Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress
Published: 2015-11-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: U. S. critical infrastructures, such as financial institutions, commercial buildings, and energy production and transmission facilities, are systems and assets, whether physical or virtual, vital to the nation's security, economy, and public health and safety. To secure these systems and assets, federal policy and the NIPP establish responsibilities for federal agencies designated as SSAs, including leading, facilitating, or supporting the security and resilience programs and associated activities of their designated critical infrastructure sectors.
GAO's objectives were to determine the extent to which SSAs have (1) identified the significance of cyber risks to their respective sectors' networks and industrial control systems, (2) taken actions to mitigate cyber risks within their respective sectors, (3) collaborated across sectors to improve cybersecurity, and (4) established performance metrics to monitor improvements in their respective sectors. To conduct the review, GAO analyzed policy, plans, and other documentation and interviewed public and private sector officials for 8 of 9 SSAs with responsibility for 15 of 16 sectors.
section_title: What GAO Found
paragraphs: Sector-specific agencies (SSA) determined the significance of cyber risk to networks and industrial control systems for all 15 of the sectors in the scope of GAO's review. Specifically, they determined that cyber risk was significant for 11 of 15 sectors. Although the SSAs for the remaining four sectors had not determined cyber risks to be significant during their 2010 sector-specific planning process, they subsequently reconsidered the significance of cyber risks to the sector. For example, commercial facilities sector–specific agency officials stated that they recognized cyber risk as a high-priority concern for the sector as part of the updated sector planning process. SSAs and their sector partners are to include an overview of current and emerging cyber risks in their updated sector-specific plans for 2015.
SSAs generally took actions to mitigate cyber risks and vulnerabilities for their respective sectors. SSAs developed, implemented, or supported efforts to enhance cybersecurity and mitigate cyber risk with activities that aligned with a majority of actions called for by the National Infrastructure Protection Plan (NIPP). SSAs for 12 of the 15 sectors had not identified incentives to promote cybersecurity in their sectors as proposed in the NIPP; however, the SSAs are participating in a working group to identify appropriate incentives. In addition, SSAs for 3 of 15 sectors had not yet made significant progress in advancing cyber-based research and development within their sectors because it had not been an area of focus for their sector. Department of Homeland Security guidance for updating the sector-specific plans directs the SSAs to incorporate the NIPP's actions to guide their cyber risk mitigation activities, including cybersecurity-related actions to identify incentives and promote research and development.
All SSAs that GAO reviewed used multiple public-private and cross-sector collaboration mechanisms to facilitate the sharing of cybersecurity-related information. For example, the SSAs used councils of federal and nonfederal stakeholders, including coordinating councils and cybersecurity and industrial control system working groups, to coordinate with each other. In addition, SSAs participated in the National Cybersecurity and Communications Integration Center, a national center at the Department of Homeland Security, to receive and disseminate cyber-related information for public and private sector partners.
The Departments of Defense, Energy, and Health and Human Services established performance metrics for their three sectors. However, the SSAs for the other 12 sectors had not developed metrics to measure and report on the effectiveness of all of their cyber risk mitigation activities or their sectors' cybersecurity posture. This was because, among other reasons, the SSAs rely on their private sector partners to voluntarily share information needed to measure efforts. The NIPP directs SSAs and their sector partners to identify high-level outcomes to facilitate progress towards national goals and priorities. Until SSAs develop performance metrics and collect data to report on the progress of their efforts to enhance the sectors' cybersecurity posture, they may be unable to adequately monitor the effectiveness of their cyber risk mitigation activities and document the resulting sector-wide cybersecurity progress.
section_title: What GAO Recommends
paragraphs: GAO recommends that certain SSAs collaborate with sector partners to develop performance metrics and determine how to overcome challenges to reporting the results of their cyber risk mitigation activities. Four of these agencies concurred with GAO's recommendation, while two agencies did not comment on the recommendations.

section_title: Letter
paragraphs: The nation’s critical infrastructure provides the essential services–such as  banking, water, and electricity–that underpin American society, and it  relies extensively on computerized systems and electronic data to carry  out its missions. The cyber threat to critical infrastructure continues to  grow and represents a serious national security challenge. Foreign  malicious actors have directly attacked and extracted highly sensitive  materials from the networks of government agencies and major critical  infrastructure companies. To address the threat, a proactive and  coordinated effort is necessary to strengthen and maintain secure,  functioning, and resilient critical infrastructure–including privately owned  or operated assets, networks, and systems–that are vital to public  confidence and the nation’s security, economy, health, and safety.
Due to the cyber-based threats to federal systems and critical  infrastructure, the persistent nature of information security vulnerabilities,  and the associated risks, we continue to designate information security as  a government-wide high-risk area in our most recent biennial report to  Congress, a designation we have made in each report since 1997. In  2003, we expanded this high-risk area to include the protection of critical  cyber infrastructure and we continued to do so in the most recent update  to our high-risk list.
Federal policy and public-private plans establish various mechanisms for  the development of public-private partnerships to help secure critical  infrastructure. For example, the National Infrastructure Protection Plan  (NIPP) calls for efforts to be carried out through the joint efforts of  multiple components of a partnership model, including federal agencies,  referred to as “sector-specific agencies” (SSA), that are to serve as a  federal interface for the prioritization and coordination of security and  resilience efforts and to carry out incident management responsibilities for  their assigned critical infrastructure sectors. Presidential Policy Directive  21 (PDD-21), among other things, identified 16 critical infrastructure  sectors and designated associated federal SSAs.
At your request, we reviewed the cybersecurity efforts of SSAs within  their sectors and across sectors. Our objectives were to determine the  extent to which SSAs have (1) identified the significance of cyber risks to  their respective sectors’ networks and industrial control systems, (2)  taken actions to mitigate cyber risks within their respective sectors, (3)  collaborated across sectors to improve cybersecurity, and (4) established  performance metrics to monitor improvements in their respective sectors.
To conduct our evaluation, we analyzed relevant critical infrastructure  protection policies and guidance for improving the cybersecurity posture  of the nation’s critical infrastructure. Based on these analyses, we  identified nine federal departments and agencies designated as the SSA  for a critical infrastructure sector. For this review, we focused on eight of  the nine SSAs responsible for 15 of the 16 critical infrastructure sectors.  We included the 15 sectors that involve private sector stakeholders in the  SSAs’ efforts to implement activities to address sector security and  resiliency goals.
To determine the extent to which SSAs identified the significance of cyber  risks to their respective sectors, we reviewed the risk assessment  methodologies employed by each SSA, as documented in the 2010  sector-specific plans, and other supplementary documentation such as  formal risk assessment documents. To determine the extent of SSAs’  activities to mitigate cyber risks, we compared sector-specific planning  documents and actions against 10 of 12 efforts called for in the 2013  NIPP that we determined to have a cybersecurity nexus. To determine  the extent of the sector-specific agencies’ collaborative efforts to enhance  their sectors’ cybersecurity environment, we identified the collaborative  councils and working groups that SSAs used to share cybersecurity- related information within and across the sectors. To identify performance  measures implemented for sector-specific agencies to monitor  cybersecurity in their respective sectors, we analyzed annual reports and  other performance reporting documents. Additionally, we reviewed past  sector annual reports, which tracked actions of the sector against goals  established in the 2010 sector-specific plans.
For the four objectives, we also interviewed federal officials from the eight  SSAs regarding activities such as their efforts to identify cybersecurity  risks to their respective critical infrastructure sectors, mitigate such risk,  collaborate across sectors on cybersecurity-related issues, and measure  the progress of sectors and the effectiveness of their effort. In addition, to  confirm federal efforts and better understand the roles and responsibilities  of the SSAs, we collected and analyzed relevant documents and  interviewed private sector stakeholders from the 15 identified critical  infrastructure sectors.
