Defense Cybersecurity: Opportunities Exist for DOD to Share Cybersecurity Resources with Small Businesses
Published: 2015-09-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Small businesses, including those that conduct business with DOD, are vulnerable to cyber threats and may have fewer resources, such as robust cybersecurity systems, than larger businesses to counter cyber threats.
The Joint Explanatory Statement accompanying the National Defense Authorization Act for Fiscal Year 2015 included a provision that GAO assess DOD OSBP's outreach and education efforts to small businesses on cyber threats. This report addresses the extent to which DOD OSBP has integrated cybersecurity into its outreach and education efforts to defense small businesses. DOD OSBP's mission includes providing small business policy advice to the Office of the Secretary of Defense, and policy oversight to DOD military department and component small business offices.
To conduct this review, GAO analyzed documentation and interviewed officials from DOD OSBP about its cybersecurity outreach and education efforts. GAO also analyzed documentation and interviewed officials from nine organizations selected for their cybersecurity expertise to identify examples of cybersecurity outreach and education programs potentially available to defense small businesses.
section_title: What GAO Found
paragraphs: The Department of Defense (DOD) Office of Small Business Programs (OSBP) has explored some options, such as online training videos, to integrate cybersecurity into its existing efforts; however, as of July 2015, the office had not identified and disseminated cybersecurity resources in its outreach and education efforts to defense small businesses. While DOD OSBP is not required to educate small businesses on cybersecurity, DOD OSBP officials acknowledged that cybersecurity is an important and timely issue for small businesses—and therefore the office is considering incorporating cybersecurity into its existing outreach and education efforts. During the review, GAO identified 15 existing federal cybersecurity resources that DOD OSBP could disseminate to defense small businesses.
Source: GAO analysis of information from listed agencies. | GAO-15-777
While DOD OSBP officials recognized the importance of identifying and disseminating cybersecurity resources through outreach and education efforts to small businesses, they identified factors that had limited their progress in doing so. Specifically, they were not aware of existing cybersecurity resources, they had leadership turnover in the office, and the office was focused on developing a training curriculum for professionals who work with small businesses. While GAO recognizes that these factors could affect progress, federal government internal controls state that management should ensure there are adequate means of communicating with, and obtaining information from, external stakeholders who may have a significant impact on the agency's achieving its goals. DOD OSBP officials agreed that identifying and disseminating information about existing cybersecurity resources to defense small businesses could help small businesses be more aware of cybersecurity practices and cyber threats. In addition, by identifying and disseminating this information, DOD OSBP could help small businesses to protect their networks, thereby supporting the 2015 DOD Cyber Strategy goals of working with the private sector to help secure defense industrial base trade data and build layered cyber defenses.
section_title: What GAO Recommends
paragraphs: GAO recommends that DOD identify and disseminate cybersecurity resources to defense small businesses. DOD concurred with the recommendation and agreed to implement training events and education programs.

section_title: Letter
paragraphs: The Department of Defense (DOD) depends on small businesses to  support its missions, spark innovation, and develop technologies to  support the warfighter. In 2014, an official from the Federal Bureau of  Investigation testified that businesses are increasingly targeted for theft of  trade secrets and economic espionage by foreign entities—often with  state sponsorship and backing—that are enabled by cyber intrusions.  The Defense Security Service also reported in 2012 that our national  security relies on success in thwarting persistent attacks—including cyber  attacks—that target U.S. technology, intellectual property, trade secrets  and proprietary information. In February 2015, the Director of National  Intelligence reported that cyber threats to U.S. national and economic  security are increasing in frequency, scale, sophistication, and severity of  impact. He further stated that the range of cyber threat actors, methods of  attack, targeted systems, and victims is expanding. Small businesses in  particular have fewer resources, such as robust cybersecurity systems,  than larger businesses have to counter such threats.
In fiscal year 2014, DOD obligated approximately $55.5 billion to small  business prime contractors at over 51,000 locations. DOD maintains an  Office of Small Business Programs (OSBP) to ensure that small  businesses receive a fair proportion of DOD purchases, contracts, and  subcontracts for property and services. This office, among other things,  is responsible for providing small business policy advice to the Office of  the Secretary of Defense and for providing policy oversight to DOD  military department and DOD component small business offices. These  offices are responsible for ensuring that small businesses are afforded  the maximum practicable opportunity to participate in DOD acquisitions,  as well as establishing challenging small business program goals.
