*HomeU.S. Government Accountability Office*
Menu

      close


          
          
                          	
				
				
	
	
					Reports & Testimonies
									
																				
				
				
	
	
								Reports & Testimonies
													
																												
																						
							
																Recommendations Database
							
																												
																						
							
																Month in Review
							
																												
																						
							
																Order Copies
							
																												
																						
							
																Restricted Reports
							
																												
																						
							
																View Topics
							
																												
																						
							
																View Agencies
							
																												
																						
							
																Bid Protests & Appropriations Law
									
																				
				
				
	
	
								Bid Protests & Appropriations Law
													
																												
																						
							
																Bid Protests
							
																												
																						
							
																Appropriations Law
							
																												
																						
							
																Federal Vacancies Reform Act
							
																												
																						
							
																Other Legal
							
																												
																						
							
																About
									
																				
				
				
	
	
								About
													
																												
																						
							
																What GAO Does
							
																												
																						
							
																U.S. Comptroller General
							
																												
																						
							
																Careers
							
																												
																						
							
																Contact UsFor Congress
                                
                          
        
                Press Center
                                
                          
        
                Careers
                                
                          
        
                BlogSearch Breadcrumb
        Home
                            View Topics
                            Information Security
    Image

                          Information Security Jump To:
    Jump ToElder Abuse
          Services for Older Adults
          State and Local-Level Drivers and Trends
          State and Local Fiscal Projections
          Federal Borrowing
          Managing the Debt
          Summary of Funding Provisions
          Auditing the Government's Books
          Unpacking the Financial Report
          Highlights
          Recommendations
          Background
          About This Work
          About This Work
          Trends
          About the Center
          Why It's High Risk
          What Remains To Be Done
          Key Reports
          Newest COVID-Related Reports
          AI Use Cases
          Flood Insurance
          Past Pandemic-Related Reports
          CARES Act Oversight Reports
          All COVID-19 Reports
          Report Suspected Fraud
          Subjects
          How to Get Notified
          Past Reports
          Public Health Threats
          Explore the FY 2022 and 2023 Funds
          Lessons Learned
          Agency Reports
          Recent Reports
          Recommendations
          Supplemental Material
          Full Report
          Additional Data
          View Decision
          Downloads
          Previously Identified Actions
          Related Pages
          Associated Agencies
          Tough Choices and Opportunities Ahead
          Americas Fiscal Future Key Areas
          Retirement Security Key Areas
          Current List
          About The High Risk List
          Area Ratings
          Previous High Risk Products
          Search Federal Vacancies
          Past Federal Vacancies
          Violation Letters
          About the Yellow Book
          Advisory Council
          Related Resources
          Comment Letters
          Related Publications
          Contacts and Resources
          Major Issues Facing the Nation
          Meeting Strategic Challenges
          Additional Resources
          Resources
          GAO Contacts
          Mission Teams
          Operations and Staff Offices
          Organization Chart
          Why a Career at GAO?
          Am I Qualified?
          Company Culture
          Reasonable Accommodations
          Video Gallery
          Paid Internships
          Student Volunteers
          Professional Development Program
          Advancement
          Executive Candidate Program
          Summer Associates
          Externships
          Benefits
          Contacts
                    Image
      Recent Reports
    Cybersecurity: Improvements Needed in Addressing Risks to Operational TechnologyGAO-24-106576
      
	Published:  Mar 07, 2024


	Publicly Released: Mar 07, 2024
          Artificial Intelligence: Fully Implementing Key Practices Could Help DHS Ensure Responsible Use for CybersecurityGAO-24-106246
      
	Published:  Feb 07, 2024


	Publicly Released: Feb 07, 2024
          Cybersecurity: National Cyber Director Needs to Take Additional Actions to Implement an Effective StrategyGAO-24-106916
      
	Published:  Feb 01, 2024


	Publicly Released: Feb 01, 2024
          Critical Infrastructure Protection: Agencies Need to Enhance Oversight of Ransomware Practices and Assess Federal SupportGAO-24-106221
      
	Published:  Jan 30, 2024


	Publicly Released: Jan 30, 2024
          Cloud Security: Federal Authorization Program Usage Increasing, but Challenges Need to Be Fully AddressedGAO-24-106591
      