We conducted this performance audit from June 2014 to November 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix I discusses our  objectives, scope, and methodology in greater detail.
subsections: section_title: Background
paragraphs: U. S. critical infrastructure is made of systems and assets, whether  physical or virtual, so vital to the United States that the incapacity or  destruction of such systems and assets would have a debilitating impact  on the nation’s security, national economic security, national public health  or safety, or any combination of these matters. Critical infrastructure  includes, among other things, banking and financing institutions,  telecommunications networks, and energy production and transmission  facilities, most of which are owned and operated by the private sector.  Sector-specific agencies (SSA) are federal departments or agencies with  responsibility for providing institutional knowledge and specialized  expertise as well as leading, facilitating, or supporting the security and  resilience programs and associated activities of its designated critical  infrastructure sector in the all-hazards environment.
subsections: section_title: The Nation Faces an Evolving Array of Cyber- Based Threats
paragraphs: Threats to systems supporting critical infrastructure are evolving and  growing. Cyber threats can be unintentional or intentional. Unintentional  or non-adversarial threats include equipment failures, software coding  errors, and the actions of poorly trained employees. They also include  natural disasters and failures of critical infrastructure on which the  organization depends but are outside of its control. Intentional threats  include both targeted and untargeted attacks from a variety of sources,  including criminal groups, hackers, disgruntled employees, foreign  nations engaged in espionage and information warfare, and terrorists.  These threat adversaries vary in terms of the capabilities of the actors,  their willingness to act, and their motives, which can include seeking  monetary gain or seeking an economic, political, or military advantage.  Table 1 describes the sources of cyber-based threats in more detail.
Cyber threat adversaries make use of various techniques, tactics, and  practices, or exploits, to adversely affect an organization’s computers,  software, or networks, or to intercept or steal valuable or sensitive  information. These exploits are carried out through various conduits,  including websites, e-mail, wireless and cellular communications, Internet  protocols, portable media, and social media. Further, adversaries can  leverage common computer software programs, such as Adobe Acrobat  and Microsoft Office, to deliver a threat by embedding exploits within  software files that can be activated when a user opens a file within its  corresponding program. Table 2 provides descriptions of common  exploits or techniques, tactics, and practices used by cyber adversaries.
Reports of cyber exploits illustrate the debilitating effects such attacks can  have on the nation’s security, economy, and on public health and safety.
In May 2015, media sources reported that data belonging to 1.1  million health insurance customers in the Washington, D.C., area  were stolen in a cyber attack on a private insurance company.  Attackers accessed a database containing names, birth dates, e-mail  addresses, and subscriber ID numbers of customers.  In December 2014, the Industrial Control Systems Cyber Emergency  Response Team (ICS-CERT) issued an updated alert on a  sophisticated malware campaign compromising numerous industrial  control system environments. Their analysis indicated that this  campaign had been ongoing since at least 2011.  In the January 2014 to April 2014 release of its Monitor Report, ICS- CERT reported that a public utility had been compromised when a  sophisticated threat actor gained unauthorized access to its control  system network through a vulnerable remote access capability  configured on the system. The incident highlighted the need to  evaluate security controls employed at the perimeter and ensure that  potential intrusion vectors are configured with appropriate security  controls, monitoring, and detection capabilities.
section_title: Federal Guidance Establishes Specific Roles and Responsibilities for Protecting the Nation’s Critical Infrastructure
paragraphs: Federal policy and public-private plans establish roles and responsibilities  for federal agencies working with the private sector and other entities to  enhance the cyber and physical security of public and private critical  infrastructures. These include PPD-21 and the NIPP.
PPD-21 shifted the nation’s focus from protecting critical infrastructure  against terrorism toward protecting and securing critical infrastructure and  increasing its resilience against all hazards, including natural disasters,  terrorism, and cyber incidents. The directive identified 16 critical  infrastructure sectors and designated associated federal SSAs. Table 3  shows the 16 critical infrastructure sectors and the SSA for each sector.
PPD-21 identified SSA roles and responsibilities to include  collaborating with critical infrastructure owners and operators;  independent regulatory agencies, where appropriate; and with state,  local, tribal, and territorial entities as appropriate;  serving as a day-to-day federal interface for the prioritization and  coordination of sector-specific activities;  carrying out incident management responsibilities consistent with  statutory authority and other appropriate policies, directives, or  regulations; and providing, supporting, or facilitating technical assistance and  consultations for their respective sector to identify vulnerabilities and  help mitigate incidents, as appropriate.
The NIPP is to provide the overarching approach for integrating the  nation’s critical infrastructure protection and resilience activities into a  single national effort. DHS developed the NIPP in collaboration with  public and private sector owners and operators and federal and  nonfederal government representatives, including sector-specific  agencies, from the critical infrastructure community. It details DHS’s roles  and responsibilities in protecting the nation’s critical infrastructures and  how sector stakeholders should use risk management principles to  prioritize protection activities within and across sectors. It emphasizes the  importance of collaboration, partnering, and voluntary information sharing  among DHS and industry owners and operators, and state, local, and  tribal governments. The NIPP also stresses a partnership approach  among the federal and state governments and industry stakeholders for  developing, implementing, and maintaining a coordinated national effort  to manage the risks to critical infrastructure and work toward enhancing  physical and cyber resilience and security.
According to the NIPP, SSAs are to work with their private sector  counterparts to understand cyber risk and develop sector-specific plans  that address the security of the sector’s cyber and other assets and  functions. The SSAs and their private sector partners are to update their  sector-specific plans based on DHS guidance to the sectors. The  currently available sector-specific plans were released in 2010 to support  the 2009 version of the NIPP. In response to the most recent NIPP,  released in December 2013, DHS issued guidance in August 2014  directing the SSAs, in coordination with their sector stakeholders, to  update their sector-specific plans. The SSAs are also to review and  modify existing and future sector efforts to ensure that cyber concerns are  fully integrated into sector security activities.
In addition, the NIPP sets up a framework for sharing information across  and between federal and nonfederal stakeholders within each sector that  includes the establishment of sector coordinating councils and  government coordinating councils. Sector coordinating councils are to  serve as a voice for the sector and a principal entry point for the  government to collaborate with the sector for critical infrastructure security  and resilience activities. The government coordinating councils enable  interagency, intergovernmental, and cross-jurisdictional coordination  within and across sectors. Each government coordinating council is  chaired by a representative from the designated SSA with responsibility  for providing cross-sector coordination.
The NIPP also recommended several activities—referred to as Call to  Action steps— to guide the efforts of the SSAs and their sector partners  to advance security and resilience under three broad activity categories:  building on partnership efforts; innovating in risk management; and  focusing on outcomes. Table 4 shows the 10 Call to Action Steps  determined to have a cybersecurity-related nexus.
The NIPP states that all of the identified steps, including these 10 actions  with a greater relationship to enhancing cybersecurity, are not intended to  be exhaustive or implemented in every sector. Rather, they are to provide  strategic direction, allow for differing priorities in each sector, and enable  continuous improvement of security and resilience efforts.
In addition, Executive Order 13636 was issued to, among other things,  address the need to improve cybersecurity through information sharing  and collaboratively developing and implementing risk-based standards.  It called for the SSAs to, among other things, establish, in coordination  with DHS, a voluntary program to support the adoption of the National  Institute of Standards and Technology’s (NIST) Framework for Improving  Critical Infrastructure Cybersecurity (Cybersecurity Framework) by  owners and operators of critical infrastructure and any other interested  entities; create incentives to encourage owners and operators of critical  infrastructure to participate in the voluntary program; and, if necessary,  develop implementation guidance or supplemental materials to address  sector-specific risks and operating environments.
section_title: Sector-Specific Agencies Determined That Cyber Risks Were Significant for Most Sectors
paragraphs: Sector-specific agencies determined the significance of cyber risk to the  networks and industrial control systems for all 15 of the sectors in the  scope of our review. Specifically, they determined that cyber risk was  significant for 11 of 15 sectors. For the remaining 4 sectors, the SSAs had  determined that cyber risks were not significant due to the lack of cyber  dependence in the sector’s operations, among other reasons. These  determinations were carried out in response to the 2009 NIPP, which  directed the SSAs to consider how cyber would be prioritized among their  sectors’ critical infrastructure and key resources as part of the sector- specific planning process. The SSAs and their sector stakeholders were  to include an overview of current and emerging sector risks including  those affecting cyber when preparing their 2010 plans. Table 5 shows the  significance of cyber risk to each sector, as determined by the SSAs, as  well as when these determinations were made.