The Joint Explanatory Statement to accompany the National Defense  Authorization Act for Fiscal Year 2015 included a provision that GAO  assess the DOD OSBP’s outreach and education efforts to assist small  businesses in understanding cyber threats. This report addresses the  extent to which DOD OSBP has integrated cybersecurity into its existing  outreach and education efforts for defense small businesses.
We focused our review on DOD OSBP because that office is responsible  for providing small business policy advice to the Office of the Secretary of  Defense and providing policy oversight to DOD military department and  DOD component small business offices, per DOD Directive 4205.01.  While other DOD components may interact with small businesses, such  as the DOD Chief Information Officer and military department small  business program offices, we found that these other components either  do not exclusively focus their efforts on small businesses or, alternatively,  they rely on DOD OSBP policy and guidance with regard to working with  small businesses. To address our objective, we analyzed documentation  and interviewed officials from DOD OSBP about its existing cybersecurity  outreach and education efforts to small businesses. We also discussed  with DOD OSBP officials any challenges or limitations to their ability to  conduct cybersecurity outreach and education. As part of this review, we  evaluated the office’s efforts by comparing information on its activities  with Standards for Internal Control in the Federal Government. By  reviewing agency websites, interviewing agency officials, and searching  literature on cybersecurity resources, we determined that there was no  central repository of federal cybersecurity resources that could be  leveraged by the DOD OSBP to share with defense small businesses. In  the absence of such a central repository, we reviewed documentation and  interviewed officials from the following organizations with cybersecurity  expertise: DOD Chief Information Officer, Defense Security Service,  Defense Information Systems Agency, Department of Homeland Security  National Protection and Programs Directorate, Federal Bureau of  Investigation Cyber Division, National Institute of Standards and  Technology, U.S. Small Business Administration, Federal  Communications Commission, and the National Cyber Security Alliance  in order to identify examples of existing cybersecurity outreach and  education programs potentially available to defense small businesses that  could be leveraged by the DOD OSBP. We limited the scope of our  research to cybersecurity outreach and education programs that were  managed or funded by federal agencies. To confirm that these resources  were accessible to defense small businesses, we visited the websites  where these resources were publicly available during May 2015 or  interviewed agency officials. To validate the relevance of these resources  to cybersecurity, we reviewed information on the resource websites to  confirm that each resource contained some level of cybersecurity  information. We may not have identified all of the resources available or  interviewed all knowledgeable parties and we did not assess the quality of  the selected resources.
We conducted this performance audit from February 2015 to September  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. See appendix I for a  detailed description of the scope and methodology for this report.
subsections: section_title: Background
subsections: section_title: Cyber Threats to Federal Government Contractors
paragraphs: Federal government contractors, including defense small businesses,  face an evolving array of cyber-based threats. As we testified in April  2015, risks to cyber-based assets can originate from both unintentional  and intentional threats. Unintentional threats can be caused by, among  other things, defective computer or network equipment, and careless or  poorly trained employees. Intentional threats include both targeted and  untargeted attacks from a variety of sources, including criminal groups,  hackers, disgruntled employees, foreign nations engaged in espionage  and information warfare, and terrorists.
Threat sources vary in terms of the capabilities of the actors, their  willingness to act, and their motives, which can include monetary gain or  political advantage, among others. For example, adversaries possessing  sophisticated levels of expertise and significant resources to pursue their  objectives—sometimes referred to as “advanced persistent threats”—  pose increasing risks. Table 1 presents various sources of cyber  threats.
Threat sources make use of various techniques—or exploits—that may  adversely affect information computers, software, networks, and  operations. Table 2 presents various types of cyber exploits. The  number of information security incidents reported by federal agencies to  the U.S. Computer Emergency Readiness Team increased from 5,503 in  fiscal year 2006 to 67,168 in fiscal year 2014, an increase of 1,121  percent.