	Published:  Jan 18, 2024


	Publicly Released: Jan 18, 2024
          Cyber Diplomacy: State's Efforts Aim to Support U.S. Interests and Elevate PrioritiesGAO-24-105563
      
	Published:  Jan 11, 2024


	Publicly Released: Jan 11, 2024
    
    

  
  View More ReportsOpen Recommendations
        Cybersecurity: Improvements Needed in Addressing Risks to Operational TechnologyGAO-24-106576
      
						Mar 07, 2024
              Show
          4Open Recommendations

          Agency Affected
                                                  Recommendation
                                                  StatusCybersecurity and Infrastructure Security Agency
                                                                                        The Director of CISA should (1) measure customer service for all of its OT products and services and (2) use the results of such measures to make improvements to the products and services. (Recommendation 1)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Cybersecurity and Infrastructure Security Agency
                                                                                        The Director of CISA should (1) develop OT competency and staffing requirements, (2) assess OT competency and staffing gaps, and (3) develop strategies for filling any gaps. (Recommendation 2)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Cybersecurity and Infrastructure Security Agency
                                                                                        The Director of CISA should issue guidance on how SRMAs should update sector-specific plans that reflects the five selected leading collaboration practices when agencies are mitigating cyber OT risks. (Recommendation 3)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Cybersecurity and Infrastructure Security Agency
                                                                                        The Director of CISA should (1) develop an agency-wide policy on agreements with SRMAs regarding collaboration to mitigate OT risks and (2) implement that policy with the selected agencies. (Recommendation 4)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
          Artificial Intelligence: Fully Implementing Key Practices Could Help DHS Ensure Responsible Use for CybersecurityGAO-24-106246
      
						Feb 07, 2024
              Show
          8Open Recommendations

          Agency Affected
                                                  Recommendation
                                                  StatusDepartment of Homeland Security
                                                                                        The Chief Technology Officer should expand its review process to include steps to verify the accuracy of its AI inventory submissions. (Recommendation 1)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Department of Homeland Security
                                                                                        The Director of CISA should develop metrics to consistently measure progress toward all stated goals and objectives for Automated PII Detection. (Recommendation 2)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Department of Homeland Security
                                                                                        The Director of CISA should clearly define the roles and responsibilities and delegation of authority of all relevant stakeholders involved in managing and overseeing the implementation of the Automated PII Detection component to ensure effective operations and sustained oversight. (Recommendation 3)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Department of Homeland Security
                                                                                        The Director of CISA should document the sources and origins of data used to develop the Automated PII Detection component. (Recommendation 4)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Department of Homeland Security
                                                                                        The Director of CISA should take steps to assess and document the reliability of data used to enhance the representativeness, quality, and accuracy of the Automated PII Detection component. (Recommendation 5)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Department of Homeland Security
                                                                                        The Director of CISA should document its process for optimizing the elements used within the Automated PII Detection component. (Recommendation 6)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
          Cybersecurity: National Cyber Director Needs to Take Additional Actions to Implement an Effective StrategyGAO-24-106916
      
						Feb 01, 2024
              Show
          2Open Recommendations

          Agency Affected
                                                  Recommendation
                                                  StatusOffice of the National Cyber Director
                                                                                        The Director of ONCD should work with relevant federal entities to assess the initiatives that lend themselves to outcome-oriented performance measures and develop such performance measures for those initiatives in a timely manner to gauge effectiveness in meeting the goals and objectives of the National Cybersecurity Strategy. (Recommendation 1)
                                                                                        Open
ONCD agreed with this recommendation and said it will assess the initiatives to identify those that warrant outcome-oriented performance measures. When we confirm what actions ONCD has taken in response to this recommendation, we will provide updated information.Office of the National Cyber Director
                                                                                        The Director of ONCD should work with relevant federal entities to assess the initiatives to identify those that warrant a cost estimate and develop such cost estimates. (Recommendation 2)
                                                                                        Open
ONCD disagreed with this recommendation. We continue to believe that the recommendation is valid because we identified initiatives that may require significant costs. As such, we will monitor ONCD's efforts to address this recommendation.
          Cloud Security: Federal Authorization Program Usage Increasing, but Challenges Need to Be Fully AddressedGAO-24-106591
      
