Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but More Can Be Done to Promote Its Use
Published: 2011-12-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Critical infrastructures are systems and assets critical to the nation's security, economy, and public health and safety, most of which are owned by the private sector. These assets rely on networked computers and systems, thus making them susceptible to cyber-based risks. Managing such risk involves the use of cybersecurity guidance that promotes or requires actions to enhance the confidentiality, integrity, and availability of computer systems. For seven critical infrastructure sectors, GAO was asked to identify (1) cybersecurity guidance for entities within the sectors, (2) the extent to which implementation of this guidance is enforced and promoted, and (3) areas of commonalities and differences between sector cybersecurity guidance and guidance applicable to federal agencies. To do this, GAO collected and analyzed information from responsible private sector coordinating councils; federal agencies, including sector-specific agencies that are responsible for coordinating critical infrastructure protection efforts; and standards-making bodies. In addition, GAO compared a set of guidance in each of three subsectors with guidance applicable to federal agencies.
section_title: What GAO Found
paragraphs: A wide variety of cybersecurity guidance is available from national and international organizations for entities within the seven critical infrastructure sectors GAO reviewed--banking and finance; communications; energy; health care and public health; information technology; nuclear reactors, material, and waste; and water. Much of this guidance is tailored to business needs of entities or provides methods to address unique risks or operations. In addition, entities operating in regulated environments are subject to mandatory standards to meet their regulatory requirements; entities operating outside of a regulatory environment may voluntarily adopt standards and guidance. While private sector coordinating council representatives confirmed lists of cybersecurity guidance that they stated were used within their respective sectors, the representatives emphasized that the lists were not comprehensive and that additional standards and guidance are likely used.
Implementation of cybersecurity guidance can occur through a variety of mechanisms, including enforcement of regulations and voluntarily in response to business incentives; however, sector-specific agencies could take additional steps to promote the most applicable and effective guidance throughout the sectors. A number of subsectors within the sectors included in GAO's review, such as electricity in the energy sector, are required to meet mandatory cybersecurity standards established by regulation under federal law or face enforcement mechanisms, such as civil monetary penalties. By contrast, entities not subject to regulation may voluntarily implement cybersecurity guidance to, among other things, reduce risk, protect intellectual property, and meet customer expectations. Federal policy establishes the dissemination and promotion of cybersecurity-related standards and guidance as a goal to enhancing the security of our nation's cyber-reliant critical infrastructure. DHS and the other lead agencies for the sectors selected for review have disseminated and promoted cybersecurity guidance among and within sectors. However, DHS and the other sector-specific agencies have not identified the key cybersecurity guidance applicable to or widely used in each of their respective critical infrastructure sectors. In addition, most of the sector-specific critical infrastructure protection plans for the sectors reviewed do not identify key guidance and standards for cybersecurity because doing so was not specifically suggested by DHS guidance. Given the plethora of guidance available, individual entities within the sectors may be challenged in identifying the guidance that is most applicable and effective in improving their security posture. Improved knowledge of the guidance that is available could help both federal and private sector decision makers better coordinate their efforts to protect critical cyber-reliant assets.
Sector cybersecurity guidance that GAO compared in three subsectors within the banking and finance, energy, and nuclear sectors is substantially similar to guidance applicable to federal agencies. Specifically, one set of guidance for each subsector, along with supplementary documents, addressed most risk management steps and most recommended security controls that are specified for federal information systems in guidance from the Commerce Department's National Institute of Standards and Technology. GAO is recommending that the Department of Homeland Security (DHS), in collaboration with public and private sector partners, determine whether it is appropriate to have cybersecurity guidance listed in sector plans. DHS concurred with GAO's recommendation.
section_title: What GAO Recommends
paragraphs: GAO is recommending that the Department of Homeland Security (DHS), in collaboration with public and private sector partners, determine whether it is appropriate to have cybersecurity guidance listed in sector plans. DHS concurred with GAOs recommendation.