section_title: DOD OSBP’s Roles and Responsibilities
paragraphs: DOD has tasked DOD OSBP with ensuring that small businesses receive  a fair proportion of DOD purchases, contracts, and subcontracts for  property and services. This office is responsible for providing small  business policy advice to the Office of the Secretary of Defense and for  providing policy oversight to DOD military department and DOD  component small business offices. Those offices are responsible for  ensuring that small businesses are afforded the maximum practicable  opportunity to participate in DOD acquisitions and establishing  challenging small business program goals. DOD Directive 4205.01 states  that DOD OSBP should take part in outreach and education on small  business issues within DOD. Specifically, the directive states that DOD  OSBP should establish and support a small business training program for  Small Business Specialists and other acquisition personnel within DOD.  In addition, DOD OSBP provides resources on the DOD OSBP website,  and according to DOD OSBP officials, DOD OSBP also supports small  businesses by providing outreach and education by attending small  business conferences. However, according to DOD OSBP officials, none  of those responsibilities requires the office to integrate cybersecurity into  current or new outreach and education efforts.
section_title: Other DOD Components Supporting Small Businesses
paragraphs: While DOD OSBP is responsible for leading DOD’s efforts to support  small business initiatives, other DOD components support defense small  businesses. For example,
Military department small business office officials told us that their  offices routinely provide outreach and education to small businesses  on topics such as how to bid on DOD contracts; however, these  efforts do not include outreach and education on cybersecurity issues.
DOD Chief Information Officer manages the Defense Industrial Base  Cyber Security/Information Assurance Program to address the  pressing need to stem the risk posed by cyber attacks against  defense industrial base businesses. According to DOD Instruction  5205.13, the program established a comprehensive approach for  protecting unclassified DOD information transiting or residing on  unclassified defense industrial base information systems and  networks by incorporating the use of intelligence, operations, policies,  standards, information sharing, expert advice and assistance, incident  response, reporting procedures, and cyber intrusion damage  assessment solutions to address a cyber advanced persistent  threat. It was designed to establish a voluntary framework to prevent  unauthorized access to DOD program information or the intellectual  property of industry. This program is available only to a subset of  small companies since participating companies must be approved to  maintain classified information.
The Defense Security Service manages the National Industrial  Security Program for the Undersecretary of Defense for Intelligence,  which governs cleared contractor companies and their cleared  employees who support DOD and other federal agencies. The  Defense Security Service has security oversight of these contractors,  and provides them with related counterintelligence services and  security education, awareness, and training; this includes the foreign  threat to cleared contractors as an aspect of the counterintelligence  mission. DOD has designated the Defense Security Service as its  provider of security professional training and security awareness  products for DOD personnel and for the cleared contractors. Under  the National Industrial Security Program, the Defense Security  Service receives, analyzes, and shares information on activity  involving cleared contractor’s networks, regardless of the  classification that may reflect foreign intelligence interests and acts in  close coordination with the Federal Bureau of Investigation and other  federal law enforcement and counterintelligence community members.
section_title: Cybersecurity Provision within the Defense Federal Acquisition Regulation Supplement
paragraphs: In November 2013, DOD updated its Defense Federal Acquisition  Regulation Supplement to include a contract clause that requires defense  contractors and subcontractors to safeguard unclassified controlled  technical information on their unclassified information systems from  unauthorized access and disclosure and to report certain cyber incidents  to DOD. In addition, under the required clause, contractors are to  implement minimum privacy and security controls such as risk  assessments that were developed by the National Institute of Standards  and Technology, among other requirements. The 2015 DOD Cyber  Strategy states that DOD must work with the private sector to help secure  defense industrial base trade data. Furthermore, to safeguard critical  programs and technologies, the strategy states that DOD will work with  companies to develop alert capabilities and build layered cyber  defenses.
section_title: DOD Office of Small Business Programs Had Not Identified and Disseminated Cybersecurity Resources to Defense Small Businesses
paragraphs: DOD OSBP officials have explored some ways whereby the office could  integrate cybersecurity into its existing outreach and education efforts;  however, as of July 2015, the office had not identified and disseminated  information about cybersecurity resources in its outreach and education  efforts to defense small businesses. While DOD OSBP is not required to  educate small businesses on cybersecurity, DOD OSBP officials  acknowledged that cybersecurity is an important and timely issue for  small businesses—and therefore the office is considering incorporating  cybersecurity into its existing outreach and education efforts. In response  to our review, DOD OSBP officials contacted DOD Chief Information  Officer officials in April 2015 to discuss options for integrating  cybersecurity into their existing outreach and education efforts. According  to DOD OSBP officials, the DOD OSBP and DOD Chief Information  Officer officials discussed the development of training materials, such as  online videos and brochures that could be distributed at small business  conferences. The purpose of such training materials would be to help  defense small businesses in understanding cybersecurity best practices,  and the cybersecurity requirements identified in the Defense Federal  Acquisition Regulation Supplement. According to DOD OSBP officials,  the office also invited a DOD Chief Information Officer official to join a  DOD OSBP representative to speak with small businesses about  cybersecurity and to distribute a handout on cybersecurity and cyber  business opportunities at a small business conference held in April 2015.  In addition, recognizing that DOD’s small business offices may not be  staffed by cybersecurity experts, DOD OSBP officials stated that they  plan to add a cybersecurity component to a training curriculum that they  are currently developing along with DOD Chief Information Officer for  professionals who work in DOD small business offices. However, these  efforts have not been completed and, as of July 2015, DOD OSBP had  not identified or disseminated cybersecurity resources to defense small  businesses that the businesses could use to understand cybersecurity  and cyber threats.