Since most of these determinations were made for the 2010 sector- specific planning process, they may not reflect the current risk  environment of the sectors. In particular, SSAs for the 4 sectors that had  not determined cyber risks to be significant during their 2010 sector- specific planning process subsequently reconsidered the significance of  cyber risks to their sectors. Also, in response to the 2013 NIPP, DHS  issued guidance for developing updated sector-specific plans for 2015.  According to this guidance and SSA officials, SSAs are to document how  they have reconsidered the significance of cyber risks to their sectors.  DHS officials stated that the SSAs have drafted their updated sector- specific plans and submitted them to DHS for review; however, the plans  have not yet been finalized and released.
Based on the 2010 sector-specific plans and subsequent documents and  activities, the SSAs’ determinations of the significance of cyber risk to  their 15 respective sectors are summarized below.
subsections: section_title: Chemical Sector
paragraphs: DHS, in collaboration with chemical sector stakeholders, determined that  cyber risk was a significant priority for the sector. In 2009, DHS and the  chemical sector coordinating council issued the Roadmap to Secure  Controls Systems in the Chemical Sector, which documented the  cybersecurity concerns for chemical facilities’ industrial control systems  and the need to develop cyber risk mitigation actions to be addressed  over a 10-year period. In addition, the 2010 Chemical Sector-Specific  Plan highlighted the importance of cyber systems to the sector and  promoted the need for owners and operators of sector assets to apply risk  assessment and management methodologies to identify cyber threats to  their individual operations.
section_title: Commercial Facilities Sector
paragraphs: DHS did not consider cyber risks to be significant for the commercial  facilities sector. The commercial facilities sector’s 2010 sector-specific  plan does not identify cyber risks as significant to the sector. DHS officials  stated that the decision was based on the sector’s diversity of  components and the manner in which cyber-related technology is  employed. According to these officials, a cyber event affecting one  facility’s cyber systems (e.g., access control or environmental systems)  would not be likely to affect the cyber assets of other facilities within the  sector.
However, in July 2015, DHS officials stated that, as part of the updated  sector planning process, they had recognized cyber risk as a high-priority  concern for the sector. In particular, they noted that the sector uses  Internet-connected systems for processes like ticketing and reservations,  so a large-scale communications failure or cyber attack could disrupt the  sector’s operations.
section_title: Communications Sector
paragraphs: DHS, in collaboration with communications sector stakeholders,  completed a risk assessment in 2012 for the communications sector that  identified cyber risk as a significant priority; however, the assessment  noted that due to the sector’s diversity and level of resiliency, most of the  threats would only result in local or regional communications disruptions  or outages. The assessment evaluated cyber threats such as malicious  and non-malicious actors committing alterations or intrusions that could  pose local, regional, or national level risks to broadcasting, cable,  satellite, wireless, and wireline communications networks. The risk  assessment also concluded that malicious actors could use the  communications sector to attack other sectors.
section_title: Critical Manufacturing Sector
paragraphs: DHS did not consider cyber risk to be significant for the critical  manufacturing sector. The sector’s 2010 sector-specific plan stated that  many critical manufacturing owners and operators from this diverse and  dispersed sector had completed asset, system, or network-specific  assessments on their own initiative. Also, the plan identified cyber  elements that support the sector’s functional areas, including electronic  systems for processing the information necessary for management and  operation or for automatic control of physical processes in manufacturing.  This applied primarily to the production of metals, machinery, electrical  equipment, and heavy equipment. However, the critical manufacturing  sector relies upon other sectors such as communications and information  technology where addressing cyber risk is a priority.
DHS officials stated that, since 2010, they have identified sector critical  cyber functions and services, and the sector’s draft 2015 sector-specific  plan notes this as a step toward conducting a sector-wide cyber risk  assessment.
section_title: Dams Sector
paragraphs: DHS officials considered cyber risks for the dams sector and  acknowledged that cyber threats could have negative consequences;  however, they determined cyber risks to not be significant for the sector.  Specifically, the sector’s 2010 sector-specific plan concluded that the  sector’s cyber environment and its legacy industrial control systems were  designed to operate in a fairly isolated environment using proprietary  software, hardware, and communications technology and, as a result,  were designed with cybersecurity as a low priority. However, the officials  stated that vulnerabilities in industrial control systems pose cyber-related  risks to the sector’s operations. In the sector-specific plan, they  acknowledged that the evolution of industrial control systems to  incorporate network-based and Internet Protocol-addressable features  and more commercially available technologies could introduce many of  the same vulnerabilities that exist in current networked information  systems.
DHS officials also stated that they are addressing cybersecurity for the  sector with their update to the sector-specific plan and the sector’s  roadmap for securing control systems, as well as with the development of  a capability maturity model specifically for the dams sector. At the time of  our review, the updated sector-specific plan was still in draft.
section_title: Defense Industrial Base Sector
paragraphs: The Department of Defense (DOD) determined that cyber threats to  contractors’ unclassified information systems represented an  unacceptable risk of compromise to DOD information and posed a  significant risk to U.S. national security and economic security interests.  In the sector’s 2010 sector-specific plan, DOD, in collaboration with its  sector partners, listed cybersecurity and managing risk to information  among its five goals for the sector’s protection and resilience. In addition,  DOD has issued annual “for official use only” reports on its progress  defending DOD and the defense industrial base against cyber events for  fiscal years 2010 through 2014. The reports identify definitions and  categories of cyber events, exploited vulnerabilities, and adversary  intrusion methods based on data from several key DOD organizations  with cybersecurity responsibilities and other intelligence sources. The  reports are to provide an annual update of cyber threats, threat sources,  and vulnerability trends affecting the defense industrial base.
section_title: Emergency Services Sector
paragraphs: DHS officials, in collaboration with sector stakeholders, concluded that  cyber threats could have a significant impact on the emergency services  sector’s operations. The risk assessment process brought together  subject matter experts to perform an assessment of cyber risks across six  emergency services sector disciplines: law enforcement, fire and  emergency services, emergency medical services, emergency  management, public works, and public safety communications and  coordination/fusion. They developed cyber risk scenarios across multiple  sector disciplines and applied DHS’s Cybersecurity Assessment and Risk  Management Approach methodology to reach their conclusion. The  results were reported in 2012 in the Emergency Services Sector Cyber  Risk Assessment.
In a previous GAO review of cybersecurity in the emergency services  sector, we reported that sector planning activities, including the cyber risk  assessment, did not address the more interconnected, Internet-based  emerging technologies becoming more prevalent in the emergency  services sector. As a result, the sector could be vulnerable to cyber risks  in the future without more comprehensive planning. We recommended  that the Secretary of Homeland Security collaborate with emergency  services sector stakeholders to address the cybersecurity implications of  implementing technology initiatives in related plans. DHS agreed with our  recommendation and stated that the updated sector-specific plan will  include consideration of the sector’s emerging technology. At the time of  our review, the updated sector-specific plan was still in draft.
section_title: Energy Sector
paragraphs: The Department of Energy (DOE) identified cyber risks as significant and  a priority for the energy sector. Specifically, in the sector’s 2010 sector- specific plan, DOE, in collaboration with its sector stakeholders, included  cybersecurity among the sector’s goals to enhance preparedness,  security, and resilience. DOE officials stressed that their risk management  approach focuses on resilience, especially in the context of ensuring the  resilience of the electric grid. In addition, the 2011 Roadmap to Achieve  Energy Delivery System Cybersecurity, developed by energy sector  stakeholders, including responsible DOE officials, recognized the  continually evolving cyber threats and vulnerabilities and provided a  framework for energy sector stakeholders to survive a cyber incident  while sustaining critical functions.
section_title: Financial Services Sector
paragraphs: Treasury, in collaboration with sector stakeholders, identified cyber risk as  significant to the financial services sector. Specifically, the 2010 financial  services sector-specific plan stated that all of the sector’s services rely on  its cyber infrastructure, which necessitates that cybersecurity be factored  into all of the sector’s critical infrastructure protection activities. In  addition, as a highly regulated sector, the financial services sector has  been required to undergo risk assessments by financial regulators to  satisfy regulatory requirements.