section_title: Letter
paragraphs: Federal policy identifies infrastructure sectors—such as banking and  finance, energy, health care and public health, and communications—that  are critical to the nation’s security, economy, and public health and  safety. Because these sectors rely extensively on computerized  information systems and electronic data, the effective implementation of  appropriate security over these systems and data is crucial. Further,  because most of these infrastructures are privately owned, it is imperative  that public and private entities work together to protect these assets.  Since 2003 we have identified protecting systems supporting our nation’s  critical infrastructure—referred to as cyber-critical infrastructure  protection, or cyber CIP—as a governmentwide high-risk area, and we  continue to do so in the most recent update to our high-risk list.
To better manage cyber-based risks, public and private organizations use  cybersecurity guidance that promotes or requires action to enhance the  confidentiality, integrity, and availability of computer systems.  In addition,  for certain entities, such as financial institutions and nuclear power plants,  federal laws, regulations, and mandatory guidance require actions to  enhance the security of their information technology (IT) systems and  data.
As used in this report, cybersecurity guidance includes voluntary, consensus-based  standards and mandatory or required standards, implementation guides and manuals, and  best or smart practices.
As agreed, our objectives were to identify (1) cybersecurity guidance for  entities within selected critical infrastructure sectors, (2) the extent to  which implementation of cybersecurity guidance is enforced and  promoted within selected sectors, and (3) areas of commonalities and  differences that exist between sectors’ cybersecurity guidance and  guidance applicable to federal agencies. To accomplish these objectives,  we focused our efforts on seven sectors and certain subsectors: banking  and finance; communications; energy (electricity and oil and natural gas);  health care and public health; information technology; nuclear reactors,  materials, and waste; and water. We collected and analyzed information  from the federal agencies responsible for overseeing each critical  infrastructure sector—referred to as sector-specific agencies—private  councils established to coordinate critical infrastructure protection  policy—referred to as sector coordinating councils (SCC)—and other  sources to identify cybersecurity guidance, efforts to promote  cybersecurity guidance within the sectors, and mechanisms and  authorities available to enforce compliance with the mandatory guidance.  In addition, we compared the cybersecurity guidance available to a  subsector within each of three sectors (banking and finance, energy, and  nuclear) with federal cybersecurity guidance to identify areas of  commonalities and differences. Further details of our objectives, scope,  and methodology are provided in appendix I.
We conducted this performance audit from October 2010 to December  2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Critical infrastructures are systems and assets, whether physical or  virtual, so vital to our nation that their incapacity or destruction would  have a debilitating impact on national security, economic well-being,  public health or safety, or any combination of these. Critical infrastructure  includes, among other things, banking and financial institutions,  telecommunications networks, and energy production and transmission  facilities, most of which are owned by the private sector. As these critical  infrastructures have become increasingly dependent on computer  systems and networks, the interconnectivity among information systems,  the Internet, and other infrastructures creates opportunities for attackers  to disrupt critical systems, with potentially harmful effects. To better  manage cyber-based risks that the nation’s cyber-reliant critical  infrastructure faces, public and private organizations use available  cybersecurity standards and guidance that promote the security of their  critical systems.
subsections: section_title: Cyber-Reliant Critical Infrastructures Face a Proliferation of Threats
paragraphs: Threats to systems supporting critical infrastructure are evolving and  growing. In February 2011, the Director of National Intelligence testified  that, in the past year, there had been a dramatic increase in malicious  cyber activity targeting U.S. computers and networks, including a more  than tripling of the volume of malicious software since 2009. Cyber  threats can be unintentional or intentional. Unintentional threats can be  caused by software upgrades or maintenance procedures that  inadvertently disrupt systems. Intentional threats include both targeted  and untargeted attacks from a variety of sources, including criminal  groups, hackers, disgruntled employees, foreign nations engaged in  espionage and information warfare, and terrorists.
GAO, Information Security: TVA Needs to Address Weaknesses in Control Systems and  Networks, GAO-08-526 (Washington, D.C.: May 21, 2008). continue to move to networked operations, the threat will continue to  grow. Table 1 provides descriptions of common types of cyber exploits.
Reports of cyber attacks illustrate that such attacks could have a  debilitating impact on national and economic security and on public health  and safety.