We identified 15 existing federal cybersecurity outreach and education  resources that the office could leverage for defense small businesses.  For example:
DOD’s Defense Security Service offers online cybersecurity training  programs that are available to the public on topics such as  cybersecurity awareness, the National Institute of Standards and  Technology’s Risk Management Framework, insider threats, and  security controls through its public website. According to Defense  Security Service officials, DOD small businesses could use the online  training programs to improve their knowledge of cybersecurity.
The U.S. Small Business Administration maintains a learning center  that provides a 30-minute online program—available to small  businesses—that covers cybersecurity concepts for small business.  Topics include identifying and securing sensitive information, types of  cyber threats, risk management, and best practices for guarding  against cyber threats.
The Department of Homeland Security, in coordination with the  National Cyber Security Alliance and the Anti-Phishing Working  Group, provides cyber awareness resources to the public—including  cybersecurity awareness videos and tip sheets—on its  Stop.Think.Connect website and facilitates cybersecurity awareness  events targeted to various audiences, including businesses. This  resource is available to defense small businesses.
The Federal Communications Commission hosts a planning tool on its  website, known as the FCC Small Biz Cyber Planner 2.0 that is  targeted to small businesses and available to the public. This online  planner provides guidance to small businesses on developing their  cybersecurity plans and is available to defense small businesses.
See appendix II for a listing of the 15 resources we identified.
While DOD OSBP officials recognized the importance of identifying and  disseminating cybersecurity resources through outreach and education  efforts to defense small businesses, they also identified a number of  factors that had, to date, limited their progress in doing so. Specifically,  DOD OSBP officials were not aware of existing cybersecurity resources  such as those we identified when we met with them in June 2015, there  had been leadership turnover within the office, and the office had been  focused on one of its key initiatives—developing the training curriculum  for DOD professionals who work with small businesses. OSBP officials  also stated that they had been focused on their statutory requirements  such as training the DOD workforce that works with small businesses,  advocating for small businesses within the government, and reaching out  to small businesses in the private sector. While we recognize that these  factors could affect progress, federal government internal controls state  that management should ensure that there are adequate means of  communicating with, and obtaining information from, external  stakeholders who may have a significant impact on the agency’s  achieving its goals. While they had not yet identified or disseminated  information about existing cybersecurity resources to defense small  businesses, officials agreed that doing so could help the businesses to  become more aware of cybersecurity practices and cyber threats. In  addition, by identifying and disseminating this information, DOD OSBP  could help defense small businesses to protect their networks against  cyber exploits, which would support the 2015 DOD Cyber Strategy goals  of working with the private sector to help secure defense industrial base  trade data and build layered cyber defenses. Furthermore, by identifying  existing federal government resources, OSBP’s efforts would be in line  with DOD Instruction 5134.04, which states that the OSBP Director shall  use the existing services and systems of DOD and other federal  agencies, when practicable, to avoid duplication and to achieve maximum  efficiency and economy. Finally, once OSBP has identified the  resources, it can also share them with military department and  component small business offices so that they can use them for their own  outreach and education efforts with defense small businesses.
section_title: Conclusions
paragraphs: DOD spends billions of dollars contracting with defense small businesses,  and relies on these businesses to support its missions. However, defense  small businesses face challenges in protecting their corporate networks  and information from increasing cyber threats. While DOD OSBP officials  have recognized the importance of educating defense small businesses  about cybersecurity, they have not identified and disseminated  cybersecurity resources through their outreach and education efforts to  businesses because they have been focused on other priorities, such as  developing a training curriculum for DOD professionals who work with  small businesses. By identifying and disseminating information about  existing cybersecurity resources to defense small businesses, these  businesses may be made more aware of cybersecurity practices and  cyber threats, thereby potentially assisting them in protecting their  networks against cyber exploits. By leveraging resources that DOD  components and other federal agencies have already developed, some of  which have been identified in this report, DOD OSBP will be able to  spend more time focusing on other priorities such as developing the  training curriculum.