In July 2015, Treasury officials stated that they leveraged the collective  body of risk assessment data to determine the sector’s overall risk profile,  which will be included in the 2015 sector-specific plan. At the time of our  review, the updated sector-specific plan was still in draft.
section_title: Food and Agriculture Sector
paragraphs: The U.S. Department of Agriculture (USDA) and the Department of  Health and Human Services’ Food and Drug Administration (FDA), in  collaboration with their sector stakeholders, determined that the  significance of cyber risk was low for the food and agriculture sector when  the SSP was developed in 2010. As stated in the plan, the sector did not  perceive itself as a target of cyber attack and concluded that, based on  the nature of its operations, a cyber attack would pose the risk of only  minimal economic disruption. However, the plan acknowledged the  rapidly evolving cyber environment and the need to revisit the issue in the  future.
In July 2015, USDA officials stated that they had reconsidered the  significance of cyber risk and the role of cybersecurity in the sector and  that it would be reflected in the yet-to-be-released 2015 sector-specific  plan. In addition, according to USDA officials, they had completed a  sector risk assessment effort with assistance from DHS.
section_title: Health Care and Public Health Sector
paragraphs: The Department of Health and Human Services (HHS), in collaboration  with its sector partners, identified cyber risk as significant to the health  care and public health sector. Specifically, the 2010 sector-specific plan  identified cybersecurity and mitigating risks to the sector’s cyber assets  as one of four service continuity goals for the sector. The plan’s  cybersecurity risk assessment section identified and categorized common  cyber threats, vulnerabilities, consequences, and mitigation strategies for  the sector. Also, HHS and its partners added cyber infrastructure  protection as a research and development priority in the sector-specific  plan. In addition, health care entities, such as health plans and providers  that maintain health data, must assess risks to cyber-based systems  based on Health Insurance Portability and Accountability Act of 1996  security requirements.
section_title: Information Technology Sector
paragraphs: DHS, in collaboration with information technology sector stakeholders,  identified cyber risk as a sector priority. DHS and its sector partners  determined that the consequences of cyber incidents or events would be  of great concern and would affect the sector’s ability to produce or  provide critical products and services. DHS worked with public and  private information technology stakeholders to complete the Information  Technology Sector Baseline Risk Assessment in 2009. The risk  assessment focused on risks to the processes involved in the creation of  IT products and services and critical IT functions including research and  development, manufacturing, distribution, upgrades, and maintenance— and not on specific organizations or assets.
section_title: Nuclear Sector
paragraphs: DHS and its nuclear sector stakeholders prioritized cyber risk as a  significant risk for the nuclear sector. According to the 2011 Roadmap to  Enhance Cyber Systems Security in the Nuclear Sector, they  determined that the cyber systems supporting the nuclear sector are at  risk due to the increasing volume, complexity, speed, and connectedness  of the nuclear sector’s systems. Therefore, DHS and its sector partners  included protecting against the exploitation of the sector’s cyber assets,  systems, and networks among its sector goals and objectives for a  comprehensive protective posture.
section_title: Transportation Systems Sector
paragraphs: Addressing cyber risk is a significant priority for the transportation  systems sector. In the 2010 transportation systems sector-specific plan,  DHS’s Transportation Security Administration (TSA) and U.S. Coast  Guard acknowledged the importance of cyber assets to the sector’s  operations across the various transportation modes and included an  overview of the risk management framework, an all-hazards approach to  be applied to the physical, human, and cyber components of the  infrastructure. They also established goals and objectives to shape their  sector partners’ approach for managing sector risk. As part of their  objective to enhance the all-hazard preparedness and resilience of the  transportation systems sector, they included the need to identify critical  cyber assets, systems, and networks and implement measures to  address strategic cybersecurity priorities.
For fiscal year 2014, TSA assessed risks to the transportation systems  sector and reported the outcome to Congress. Although the assessment  did not specifically quantify cyber risks for the sector, it considered cyber  threats to transportation modes in hypothetical scenarios, such as the  effect of a cyber attack disabling a public transit system. In addition,  TSA’s Office of Intelligence and Analysis provides transportation mode- specific annual threat assessments that include malicious cyber activity  as part of the analysis. For example, the pipeline modal threat  assessment considered computer network attacks that could disrupt  pipeline functions and computer network exploitations that could allow  unauthorized network access and theft of information. In addition, we  have previously reported that the Coast Guard needs to address  cybersecurity in the maritime port environment by, among other things,  including cyber risks in its biennial maritime risk assessment.  Subsequently, the Coast Guard released its updated risk assessment for  maritime operations, which identified the need to address cyber risk but  did not identify vulnerabilities in relevant cyber assets.
section_title: Water and Wastewater Systems (Water) Sector
paragraphs: The Environmental Protection Agency (EPA), in collaboration with sector  partners, determined that a cyber attack is a significant risk to the water  sector. Cyber attacks on the industrial control systems are among the  plausible hazards that threaten the water and wastewater systems sector,  according to the risk assessment portion of the 2010 sector-specific plan.  EPA concluded that attacks on the systems used to monitor and control  water movement and treatment could disrupt operations at water and  wastewater facilities, although the capability to employ manual overrides  for critical systems could reduce the consequences of an attack. EPA  recommended that water sector facilities regularly update or conduct an  all-hazards risk assessment that includes cyber attacks as a priority  threat. Further, the Roadmap to a Secure and Resilient Water Sector,  developed in 2013 by EPA, DHS, and water sector partners, included  advancing the development of sector-specific cybersecurity resources as  a top priority for the sector.
section_title: Sector-Specific Agencies Generally Performed Cyber Risk Mitigation Activities
paragraphs: Sector-specific agencies generally took actions to mitigate cyber risks and  vulnerabilities for their respective sectors that address the Call to Action  steps in the National Infrastructure Protection Plan. While the steps are  not required of the SSAs, they are intended to guide national progress  while allowing for differing priorities in different sectors. The SSAs had  taken action to address most of the nine NIPP Call to Action steps.  While SSAs for 12 of the 15 sectors had not identified incentives to  promote cybersecurity in their sectors, as called for by one of the Call to  Action steps, all the SSAs have participated in a working group to identify  appropriate incentives to encourage cybersecurity improvements across  their respective sectors. In addition, SSAs for 3 of 15 sectors had not yet  made significant progress in advancing cyber-based research and  development within their sectors because it had not been an area of focus  for their sector. DHS guidance for updating the sector-specific plans  directs the SSAs to incorporate the NIPP’s actions to guide their cyber  risk mitigation activities including cybersecurity-related actions to identify  incentives and promote research and development.
Figure 1 depicts NIPP Call to Action steps addressed by SSAs. (App. II  provides further details on actions taken to address the Call to Action  steps for each sector.)
subsections: section_title: Chemical Sector
paragraphs: DHS implemented activities to mitigate the cyber risks for the chemical  sector for eight of nine of the NIPP’s Call to Action steps; however, it had  not established incentives to encourage its sector partners to voluntarily  invest in cybersecurity-enhancing measures. DHS has developed  technical resources, cybersecurity awareness tools, and information- sharing mechanisms among its activities to enhance the sector’s  cybersecurity. DHS officials described other cybersecurity activities in  development including updates to sector cybersecurity guidance that  could include incentives; however, they were unable to identify specific  incentives to encourage cybersecurity across the sector.
section_title: Commercial Facilities Sector
paragraphs: DHS conducted cyber mitigation activities that aligned with eight of the  nine NIPP Call to Action steps for the commercial facilities sector. DHS  provided technical assistance and supported information-sharing efforts  for the sector. For example, it developed a risk self-assessment tool in  conjunction with sector partners to raise awareness of the importance of  their cyber systems. DHS also promoted a number of information-sharing  mechanisms available through its Office of Cybersecurity and  Communications, including the dissemination of alerts through the U.S.  Computer Emergency Readiness Team (US-CERT), ICS-CERT, and the  Commercial Facilities Cyber Working Group, among others. However,  DHS did not identify efforts to establish incentives to encourage  commercial facilities sector partners to implement cybersecurity- enhancing measures.
section_title: Communications Sector
paragraphs: DHS worked to reduce risk to the communications sector through  collaborative cyber risk mitigation activities that align with eight of nine  NIPP Call to Action steps. However, DHS did not establish incentives to  promote cybersecurity for the sector. As previously stated, DHS and its  communications sector partners completed the 2012 National Sector Risk  Assessment for Communications, which examined risks from cyber  incidents or events that threaten the sector’s cyber assets, systems, and  networks. According to DHS officials, it coordinated mitigation activities  with its communications sector partners and addressed risks identified  through the assessment process. In addition, officials explained that it  implemented or facilitated sector-wide information-sharing mechanisms  with such entities as the National Cybersecurity and Communications  Integration Center, National Infrastructure Coordinating Center, and  National Coordinating Center for Telecommunications and  Communications Information Sharing and Analysis Center.