In June 2011, a major bank reported that hackers had broken into its  systems and gained access to the personal information of hundreds of  thousands of customers. Through the bank’s online banking system,  the attackers were able to view certain private customer information.  In February 2011, media reports stated that computer hackers had  broken into and stolen proprietary information worth millions of dollars  from the networks of six U.S. and European energy companies.  In July 2010, a sophisticated computer attack, known as Stuxnet, was  discovered. It targeted control systems used to operate industrial  processes in the energy, nuclear, and other critical sectors. It is  designed to exploit a combination of vulnerabilities to gain access to  its target and modify code to change the process.
section_title: Federal Law and Policy Emphasizes Public-Private Coordination and the Provision of Guidance for the Protection of Cyber- Reliant Critical Assets
paragraphs: Federal law and policy have established roles and responsibilities for  federal agencies working with the private sector and other entities in  enhancing the cyber and physical security of critical public and private  infrastructures. These include the Homeland Security Act of 2002,  Homeland Security Presidential Directive 7 (HSPD-7), and the National  Infrastructure Protection Plan (NIPP). In addition, regulatory entities  oversee entities within critical infrastructure sectors and develop and  publish various types of cybersecurity guidance to assist their examiners  and organizations.
The Homeland Security Act of 2002 created the Department of Homeland  Security (DHS). Among other things, it assigned the department the  following critical infrastructure protection responsibilities: (1) developing a  comprehensive national plan for securing the key resources and critical  infrastructures of the United States; (2) assisting in the development and  promotion of private sector best practices to secure critical infrastructure;  and (3) disseminating, as appropriate, information to assist in the  deterrence, prevention, and preemption of, or response to, terrorist  attacks.
HSPD-7 established DHS as the principal federal agency to lead,  integrate, and coordinate the implementation of efforts to protect cyber- critical infrastructures and key resources. In addition, HSPD-7 identified  lead federal agencies, referred to as sector-specific agencies, which are  responsible for coordinating critical infrastructure protection efforts with  the public and private stakeholders in their respective sectors. For  example, the Department of the Treasury and the Department of Health  and Human Services are the sector-specific agencies for the banking and  finance and the health care and public health sectors, respectively.
The NIPP states that, in accordance with HSPD-7, DHS is a principal  focal point for the security of cyberspace and is responsible for  coordinating efforts to protect the cyber infrastructure to ensure its  confidentiality, integrity, and availability. These responsibilities, among  other things, include providing guidance on effective cyber-protective  measures, assisting the sector-specific agencies in understanding and  mitigating cyber risk, and assisting in developing effective and appropriate  protective measures. To accomplish these responsibilities, DHS is to help  in the development of comprehensive cybersecurity guidance that  homeland security partners may adopt to meet accepted industry-based  standards that measurably reduce the risk of cyber disruption or  exploitation.
The NIPP also describes a partnership model as the primary means of  coordinating government and private sector efforts to protect critical  infrastructure. For each sector, the model requires formation of  government coordinating councils—composed of federal, state, local, or  tribal agencies with purview over critical sectors—and encourages  voluntary formation of SCCs—composed of owner-operators of these  critical assets (some of which may be state or local agencies) or their  respective trade associations. These councils create the structure through  which representative groups from all levels of government and the private  sector are to collaborate in planning and implementing efforts to protect  critical infrastructure. The sector councils are envisioned to be policy- related and to represent a primary point of contact for government to plan  the entire range of infrastructure protection activities, including those  associated with mitigating cyber threats.
According to the NIPP, sector-specific agencies are to work with their  private sector counterparts to understand and mitigate cyber risk by,  among other things, determining whether approaches for critical  infrastructure inventory, risk assessment, and protective measures  address assets, systems, and networks; require enhancement; or require  the use of alternative approaches. They are also to review and modify  existing and future sector efforts to ensure that cyber concerns are fully  integrated into sector security activities and protective activities. Table 2  shows the 18 critical infrastructure sectors and the sector-specific  agencies assigned to each sector.
Further, the NIPP called for the sector-specific agencies, in close  collaboration with the sector coordinating councils, government  coordinating councils, and others, including state, local, and tribal critical  infrastructure key resources partners, to develop sector-specific plans  and sector annual reports to address how the sectors would implement  the national plan, including how the security of cyber and other (physical)  assets and functions was to be improved. More specifically, according to  the NIPP,  sector plans were to, among other things, describe how the sector will  identify and prioritize its critical cyber and other assets and define  approaches to be taken to assess risks and develop programs to  protect these assets, and  sector annual reports were to provide status and progress on each  sector’s efforts to carry out the sector plans.