section_title: Recommendation for Executive Action
paragraphs: To better position defense small businesses in protecting information and  networks from cyber threats, we recommend that the Secretary of  Defense direct the Director of the DOD OSBP, as part of its existing  outreach efforts, to identify and disseminate cybersecurity resources to  defense small businesses.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOD, the Federal Communications  Commission, the Department of Homeland Security, the Department of  Justice, the U.S. Small Business Administration, and the National Institute  of Standards and Technology for review and comment.
DOD’s written comments are included in appendix III. DOD concurred  with our recommendation that the Secretary of Defense direct the Director  of the DOD OSBP, as part of its existing outreach efforts, to identify and  disseminate cybersecurity resources to defense small businesses. DOD  stated that understanding the essential need to protect DOD critical  networks, information and infrastructure—including those within defense  small businesses—DOD OSBP, with support from the DOD Chief  Information Officer, is expanding its current cybersecurity awareness and  outreach programs. DOD stated further that the resources we identified  reflect a thorough assessment of available federal capabilities and are  very helpful to any organization conducting cybersecurity education for its  stakeholders. DOD noted that future outreach by the DOD OSBP will  increase awareness of cybersecurity education and training resources to  defense small businesses. Finally, DOD noted that OSBP will also  increase awareness of the cybersecurity education resources among the  DOD small business workforce through training events and education  programs, and by issuing guidance to the military departments and  defense agencies. DOD OSBP added in its technical comments that the  office has new leadership and staff in place to expand cybersecurity  education for small businesses. The office also noted that it is using a  measured approach involving existing information resources and  inclusion of cybersecurity information in the development of DOD  workforce training and the ongoing creation of outreach materials and  presentations. We believe that by identifying and disseminating  cybersecurity information, DOD OSBP will help defense small businesses  to become more aware of cybersecurity practices and cyber threats and  help them protect their networks against cyber exploits.
In technical comments on the report, the Federal Communications  Commission identified the following additional federal cybersecurity  resource—the Communications Security, Reliability and Interoperability  Council - Cybersecurity Risk Management and Best Practices Working  Group 4: Final Report. The report’s appendix provides cybersecurity risk  management and best practice recommendations for small and medium  business interests, includes potential challenges and barriers to best  practice implementation, and includes a compilation of cybersecurity  resources available to small businesses. Although the report appendix is  intended for small and medium businesses in the communications  industry, it is also publicly available online to defense small business  contractors.
DOD provided additional technical comments that we incorporated as  appropriate. The Department of Homeland Security and the National  Institute of Standards and Technology also provided technical comments  that we incorporated as appropriate. The U.S. Small Business  Administration and the Department of Justice did not comment on the  report.
We are sending copies of this report to appropriate congressional  committees; the Secretary of Defense; the Secretary of Homeland  Security; the U.S. Attorney General; the Chairman of the Federal  Communications Commission; the Director of the National Institute of  Standards and Technology; and the Administrator of the U.S. Small  Business Administration. In addition, the report is available at no charge  on the GAO website at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-9971 or KirschbaumJ@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: We focused our review on the Department of Defense (DOD) Office of  Small Business Programs (OSBP) because this office is responsible for  providing small business policy advice to the Office of the Secretary of  Defense and for providing policy oversight to DOD military department  and DOD component small business offices, per DOD Directive 4205.01.  While other DOD components such as the DOD Chief Information Officer  and military department small business program offices may interact with  small businesses, we found these other components either do not  exclusively focus their efforts on small businesses or they rely on DOD  OSBP policy and guidance with regard to working with small businesses.
To address the extent to which the DOD OSBP has integrated  cybersecurity into its existing outreach and education efforts for defense  small businesses, we analyzed documentation and interviewed officials  from the DOD OSBP about its existing cybersecurity outreach and  education efforts to small businesses. We also discussed with DOD  OSBP officials any challenges or limitations to their ability to conduct  cybersecurity outreach and education. As part of this review, we  evaluated the office’s efforts by comparing information on their activities  with Standards for Internal Control in the Federal Government.