Although DHS had not implemented specific cyber-related incentives for  the communications sector, DHS officials stated that National Security  staff and the Office of Policy have been working on possible national  incentives such as tax credits for future use.
section_title: Critical Manufacturing Sector
paragraphs: DHS focused cyber risk mitigation activities in seven of nine NIPP Call to  Action steps for the critical manufacturing sector. However, cyber risk  mitigation activities did not include efforts to incentivize cybersecurity or  support cybersecurity-related research and development. Among its  cyber risk mitigation activities, DHS participated in information sharing  efforts through the sector coordinating council to enhance situational  awareness; and led outreach efforts to encourage diverse (i.e., small,  medium, and large companies) participation in the council as an activity to  build national capacity.
Although specific incentives to encourage cybersecurity across the sector  had not been put in place, DHS officials stated that they had been  involved in a working group to study possible options such as cyber  insurance. While the critical manufacturing sector-specific plan and  associated annual report of sector activities indicated that goals and  needs regarding sector research and development are areas for future  development, DHS did not provide any examples of specific research and  development activities addressing the sector’s cybersecurity.
section_title: Dams Sector
paragraphs: DHS developed cyber risk mitigation activities for the dams sector  focused on eight of nine NIPP Call to Action steps. However, DHS did not  identify activities leveraging incentives to advance security and resilience.  DHS officials stated that their efforts had not focused on incentives.  Among its cyber risk mitigation activities, DHS officials facilitated the  development of the Dams Sector Roadmap to Secure Control Systems,  developed in 2010, which focuses on the cybersecurity of industrial  control systems where cyber risks maybe more significant for individual  entities. DHS also supported information-sharing mechanisms by  promoting sector-wide information sharing and organized a cybersecurity  working group to discuss cyber-relevant topics during quarterly meetings.  Further, the department disseminated cyber vulnerability information to  sector partners through advisories and alerts from DHS’s ICS-CERT and  US-CERT.
section_title: Defense Industrial Base Sector
paragraphs: DOD devised cyber risk mitigation activities that align with eight of nine  NIPP Call to Action steps but had not established incentives to promote  cybersecurity. Cyber risk mitigation activities included sharing threat  information and mitigation strategies for enhanced situational awareness  and participating in DOD-centric exercises, among others.
Although DOD did not identify specific incentives to encourage  cybersecurity in the defense industrial base sector, DOD officials stated  that they joined an interagency effort to explore various incentives that  might be offered to industry to encourage use of the NIST Cybersecurity  Framework.
In addition, DOD officials noted that they have worked with the General  Services Administration to develop strategic guidelines to incorporate  cybersecurity standards in requirements for DOD contractors; however,  this effort would not be part of DOD’s voluntary sector cybersecurity  program.
section_title: Emergency Services Sector
paragraphs: DHS established or facilitated cyber risk mitigation activities for eight of  nine NIPP Call to Action steps; however, it had not instituted  cybersecurity incentives. DHS officials stated that grants to state and  local governments as incentives to encourage cybersecurity were not  available, and no other types of incentives were identified. Among its  activities, the department collaborated with emergency services sector  partners in March 2014 to develop the Emergency Services Sector  Roadmap to Secure Voice and Data Systems, which identified and  discussed proposed risk mitigation activities and included justification for  the response, sector context, barriers to implementation, and suggestions  for implementation. DHS officials also noted various information-sharing  mechanisms that disseminate cyber threat and vulnerability information to  sector partners and allow reporting back to DHS.
section_title: Energy Sector
paragraphs: DOE instituted or supported cyber risk mitigation activities that  correspond to all nine of the NIPP Call to Action steps. For example, DOE  provided grants to share the costs of sector partners’ cybersecurity  innovation efforts as an incentive for advancing cybersecurity and to  support research and development of solutions to improve critical  infrastructure security and resilience. Other activities to encourage  cybersecurity in the sector included the development of cybersecurity  guidance to promote the use of NIST’s Cybersecurity Framework and  establishing or supporting cyber threat information sharing mechanisms.  DOE also developed and implemented the Cybersecurity Risk Information  Sharing Program, a public-private partnership to facilitate the timely  sharing of cyber threat information and develop situational awareness  tools to enhance electric utility companies’ ability to identify, prioritize, and  coordinate the protection of their critical infrastructure.
section_title: Financial Services Sector
paragraphs: The Department of the Treasury implemented or facilitated activities that  served to mitigate cyber risk for the financial services sector. These  activities correspond to eight of the nine NIPP Call to Action steps.  However, Treasury had not developed incentives to encourage  cybersecurity in the sector through its voluntary critical infrastructure  protection program. Treasury officials noted that they foresee developing  incentives as a result of a report to the President pursuant to an  Executive Order 13636 requirement that outlined an approach for  policymakers to evaluate the benefits and relative effectiveness of  government incentives in promoting adoption of NIST’s Cybersecurity  Framework. Using the results of the updated sector planning process to  inform its efforts could assist Treasury in developing any such incentives,  as appropriate.
We have previously reported on additional efforts to address cyber risk in  this sector. In July 2015, we reported on cyber attacks against depository  institutions, banking regulators’ oversight of cyber risk mitigation activities,  and the process for sharing cyber threat information. Specifically, we  found that smaller depository institutions were greater targets for cyber  attacks. Also, we noted that although financial regulators devoted  considerable resources to overseeing information security at larger  institutions, their limited IT staff resources generally meant that examiners  with little or no IT expertise were performing IT examinations at smaller  institutions. As a result, we recommended that these regulators collect  and analyze additional trend information that could further increase their  ability to identify patterns in problems across institutions and better target  their reviews. Finally, with cyber threat information coming from multiple  sources, including from Treasury and other federal entities, recipients  contacted in the review found federal information repetitive, not always  timely, and not always readily usable. To help address these needs,  Treasury had various efforts under way to obtain such information and  confidentially share it with other institutions, including participating in  groups that monitor and provide threat information on cyber incidents.
section_title: Food and Agriculture Sector
paragraphs: USDA and FDA, as co-SSAs for the food and agriculture sector, had  cyber risk mitigation activities addressing six of the nine NIPP Call to  Action steps. For example, the SSAs had encouraged sector-wide  participation in DHS’s program to promote NIST’s Cybersecurity  Framework, participated in the process to identify any cyber-dependent  critical functions and services, and supported threat briefings to enhance  situational awareness across the sector. According to food and  agriculture SSA officials, they had other activities in progress including  facilitated sessions with their sector stakeholders as part of assessing  risks to the sector and considering the development of food and  agriculture sector-specific NIST Cybersecurity Framework implementation  guidance to make the framework more relatable to food and agriculture  stakeholders.