In September 2009, we reported that sector-specific agencies had made  limited progress in updating their sector-specific plans to fully address key  cyber elements. As a result, we recommended that the Secretary of  Homeland Security, consistent with any direction from the Office of the  Cybersecurity Coordinator, (1) assess whether the existing sector- specific planning process should continue to be the nation’s approach to  securing cyber and other critical infrastructure and, in doing so, consider  whether proposed and other options would provide more effective results  and (2) if the existing approach is deemed to be the national approach,  work with the sector-specific agencies to develop their plans to fully  address DHS cybersecurity criteria. In response to our recommendations,  DHS took steps to make sector-specific planning a priority. For example,  in 2009 and 2010, DHS met and worked with the sector-specific agencies  and sector representatives to update sector plans with the goal of fully  addressing cyber-related criteria. As of October 2011, of the 18 plans,  DHS reported that 17 have been finalized and approved and 1 is still in  the process of being reviewed.
In addition, DHS’s Quadrennial Homeland Security Review Report  identified key strategic outcomes for the department’s safeguarding and  securing cyberspace mission, including, among others, that the (1)  homeland security partners develop, update, and implement guidelines,  regulations, and standards that ensure the confidentiality, integrity, and  reliability of systems, networks, and data, and (2) critical infrastructure  sectors adopt and sector partners meet accepted standards that  measurably reduce the risk of cyber disruption or exploitation.
In addition to public-private partnership-related efforts, regulatory entities  oversee entities within critical infrastructure sectors that are under the  purview of federal law, regulation, or mandatory standards pertaining to  securing privately owned information systems or data. For example,  depository financial institutions (such as commercial banks and credit  unions) in the banking and finance sector are regulated by members of  the Federal Financial Institutions Examination Council (FFIEC). The  mechanisms used to perform oversight include continuous examinations,  periodic examinations, self-reporting, and compliance reviews, and  various types of mechanisms exist to enforce compliance. Federal  regulators also develop and publish various types of cybersecurity  guidance to assist (1) the examiners and inspectors in carrying out their  responsibilities and (2) the regulated entities in fulfilling requirements,  addressing specific threats, or mitigating identified risks. For example,  FFIEC has issued handbooks that are intended to provide guidance to  examiners and organizations.
section_title: Many Organizations Develop Cybersecurity Guidance to Help Manage Cyber-Based Risks
paragraphs: Cybersecurity guidance provides general guidelines and principles as well  as technical security techniques for maintaining the confidentiality,  integrity, and availability of information systems and data. When  implementing cybersecurity technologies and processes, organizations  can avoid making common implementation mistakes by consulting  guidance developed by various other organizations. Public and private  organizations may decide to voluntarily adopt this guidance to help them  manage cyber-based risks. Some entities may also be required to meet  regulations or mandatory requirements that address cybersecurity.
Many organizations exist that develop standards and guidance that,  among other things, promote the confidentiality, integrity, and availability  of computer systems and information. Examples of such organizations  include the following:  International Organization for Standardization (ISO): a  nongovernmental organization that develops and publishes  international standards. The standards, among other things, address  information security by establishing guidelines and general principles  for initiating, implementing, maintaining, and improving information  security management in an organization.
International Electrotechnical Commission (IEC): an organization for  standardization comprising all national eletrotechnical committees.  The commission publishes international standards, technical  specifications, technical reports, and publicly available specifications  and guides. The information security standards address safety,  security, and reliability in the design and operations of systems in the  power industry, among other things.
The International Telecommunication Union: a United Nations agency  whose mission includes, among other things, developing technical  standards and providing technical assistance and capacity building to  developing countries. The union has also developed technical  standards for security and, more recently, engaged in other  cybersecurity activities. For example, the union has established a  study group for telecommunications security to focus on developing  standards and recommendations associated with network and  information security, application security, and identity management.  Similarly, the union, through its members’ efforts, prepared a report on  cybersecurity best practices for countries seeking to organize national  cybersecurity efforts.