By reviewing agency websites, interviewing agency officials, and  searching literature on cybersecurity resources, we determined that there  was no central repository of federal cybersecurity resources that could be  leveraged by the DOD OSBP to share with defense small businesses. In  the absence of such a central repository, we reviewed documentation and  interviewed officials from the following organizations with cybersecurity  expertise: DOD Chief Information Officer, Defense Security Service,  Defense Information Systems Agency, Department of Homeland Security  National Protection and Programs Directorate, Federal Bureau of  Investigation Cyber Division, National Institute of Standards and  Technology, U.S. Small Business Administration, Federal  Communications Commission, and the National Cyber Security Alliance  in order to identify examples of existing cybersecurity outreach and  education programs potentially available to defense small businesses that  could be leveraged by the DOD OSBP. We limited the scope of our  research to cybersecurity outreach and education programs that were  managed or funded by federal agencies. To confirm that these resources  were accessible to defense small businesses, we visited the websites  where these resources were publicly available during May 2015 or  interviewed agency officials. To validate that the resources were relevant  to cybersecurity, we reviewed information on the resource websites to  confirm that each resource contained some level of cybersecurity  information. We may not have identified all of the resources available or  interviewed all knowledgeable parties, and we did not assess the quality  of the selected resources.
To describe the approximate size of DOD’s current small business  community, we aggregated obligations data for DOD’s prime contractors  coded as small in the Federal Procurement Data System-Next Generation  database for fiscal year 2014. This database does not collect data on  subcontractors to defense businesses, so the reported data likely  underestimate the size of the DOD small business community. We  compared this data to the U.S. Small Business Administration Fiscal Year  2014 Small Business Goaling Report and found the data to be sufficiently  reliable to provide an overview of DOD’s spending on prime contracts  with small businesses. We define the terms “cybersecurity” and “threat”  in the introduction of the report using definitions from the National Institute  of Standards and Technology and we define “small business” in the  introduction of the report using DOD’s methodology.
We conducted this performance audit from February 2015 to September  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Federal Government and Federally-Funded Cybersecurity Resources GAO Identified as Available to Defense Small Businesses
section_title: Appendix III: Comments from the Department of Defense
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, GAO staff who made significant  contributions to this report include Tommy Baril (Assistant Director), Tracy  Barnes, David Beardwood, Kevin Copping, and Patricia Farrell Donahue.
section_title: Related GAO Products
paragraphs: Information Security: Cyber Threats and Data Breaches Illustrate Need  for Stronger Controls across Federal Agencies. GAO-15-758T.  Washington, D.C.: July 8, 2015.
Insider Threats: DOD Should Strengthen Management and Guidance to  Protect Classified Information and Systems. GAO-15-544. Washington,  D.C.: June 2, 2015.
Cybersecurity: Actions Needed to Address Challenges Facing Federal  Systems. GAO-15-573T. Washington, D.C.: April 22, 2015.
Information Security: Agencies Need to Improve Oversight of Contractor  Controls. GAO-14-612. Washington, D.C.: August 8, 2014.
Information Security: Agencies Need to Improve Cyber Incident  Response Practices. GAO-14-354. Washington, D.C.: April 30, 2014.
Information Security: Federal Agencies Need to Enhance Responses to  Data Breaches. GAO-14-487T. Washington, D.C.: April 2, 2014.
Federal Information Security: Mixed Progress in Implementing Program  Components; Improved Metrics Needed to Measure Effectiveness.   GAO-13-776. Washington, D.C.: September 26, 2013.
Government Contracting: Federal Efforts to Assist Small Minority Owned  Businesses. GAO-12-873. Washington, D.C.: September 28, 2012.
Defense Cyber Efforts: Management Improvements Needed to Enhance  Programs Protecting the Defense Industrial Base from Cyber Threats.  GAO-12-762SU. Washington, D.C.: August 3, 2012. This report is  restricted to official use only and is not publicly available.
Information Security: Cyber Threats Facilitate Ability to Commit Economic  Espionage. GAO-12-876T. Washington, D.C.: June 28, 2012.
Cybersecurity: Threats Impacting the Nation. GAO-12-666T. Washington,  D.C.: April 24, 2012.
IT Supply Chain: National Security-Related Agencies Need to Better  Address Risks. GAO-12-361. Washington, D.C.: March 23, 2012.