However, other areas, including incentives to promote cybersecurity,  research and development of security and resilience solutions, and  lessons learned from exercises and incidents, have yet to be developed.  As stated earlier, during the 2010 sector-specific planning process,  cybersecurity risk was not considered significant for the sector, but USDA  and FDA officials stated that they had incorporated cyber risk into their  updated sector-specific plan and they continue to develop cybersecurity- related activities for the sector.
section_title: Health Care and Public Health Sector
paragraphs: HHS developed or supported activities addressing eight of the nine NIPP  Call to Action steps. For example, HHS leveraged the private sector  clearance program and access to classified information as incentives for  sector stakeholders to participate in cybersecurity-enhancing activities.  However, HHS had not performed any activities related to cybersecurity  research and development. HHS officials stated that promoting research  and development efforts to enhance the sector’s cybersecurity was not a  focus of their cyber risk mitigation activities during fiscal years 2014 and  2015.
section_title: Information Technology Sector
paragraphs: DHS, in collaboration with its information technology sector partners,  implemented risk mitigation activities to enhance the sector’s  cybersecurity environment. We identified activities that addressed eight of  nine NIPP Call to Action steps. DHS’s IT sector cyber risk mitigation  activities included the promotion of incident response and recovery  capabilities, support for various cyber-related information sharing  mechanisms, and capabilities for technical assistance to sector entities.  However, DHS had not specifically identified and analyzed incentives to  improve cybersecurity within the IT sector. DHS officials stated that they  have collaborated with other federal agencies to develop options for  cybersecurity enhancement incentives for the sector.
section_title: Nuclear Reactors, Materials, and Waste (Nuclear) Sector
paragraphs: DHS carried out risk mitigation activities that addressed eight of the nine  NIPP Call to Action steps. These activities included collaborative efforts  through established working groups and councils to share information  about cybersecurity-related alerts, advisories, and strategies. DHS  officials responsible for nuclear SSA efforts referred to the Roadmap to  Enhance Cyber Systems Security in the Nuclear Sector as guidance they  developed in June 2011 and disseminated to sector partners for  determining cyber risk and a vision for mitigating it over a 15-year  period. However, DHS’s cyber risk mitigation activities did not include  incentives for nuclear sector partners to enhance cybersecurity.
section_title: Transportation Systems Sector
paragraphs: The Department of Transportation and DHS’s TSA and U.S. Coast Guard  put in place cyber risk mitigation activities in line with all nine NIPP Call to  Action steps. For example, TSA shared cyber threat intelligence and  information from the National Cybersecurity and Communications  Integration Center to multiple transportation modes through its threat  dissemination channels. In addition, classified information had been  “tearlined” or downgraded based on a request from TSA so that  information could be shared without sharing sensitive and restricted  information to sector officials without security clearances. Further, the  U.S. Coast Guard used its Port Security Grant Program as an incentive  for cybersecurity efforts through its Port Security Grants Program for the  maritime subsector. This DHS grants program provides funding for  maritime transportation security measures including cybersecurity.  However, as we have previously reported, this program did not always  make use of cybersecurity-related expertise and other information in  allocating grants. Accordingly, we recommended that the program take  steps to make better-informed funding decisions. In addition, TSA officials  stated that they have participated in working groups to identify other  cybersecurity-related incentives across the various transportation modes.
section_title: Water Sector
paragraphs: EPA incorporated cyber risk mitigation activities that aligned with eight of  the nine NIPP Call to Action steps. Specifically, EPA had not established  incentives to encourage sector partners to enhance their security and  resiliency. EPA officials stated providing funds to support cybersecurity  enhancements would be an incentive for their sector partners; however,  they lacked the resources to offer grants to implement security measures.  EPA officials also stated that they are working on implementing  recommendations from Critical Infrastructure Partnership Advisory  Council Water Sector Cybersecurity Strategy Workgroup which include  exploring ways to demonstrate how the benefits of implementing  cybersecurity enhancements outweigh the costs of cyber incidents as an  incentive to encourage investment in cybersecurity improvements.
section_title: Sector-Specific Agencies Collaborated across Sectors to Improve Cybersecurity Efforts
paragraphs: Sector-specific agencies use various collaborative mechanisms to share  cybersecurity related information across all of the sectors. Presidential  Policy Directive 21 (PPD-21) states that sector-specific agencies are to  coordinate with DHS and other relevant federal departments and  agencies and collaborate with critical infrastructure owners and operators  to strengthen the security and resiliency of the nation’s critical  infrastructure.
SSAs share information and collaborate across sectors primarily through  a number of councils, working groups, and information-sharing centers  established by federal entities. The mechanisms identified during our  review for SSAs to collaborate across the sectors are summarized, along  with the number of sectors represented in each council or group by their  respective SSA, in table 6.
The mechanisms provide SSAs opportunities to interact, collaborate, and  coordinate with one another. For example, each of the sectors we  reviewed used working groups created under the Critical Infrastructure  Partnership Advisory Council. According to the CIPAC 2013 annual  report, in 2012 there were 60 working groups that held approximately 200  meetings with objectives such as information sharing, training and  exercises, and risk management.
In addition, SSAs used their respective government coordinating councils  to coordinate with other SSAs about interdependencies and to gain  access to needed expertise about the operations of other sectors. For  example, DHS officials stated that the communications sector’s  government coordinating council membership provides the expertise  necessary to fulfill the council’s mission. They stated that its current  membership includes representatives from the DOD, DOE and Treasury,  among others, and from multiple DHS components.
Further, SSAs continually referred to the Cross-Sector Cyber Security  Working Group and the Industrial Control System Joint Working Group as  two of the main cybersecurity-related collaborative opportunities for  federal agencies. Both of these working groups facilitate government  sharing of information among officials representing different sectors. The  Cross-Sector Cyber Security Working Group operates under DHS’s Office  of Cybersecurity and Communications. It provides the SSAs the  opportunity to establish and maintain cross-sector partnerships; work on  cross-cutting issues, such as incentives to encourage cybersecurity  actions; and identify cyber dependencies and interdependencies that  allow them to share information on cybersecurity trends that can affect  their respective sectors. According to DHS, more than 100 members  attend monthly meetings to share information and activities about their  respective sectors. Of the SSAs representing the 15 sectors we reviewed,  SSAs for 14 sectors indicated in their documentation or statements that  they were active participants in this working group.
The Industrial Control System Joint Working Group was established by  DHS’s Industrial Control Systems Cyber Emergency Response Team to  facilitate information sharing and reduce the risk to the nation’s industrial  control systems. According to DHS, the goal of this working group is to  continue and enhance the collaborative efforts of the industrial control  systems stakeholder community by accelerating the design, development,  and deployment of secure industrial control systems. SSAs for 12 of the  15 sectors within the scope of our review were active participants in the  working group. For example, HHS officials stated that they attend the  Industrial Control System Joint Working Group meetings as a way to  analyze relationships and identify overlapping actions with other sectors.
Table 7 provides examples of cross-sector collaboration in relation to the  sectors.
In addition to the mechanisms identified above, further collaboration  occurred through the co-location of sectors’ SSAs within one department.  DHS, as the SSA for eight critical infrastructure sectors, has six of the  sectors assigned to officials under the Infrastructure Protection group,  and two under the Cybersecurity and Communications group. DHS’s  Office of Infrastructure Protection officials representing several SSAs  stated that they leverage DHS’s Office of Cybersecurity and  Communications capabilities and resources for their sectors. Further,  housing these responsibilities within the same organization provided  efficiencies for their respective critical infrastructure sectors. For example,  according to documentation for the critical manufacturing sector SSA,  officials are leveraging training curricula produced by other Office of  Infrastructure Protection SSA officials. Additionally, DHS had co-located  both the National Cybersecurity and Communications Integration Center  and National Infrastructure Coordinating Center, which brings two 24x7  watch centers together as they share physical and cyber information  related to critical infrastructure.