The International Society of Automation (ISA): a global and nonprofit  organization that develops standards for automation. It has developed  a series of standards to address security in industrial automation and  control systems.
The American National Standards Institute (ANSI): a U.S.  organization that is responsible for coordinating and promoting  voluntary consensus-based standards and information sharing to  minimize overlap and duplication of U.S. standards-related efforts.
In addition, it is the representative of U.S. interests in international  standards-developing organizations.
Individual industries and sectors also have their own specific standards.  These include standards or guidance developed by regulatory agencies  that assist entities within sectors in complying with cybersecurity-related  laws and regulations. In addition, organizations that operate in a specific  industry develop cybersecurity standards and guidance and promote  practices for their industries.
In the United States, the National Institute of Standards and Technology  (NIST), a standards-setting agency under the U.S. Department of  Commerce, issues Federal Information Processing Standards that,  pursuant to the Federal Information Security Management Act of 2002  (FISMA), are mandatory for federal agencies and special publications that  provide guidance for information systems security for non-national  security systems. For example, NIST Special Publication (SP) 800-39,  Managing Information Security Risk: Organization, Mission, and  Information System View, provides guidance for an integrated,  organizationwide program for managing information security risk to  organizational operations, organizational assets, individuals, other  organizations, and the nation resulting from the operation and use of   NIST also developed a risk management  federal information systems.framework that is one of several NIST guidelines for federal agencies to  follow in developing information security programs. The framework is  specified in NIST SP 800-37, Revision 1, Guide for Applying the Risk  Management Framework to Federal Information Systems: A Security Life  Cycle Approach, which provides agencies with guidance for applying the  risk management framework to federal information systems.framework consists of a six-step process involving (1) security  categorization, (2) security control selection, (3) security control  implementation, (4) security control assessment, (5) information system  authorization, and (6) security control monitoring. It also provides a  process that integrates information security and risk management  activities into the system development life cycle.
NIST SP 800-53, Revision 3, Recommended Security Controls for  Federal Information Systems and Organizations, provides a catalog of  security controls and technical guidelines that federal agencies use to  protect federal information and information systems. such as those in the nation’s critical infrastructure sectors, are  encouraged but not required to use this NIST guidance where  appropriate. Table 3 lists SP 800-53’s 18 control families and the 198  recommended controls.
DHS’s National Cyber Security Division’s Control Systems Security  Program has also issued recommended practices to reduce risks to  industrial control systems within and across all critical infrastructure and  key resources sectors. For example, in April 2011, the program issued  the Catalog of Control Systems Security: Recommendations for  Standards Developers, which is intended to provide a detailed listing of  recommended controls from several standards related to control  systems.
section_title: Wide Variety of Sector Cybersecurity Guidance Is Available
paragraphs: A wide variety of cybersecurity guidance from national and international  organizations is available to critical infrastructure sector entities. Much of  this guidance is tailored to the unique characteristics of each sector.  Further, entities within regulated subsectors have specific cybersecurity  guidance that is required or recommended to be used, while entities  operating outside of a regulatory environment have standards and  guidance available, but not required, for their use. Furthermore, industry  regulators, associations, and other groups have also developed and  issued voluntary guidance available for use by entities within their  respective sectors that is tailored to the business needs of entities or  provides methods to address unique risks or operations.
While SCC representatives confirmed lists of cybersecurity guidance that  they stated was used within their respective sectors, the representatives  emphasized that the lists were not comprehensive and that additional  standards and guidance are likely used within the sectors. In addition,  SCC representatives stated that they were not always aware of the extent  to which the identified guidance was used by entities within their sectors.
The following discussion describes cybersecurity guidance identified for  each of the sectors in our review. A list of specific guidance for each  sector is provided in appendix II.
Banking and finance sector: The guidance documents for the banking  and finance sector are diverse. For example, federal regulatory entities  within the various sector segments issue specific risk-based cybersecurity  requirements. In addition, financial institutions and the payment card  industry have developed voluntary standards and practices.
