments of Energy, Health and Human Services, Homeland Security, and Transportation to establish and use metrics to assess the effectiveness of sector IoT and OT cybersecurity efforts and evaluate sector IoT and OT cybersecurity risks.Quantum Computing Major Cybersecurity RisksQuantum technologies collect, generate, and process information in ways existing technologies cannot. We reported in September 2022 that quantum technologies could dramatically increase capabilities, including high-value applications in security and cryptography. However, such technology could create major cybersecurity risks such as a full-scale quantum computer to breaking standard encryption technologies. Consequently, the federal government’s cybersecurity infrastructure will need to evolve to address such threats.For more information about this Snapshot, contact: Marisol Cruz Cain, Director, Information Technology &amp; Cybersecurity, cruzcainm@gao.gov, (202) 512-5017.