Finally, SSAs used the Homeland Information Sharing Network (HSIN)  sector pages to collaborate across sectors. The HSIN is a network for  homeland security mission operations to share sensitive but unclassified  information, including with the critical infrastructure community. It is to  provide real-time collaboration tools including a virtual meeting space,  document sharing, alerts, and instant messaging. Officials from SSAs  associated with 14 of the 15 sectors stated that they used HSIN to share  information with stakeholders within their respective sectors. For  example, within the dams HSIN portal, the sector implemented a  Suspicious Activity Report online tool to provide users with the capability  to report and retrieve information pertaining to suspicious activities that  could compromise the facility or system in a manner that would cause an  incident jeopardizing life or property. Additionally, officials from the  chemical sector stated that they use HSIN for the coordination of  cybersecurity incidents within the sector and officials from the critical  manufacturing SSA stated that when entities from their sector reach out  to them for more information on threats or alerts, they direct them to  subscribe to the critical manufacturing HSIN page.
section_title: Most SSAs Have Not Developed Performance Measures to Monitor Sectors’ Progress toward Improving Cybersecurity
paragraphs: The NIPP includes guidance to SSAs to focus on the outcomes of their  security and resilience activities. Specifically, as noted earlier, one of the  NIPP Call to Action steps directs SSAs and their sector partners to  identify high-level outcomes to facilitate evaluation of progress toward  national goals and priorities, including securing critical infrastructure  against cyber threats. In addition, the NIPP risk management framework,  used as a basis for the sector-specific plans, includes measuring the  effectiveness of the SSAs’ risk mitigation activities as a method of  monitoring sector progress.
Among the SSAs, DOD, DOE, and HHS had established performance  metrics to monitor cybersecurity-related activities, incidents, and progress  in their sectors.
DOD monitored cybersecurity for the defense industrial base sector  through reports of cyber incidents and cyber incidents that were  blocked; reports from owners and operators regarding efforts to  execute the sector-specific plan’s implementation actions; and the  number of cyber threat products disseminated by DOD to cleared  companies and the timeliness of shared threat information. DOD also  prepared annual reports for Congress for fiscal years 2010 through  2014 that provided information on sector performance metrics.
DOE developed the ieRoadmap, an interactive tool designed to  enable energy sector stakeholders to map their energy delivery  system cybersecurity efforts to specific milestones identified in the  Roadmap to Achieve Energy Delivery Systems Cybersecurity. DOE  also established the Cybersecurity Capability Maturity Model program  to support ongoing development and measurement of cybersecurity  capabilities. The voluntary program provides a mechanism for  measuring cybersecurity capabilities from a management and  program perspective.
HHS monitored cybersecurity metrics such as the number of  subscribers to receive its security alerts and incidents of health  information security breaches. The Health Information Technology for  Economic and Clinical Health (HITECH) Act requires that health  care data breaches be reported to the affected individuals and HHS,  compiled in an annual HHS report to Congress, and for breaches  affecting 500 or more individuals, shared with the media. HHS officials  stated that they use the information on data breaches as an indicator  of cybersecurity-related trends for the sector.
However, SSAs for the other 12 sectors had not developed or reported  performance metrics, although some had efforts under way to do so. For  selected sectors, including financial services and water and wastewater  systems, SSAs emphasized that they rely on their private sector partners  to voluntarily share information and so are challenged in gathering the  information needed to measure efforts. Sector stakeholders are not  necessarily willing to openly share potentially sensitive cybersecurity- related information. Also, the DHS guidance to the SSAs for updating  their sector-specific plans includes directions to create new metrics to  evaluate the sectors’ security and resilience progress; however, the plans  have not been finalized and released.
DHS had not developed performance metrics to monitor the cybersecurity  progress for its 8 sectors, although according to agency officials, such  efforts are under way. For example, DHS lacked metrics for the chemical  sector; however, officials stated that multiple industry working groups  were working on cyber performance metrics to measure progress at a  very high level. In addition, in 2011, a nuclear cybersecurity roadmap  document was released that outlined milestones and specific  cybersecurity goals for the sector over a 15-year period, including the  need for metrics to measure and assess the sector’s cybersecurity  posture. The nuclear sector roadmap provides near-, mid-, and long-term  goals but not specific measures or criteria to assess the sector’s  cybersecurity posture.
Further, according to DHS officials, a number of initiatives were begun to  gather performance-related information, including the following:
DHS’s Programmatic Planning and Metrics Initiative was established  in October 2014 to gather data from the department’s sectors and  monitor their cybersecurity process. However, as of the time of our  review, the initiative had only limited historical data.
DHS’s Sector Outreach and Programs Division plans to implement  program metrics to measure and analyze adoption of cybersecurity  practices and NIST’s Cybersecurity Framework across the sectors.
DHS officials for the information technology and communications  sectors stated that they had proposed performance metrics to be  implemented through 2018. In a review of cybersecurity related to the  nation’s communications networks, we reported that DHS and its  partners had not developed outcome-based metrics related to the  cyber-protection activities for the communications sector. We  recommended that DHS and its sector partners develop, implement,  and track sector outcome-oriented performance measures for cyber  protection activities related to the nation’s communications networks.
Regarding the financial services sector, Treasury officials stated that the  department does not have performance metrics to chart the sector’s  cybersecurity-related progress. However, according to Treasury officials,  the sector coordinating council is working with the Financial and Banking  Information Infrastructure Committee to identify metrics to evaluate  progress in the sector. According to the officials, identifying actionable  metrics based on cyber risk mitigation programs is a challenge. Treasury  officials emphasized that the information needed is privately owned and  may or may not be voluntarily shared with government partners.
The food and agriculture 2010 sector-specific plan stated that the sector  did not have metrics to measure the effectiveness of risk mitigation  efforts, although it acknowledged the need to establish tracking and  monitoring mechanisms. The plan also noted that sector partners,  including state agencies and private industry, may view reporting  programmatic data as a burden and question the security of the data  once reported. In December 2014, USDA officials noted that they do not  have formal mechanisms to measure sector progress, although survey  results collected through food safety inspection activities have some  security elements. The ongoing process to update the sector-specific plan  provides USDA and HHS an opportunity to consider possible  performance metrics for monitoring the sector’s cybersecurity progress.
The transportations systems sector SSAs had also not instituted  mechanisms to evaluate the progress of sector entities in achieving a  more secure sector. For example, TSA officials stated that they are  developing cyber metrics in line with the 2014 Sector-Specific Plan  Guidance; however, the officials noted that their industry partners are  reluctant to share information needed to monitor improvement in the  sector because they fear regulation.
Finally, EPA does not collect performance information to provide metrics  on the effectiveness of its cybersecurity programs for the water sector.  Agency officials noted that the lack of statutory authority is a major  challenge to collecting performance metrics data. In the absence of  statutory authority or agency policy, EPA must work with water sector  associations to collect the information across the sector. However, water  utilities may be reluctant to voluntarily report security information to EPA.  EPA is also working with the Water Sector Coordinating Council to  identify performance metrics for implementation of NIST’s Cybersecurity  Framework in the water sector, according to agency officials.
Until SSAs develop performance metrics and collect data to report on the  progress of the sector-specific agencies’ efforts to enhance the sectors’  cybersecurity posture, they may be unable to adequately monitor the  effectiveness of their cyber risk mitigation activities and document the  resulting sector-wide cybersecurity progress.
section_title: Conclusions
paragraphs: Overall, SSAs are acting to address sector cyber risk, but additional  monitoring actions could enhance their respective sectors’ cybersecurity  posture. Most SSAs had identified the significance of cyber risk to their  respective sectors as part of the 2010 sector-specific planning process  with four sectors concluding that cyber risk was not significant at that  time, but subsequently reconsidering the significance of cyber risks to  their sectors. However, to prepare the 2015 updates to their sector- specific plans, the planning guidance directed the SSAs to address their  current and emerging sector risks including the cyber risk landscape and  key trends shaping their approach to managing risk. Toward this end, all  of the SSAs had generally performed cyber risk mitigation activities that  address the NIPP’s Call to Actions steps and regarding incentives— one  area not addressed by most of the SSAS— efforts had begun to  determine appropriate ways to encourage additional cybersecurity-related  efforts across the nation’s critical infrastructures.