						Jan 18, 2024
              Show
          3Open Recommendations

          Agency Affected
                                                  Recommendation
                                                  StatusOffice of Management and Budget
                                                                                        The Director of OMB, in collaboration with the FedRAMP PMO, should issue guidance to agencies to ensure that they consistently track and report the costs of sponsoring a FedRAMP authorization of cloud services. (Recommendation 1)
                                                                                        Open
In October 2023, OMB published proposed guidance for public comment to modernize the FedRAMP program, as required by the FedRAMP Authorization Act (44 U.S.C. ? 3608-3616). The proposed guidance calls for the FedRAMP program management office and the FedRAMP board to seek feedback from industry on how to reduce the burden and cost of the FedRAMP authorization process for both federal agencies and cloud service providers. OMB requested that agencies report aggregated cloud security costs but did not ask agencies to separately track and report the specific costs for sponsoring the authorizations or provide them with guidance on how to track these costs. As a result, we recommended that OMB issue guidance to ensure agencies consistently track and report the costs of sponsoring a FedRAMP authorization. OMB did not comment on the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.Office of Management and Budget
                                                                                        The Director of OMB should finalize and implement the proposed new FedRAMP guidance, to include addressing the challenges identified in this report. (Recommendation 2)
                                                                                        Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.General Services Administration
                                                                                        The Administrator of General Services should direct the Director of FedRAMP to develop a plan, including firm time frames, for issuing guidance on how CSPs can navigate the FIPS 140-3 cryptographic requirements. (Recommendation 3)
                                                                                        Open
GSA agreed with the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
    
    

  
  View More RecommendationsRelated Pages
    RelatedProtecting Personal Privacy
          RelatedElections and Campaign Finance
          RelatedFinancial Technology
          RelatedK-12 Education
GAO Contacts
    
      Vijay A. D'Souza
      
              Vijay A. D'Souza
            
            Director
      
            dsouzav@gao.gov
      
            (202) 512-7650
    Nick Marinos
      
              Nick Marinos
            
            Managing Director
      
            MarinosN@gao.gov
      
            (202) 512-9342
    William Russell
      
              William Russell
            
            Director
      
            russellw@gao.gov
      
            (202) 512-4841
    Jennifer Franks
      
              Jennifer Franks
            
            Director
      
            franksj@gao.gov
      
            (404) 679-1831
    David Hinchman
      
              David (Dave) Hinchman
            
            Director
      
            HinchmanD@gao.gov
      
            (214) 777-5719
    Marisol Cruz Cain
      
              Marisol Cruz Cain
            
            Director
      
            cruzcainm@gao.gov
      
            (202) 512-5017

            View More Contacts
                                                      MultimediaIRS & Taxpayer Data: Critical Weaknesses in Security
      
        
        IRS & Taxpayer Data: Critical Weaknesses in Security
          Monday, September 11, 2023
          Cybersecurity of Critical Infrastructure – 12/2/21 Hearing Highlights
      
        
        Cybersecurity of Critical Infrastructure – 12/2/21 Hearing Highlights
          Monday, December 13, 2021Transcript
Podcasts
    
      The Growing Need for Cyber Diplomacy
    Thursday, January 11, 2024
      
            Transcript
          How Does DOD Protect Itself and Contractors from Cyberthreats?
    Monday, November 14, 2022
      
            Transcript
          Ransomware and Other Cyberattacks on K-12 Schools
    Monday, October 24, 2022
      
            Transcript
Photo of the White House with cyber locks illustrated on top of it.
          Blog Post
              The U.S. Now Has a National Cybersecurity Strategy, but Is It as Strong as It Could Be?
            Thursday, March 21, 2024
      
            In February, Change Healthcare, the largest health care payment processer in the United States, was...
          Illustration of a computer keyboard with the word "cybercrime" highlighted in red on the keys.
          Blog Post
              The U.S. Is Less Prepared to Fight Cybercrime Than It Could Be
            Tuesday, August 29, 2023
      
            Cybercrimes in the United States have resulted in hundreds of billions of dollars in losses, and...
 Receive GAO Updates
  Stay informed as we add new reports & testimonies.

    GAO Logo
      U.S. Government Accountability Office


                                   Column 1
                            Press Center
                              Contact Us
                              Inspector General
                              Restricted Reports
                              Column 2
                            Copyright & Terms of Use
                              Privacy Policy
                              Accessibility
                              Sitemap
                              Column 3
                            FOIA Requests
                              Scam Alerts
                              No FEAR Act Data
                              Health Care Advisory Committees