*HomeU.S. Government Accountability Office*
Menu

      close


          
          
                          	
				
				
	
	
					Reports & Testimonies
									
																				
				
				
	
	
								Reports & Testimonies
													
																												
																						
							
																Recommendations Database
							
																												
																						
							
																Month in Review
							
																												
																						
							
																Order Copies
							
																												
																						
							
																Restricted Reports
							
																												
																						
							
																View Topics
							
																												
																						
							
																View Agencies
							
																												
																						
							
																Bid Protests & Appropriations Law
									
																				
				
				
	
	
								Bid Protests & Appropriations Law
													
																												
																						
							
																Bid Protests
							
																												
																						
							
																Appropriations Law
							
																												
																						
							
																Federal Vacancies Reform Act
							
																												
																						
							
																Other Legal
							
																												
																						
							
																About
									
																				
				
				
	
	
								About
													
																												
																						
							
																What GAO Does
							
																												
																						
							
																U.S. Comptroller General
							
																												
																						
							
																Careers
							
																												
																						
							
																Contact UsFor Congress
                                
                          
        
                Press Center
                                
                          
        
                Careers
                                
                          
        
                BlogSearch < WatchBlog: Following the Federal Dollar
    The U.S. Now Has a National Cybersecurity Strategy, but Is It as Strong as It Could Be? Posted on March 21, 2024
                    In February, Change Healthcare, the largest health care payment processer in the United States, was the victim of a ransomware attack that disrupted services across the country. The attack threatened health care workers’ paychecks, impacted the ability to fill prescriptions, and even disrupted patient care throughout the health care system.Attacks like this underscore the need for action to protect our nation’s critical services, such as health care, water, electric, and our financial institutions. Last year, the White House issued a National Cybersecurity Strategy that outlines steps the government is taking to address the longstanding cybersecurity challenges facing the country. We looked at the national strategy’s plans and found some key weaknesses that could diminish its effectiveness and cost taxpayers more money.Today’s WatchBlog post looks atour new reportand what we found.Image
              Photo of the White House with cyber locks illustrated on top of it.**Cybersecurity leaders have incomplete plans for measuring success and failures of cyber efforts**The White House National Cybersecurity Strategy and the plan to implement it outlined efforts to address cybersecurity challenges, like protecting the privacy of public data and defeating ransomware. The strategy is intended to better secure cyberspace and ensure the United States is in the strongest possible position to realize all the benefits and potential of a digital future.But the strategy doesn’t include outcome-oriented performance measures for various cybersecurity initiatives, such as information sharing or modernizing federal agency defenses. Therefore, federal cybersecurity leaders do not have a comprehensive way to assess or ensure that their efforts are accomplishing greater cybersecurity.We asked officials why plans do not include these important measures. They told us that it was not realistic to develop outcome-oriented measures at this point because of the inherent difficulty of measuring success in cybersecurity. But some of the key information needed to measure outcomes is already available. For example, the Department of the Treasury already collects information on the number and dollar value of ransomware-related incidents. In calendar year 2021, the reported total dollar value was about $886 million.Knowing the size of a problem can help officials set goals to reduce it, know the effectiveness of actions, and direct resources where needed. But as discussed above and in the graphic below, the plan lacks this key element.**Extent to Which the March 2023*****National Cybersecurity Strategy*****and July 2023 Implementation Plan Addressed GAO's Desirable Characteristics of a National Strategy**Image
              Graphic showing extent to which the National Cybersecurity plan addresses GAO's desirable characteristics of a national strategy.**A cost estimate will cost taxpayers, but not having one may cost them even more**There’s no price tag for how much it will cost to develop and implement a national cybersecurity strategy. Federal officials we interviewed said estimating this cost is unrealistic due to the current budget process where cost may be embedded in agencies’ baseline budgets.We agree that it may not be possible to estimate every initiative. But some initiatives under the plan could have significant costs and should be estimated to make sure funds are directed where needed and used effectively. For example, one initiative tasks the Department of Justice with enhancing its capabilities for responding to cyber campaigns against the United States. A cost estimate would help make sure that these efforts have enough funds, staff, and other resources to be effective.Developing a national strategy is a critical step in addressing our nation’s cyber challenges. But to be effective, the strategy needs clear measures of success and an estimate of the costs to achieve them. As a result, we’ve made recommendations to address gaps in current implementation efforts.Learn more about our work on the National Cybersecurity Strategy by checking outour latest reportor by visiting our key issues web page oncybersecurity.GAO’s fact-based, nonpartisan information helps Congress and federal agencies improve government. The WatchBlog lets us contextualize GAO’s work a little more for the public. Check out more of our posts atGAO.gov/blog.
TopicsInformation Security
                        Cybersecurity and Infrastructure Security Agency
                        Cybersecurity
              Critical infrastructure protection
                        Information Technology and Cybersecurity
GAO Contacts
    
      Marisol Cruz Cain
      
              Marisol Cruz Cain
            
            Director
      
            cruzcainm@gao.gov
      
            (202) 512-5017
		
					Related Posts
		
			Photo of an electricity grid (the towers) with superimposed lines connecting them in a cyber way.
          Blog Post
              Improving Communication Could Strengthen Federal Efforts to Prevent the Next Major Cyberattack
            Wednesday, September 27, 2023
      
            We’ve already seen what can happen when one of the nation’s critical services is disrupted by a...
          photo of the IRS building sign
          Blog Post
              Taxpayer Information Keeps Ending Up In the Wrong Hands. What Can IRS Do To Better Protect It?
            Tuesday, September 26, 2023
      
            When you file your taxes each year, you expect IRS to keep your personal and financial information...
          Photo of hands on a laptop computer keyboard with cartoonish icons surrounding it of different systems like a cloud, email, file, screen, documents
          Blog Post
              After a Recent Hacking—What are the Risks and Rewards of Cloud Computing Use by the Federal Government?
            Thursday, August 10, 2023
      
            Cloud computing offers significant opportunities to increase government efficiency, as well as...

Related Products
					Cybersecurity: National Cyber Director Needs to Take Additional Actions to Implement an Effective StrategyProduct Number
              GAO-24-106916

	Published:  Feb 01, 2024


	Publicly Released: Feb 01, 2024
About WatchblogGAO's mission is to provide Congress with fact-based, nonpartisan information that can help improve federal government performance and ensure accountability for the benefit of the American people. GAO launched its WatchBlog in January, 2014, as part of its continuing effort to reach its audiences—Congress and the American people—where they are currently looking for information.

The blog format allows GAO to provide a little more context about its work than it can offer on its other social media platforms. Posts will tie GAO work to current events and the news; show how GAO’s work is affecting agencies or legislation; highlight reports, testimonies, and issue areas where GAO does work; and provide information about GAO itself, among other things.

Please send any feedback on GAO's WatchBlog to blog@gao.gov.
 Receive GAO Updates
  Stay informed as we add new reports & testimonies.

    GAO Logo
      U.S. Government Accountability Office


                                   Column 1
                            Press Center
                              Contact Us
                              Inspector General
                              Restricted Reports
                              Column 2
                            Copyright & Terms of Use
                              Privacy Policy
                              Accessibility
                              Sitemap
                              Column 3
                            FOIA Requests
                              Scam Alerts
                              No FEAR Act Data
                              Health Care Advisory Committees