To their credit, SSAs are engaged in multiple public-private and cross  sector collaboration mechanisms that facilitate the sharing of information,  including cybersecurity-related information. However, most SSAs have  not developed metrics to measure and improve the effectiveness of all  their cyber risk mitigation activities and their sectors’ cybersecurity  posture. As a result, SSAs may not be able to adequately monitor and  document the benefits of their activities in improving the sectors’  cybersecurity posture or determine how those efforts could be improved.
section_title: Recommendations for Executive Action
paragraphs: To better monitor and provide a basis for improving the effectiveness of  cybersecurity risk mitigation activities, we recommend that, informed by  the sectors’ updated plans and in collaboration with sector stakeholders,  the
Secretary of Homeland Security direct responsible officials to develop  performance metrics to provide data and determine how to overcome  challenges to monitoring the chemical, commercial facilities,  communications, critical manufacturing, dams, emergency services,  information technology, and nuclear sectors’ cybersecurity progress;
Secretary of the Treasury direct responsible officials to develop  performance metrics to provide data and determine how to overcome  challenges to monitoring the financial services sector’s cybersecurity  progress;
Secretaries of Agriculture and Health and Human Services (as co- SSAs) direct responsible officials to develop performance metrics to  provide data and determine how to overcome challenges to  monitoring the food and agriculture sector’s cybersecurity progress;
Secretaries of Homeland Security and Transportation (as co-SSAs)  direct responsible officials to develop performance metrics to provide  data and determine how to overcome challenges to monitoring the  transportation systems sector’s cybersecurity progress; and
Administrator of the Environmental Protection Agency direct  responsible officials to develop performance metrics to provide data  and determine how to overcome challenges to monitoring the water  and wastewater systems sector’s cybersecurity progress.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Departments of Agriculture,  Defense, Energy, Health and Human Services, Homeland Security,  Transportation, and the Treasury and to EPA. In written comments signed  by the Director, Departmental GAO-OIG Liaison Office (reprinted in app.  III), DHS concurred with our two recommendations. DHS also provided  details about efforts to address cybersecurity in the sectors for which  DHS has responsibility as the SSA. DHS also stated that it supports the  intent of the recommendation to improve cybersecurity, including efforts  to develop performance metrics. Further, in regard to the transportation  sector specifically, DHS stated that the Transportation Security  Administration and the United States Coast Guard would work in  collaboration with the Department of Transportation to ensure that  cybersecurity is at the forefront of their voluntary partnership.
In written comments signed by the Department of the Treasury’s Acting  Assistant Secretary for Financial Institutions (reprinted in app. IV), the  department stated that monitoring the sector’s cybersecurity progress is a  critical component of the sector’s efforts to reduce cybersecurity risk and  discussed efforts with the department’s partners to improve the sector’s  ability to assess progress and develop metrics.
In written comments signed by EPA’s Deputy Assistant Administrator  (reprinted in app. V), EPA generally agreed with our recommendation and  discussed efforts to develop cybersecurity performance metrics for the  water and wastewater systems sector.
The Department of Transportation’s Director of Program Management  and Improvement stated in an e-mail that the department concurred with  our findings and our recommendation directed to the Secretary of  Transportation and stated that it would continue to work with DHS to  improve cyber risk mitigation activities and strengthen the transportation  sector’s cybersecurity posture.
If effectively implemented, the actions identified by these departments  should help address the need to better measure cybersecurity progress in  the sectors.
The Departments of Agriculture and Health and Human Services did not  comment on the recommendations made to them.
In addition, officials from the Departments of Agriculture, Defense,  Energy, Health and Human Services, Homeland Security, and the  Treasury and EPA also provided technical comments via e-mail that have  been addressed in this report as appropriate. The Department of  Transportation did not have technical comments for the report.
We are sending copies of this report to the appropriate congressional  committees; the Secretaries of Agriculture, Defense, Energy, Health and  Human Services, Homeland Security, Transportation, and the Treasury;  the Administrator of the Environmental Protection Agency; and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine the extent to which sector-specific  agencies (SSA) have (1) identified the significance of cyber risks to their  respective sectors’ networks and industrial control systems, (2) taken  actions to mitigate cyber risks within their respective sectors, (3)  collaborated across sectors to improve cybersecurity, and (4) established  performance metrics to monitor improvements in their respective sectors.
To conduct our evaluation, we analyzed relevant critical infrastructure  protection policies and guidance for improving the cybersecurity posture  of the nation’s critical infrastructure. Based on these analyses, we  identified nine federal agencies designated as the sector-specific  agencies for the critical infrastructure sectors. For this review, we focused  on eight of the nine sector-specific agencies responsible for 15 of the 16  critical infrastructure sectors. We included the 15 sectors that involve  private sector stakeholders in their efforts to implement activities to  address sector security and resiliency goals. We excluded the General  Services Administration, the sector-specific agency for the government  facilities sector, as the sector is uniquely governmental with facilities  either owned or leased by government entities. See Table 8 for the  sectors and sector-specific agencies included in our review.
To determine how sector-specific agencies prioritized cyber risks, we  analyzed their efforts to identify and document cyber risks. We reviewed  the risk assessment methodologies employed as documented in the 2010  sector-specific plans and other supplementary documentation such as  formal risk assessments, strategy documents, and annual reports. We  also interviewed officials responsible for carrying out the sector-specific  agency roles and responsibilities to further understand their determination  of the significance of cyber-related risks to their respective sectors.
To identify SSAs’ activities to mitigate cyber risks, we compared sector- specific planning documents and actions to fulfill roles and responsibilities  as identified in federal policy and the 2013 National Infrastructure  Protection Plan (NIPP) Call to Action steps related to cyber risks. The  NIPP steps are suggested practices to guide sector-specific agencies’  actions. The NIPP presented a total of 12 steps; however, we excluded 2  steps that we determined did not have a cybersecurity-related nexus. We  analyzed the latest sector-specific plans, which were released in 2010,  and other sector-specific planning documents including risk assessments  and strategies for each of the sectors. We also interviewed officials from  the SSAs and obtained related documentation to identify cyber risk  mitigation activities. Additionally, we interviewed private sector  stakeholders representing the sector coordinating councils to corroborate  the sector-specific agencies cyber risk mitigation activities. We used all of  this information to determine the extent to which each of the sector- specific agencies conducted activities for the 9 of the NIPP Call to Action  steps.
To determine the extent of the sector-specific agencies’ collaborative  efforts to enhance their sectors’ cybersecurity environment, we reviewed  documentation related to the collaboration mechanisms utilized by the  sector-specific agencies. We also identified the collaborative groups,  councils, and working groups that were utilized most frequently by SSAs  to share cybersecurity-related information across the sectors. We  analyzed documentation of cross-sector collaboration from the sector,  government, and cross-sector coordinating councils. Additionally, we  interviewed SSA officials and private sector stakeholders representing the  sector coordinating councils.
To identify performance measures used by SSAs to monitor cybersecurity  in their respective sectors, we analyzed the sector-specific plans and  cybersecurity-related performance reporting documents and interviewed  SSA officials. We reviewed performance evaluation guidance related to  national security and resiliency goals provided to the SSAs for past and  future planning efforts. Additionally, we reviewed past sector annual  reports, which tracked actions of the sector against goals established in  the 2010 sector-specific plans, as well as strategic documents or  roadmaps used to track sector performance. We reviewed reports of  cyber incidents and data breaches provided as examples of indicators for  SSAs to monitor sector cybersecurity. We also interviewed private sector  partners to identify sources of cybersecurity-related data being reported  to the sector-specific agencies.
We conducted this performance audit from June 2014 to November 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe the  evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Sector-Specific Agencies’ Cyber Risk Mitigation Activities by Sector
paragraphs: This appendix provides further details on cyber risk mitigation activities  sector-specific agencies (SSA) developed for the 15 sectors in our review  based on analysis of documentation and statements from SSA officials.  Tables 9 through 23 below show, for each sector, SSA actions that  aligned with the 2013 National Infrastructure Protection Plan (NIPP) Call  to Action Steps.
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: Comments from the Department of the Treasury
section_title: Appendix V: Comments from the Environmental Protection Agency
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Michael W. Gilmore, Assistant  Director; Kenneth A. Johnson; Lee McCracken; David Plocher; Di’Mond  Spencer; Jonathan Wall; and Jeffrey Woodward made key contributions  to this report.