FFIEC has issued handbooks that outline cybersecurity requirements for  depository institutions within the sector. In addition, federal financial  regulators have issued regulations that cover a comprehensive set of  high-level requirements, including security programs, risk management,  data security, incident response and anti-identity-theft. These regulations  are in response to laws such as the Gramm-Leach-Bliley Act and the Fair  Credit Reporting Act.
The banking and finance sector-specific plan identified applicable laws,  regulations, and a multitude of sector-specific guidance, especially for  depository and financial institutions, that covered many cybersecurity  topics such as access control authentication and phishing. Each of the  FFIEC agencies often issues guidance that is similar in content but  tailored to meet its legal requirements. The agencies deliver this guidance  through their respective transmittal documents, such as bulletins, financial  institution letters, letters to credit unions, and supervisory letters. In  addition, according to an SCC representative familiar with cybersecurity  guidance associated with the sector, the revision associated with the  latest sector-specific plan will have more guidance on the investments  and securities subsector.
Communications sector: The guidance documents for the  communications sector cover a variety of topics such as  telecommunication industry security standards, network engineering  standards, and security configuration guides. The SCC representatives  familiar with cybersecurity guidance associated with the sector stated that  the identified guidance is all widely used within the sector. In addition, the  representatives acknowledged that a number of the documents are  overlapping and cover similar areas, and that on the basis of its particular  needs an entity may select among several. Further, decisions on whether  or not to implement a specific practice within guidance depend on the role  of the responsible implementer (e.g., service provider, network operator,  or equipment supplier) and an understanding of the impact on factors  such as the systems, networks, and organizations.
According to SCC representatives responsible for cybersecurity efforts,  cybersecurity standards and practices promoted and used by SCC  members include those developed by the Alliance for  Telecommunications Industry Solutions, Internet Engineering Task Force,  and the International Telecommunication Union. For example, the  Alliance for Telecommunications Industry Solutions issued a U.S.  Standard for Signaling Security–Security Roadmap.
In addition, the Communications Security, Reliability, and Interoperability  Council recently published a key guidance document to update and  combine a large body of sector cybersecurity practices from a variety of  sources. The guidance addresses the following areas: identity  management, encryption, vulnerability management, and incident  response for wireless, Internet protocol services, network, people, and  legacy services. The document includes 397 cybersecurity practices  intended to ensure the security of networks and systems for all segments  of the communications industry. According to the document, the practices  are not overly prescriptive, allowing network service providers, operators,  and equipment suppliers enough latitude to make deployment decisions  that best suit their business practices, which revolve around technology,  capability, and customer requirements.
Energy sector: The energy sector is divided between the electricity and  oil and natural gas subsectors. Within the electricity subsector, the  Federal Energy Regulatory Commission (FERC) certified the North  American Electric Reliability Corporation (NERC) as the Electric  Reliability Organization that is responsible for developing reliability  standards, subject to FERC oversight, review, and approval. If  approved, the standards become mandatory and enforceable in the  contiguous 48 states. NERC developed eight cybersecurity standards,  which FERC approved in 2008, that address the following topics: critical  cyber asset identification, security management controls, personnel and  training, electronic security perimeter(s), physical security of critical  cyber assets, systems security management, incident reporting and  response planning, and recovery plans for critical cyber assets. NERC  also publishes security guidelines for companies to consider for protecting  electric infrastructure systems, although such guidelines are voluntary  and are typically not checked for compliance. For example, NERC’s June  2010 Security Guideline for the Electricity Sector: Identifying Critical  Cyber Assets is intended to assist entities in identifying and developing a  list of critical cyber assets as described in the mandatory standards.
Cybersecurity guidance for the oil and natural gas subsector has been  issued by various related organizations, as has applicable guidance from  closely related sectors, such as transportation and chemical. Among  others, sector-specific guidance was identified from the American  Petroleum Institute, American Gas Association, and the Interstate Natural  Gas Association of America. For example, the American Petroleum  Institute’s Security Guidelines for the Petroleum Industry address  cyber/information technology in the petroleum industry and endorse the  ISO/IEC international standard 17799 for creating a cybersecurity  program as voluntary guidance.covered various topics, including cryptography, third-party connections,  and control systems.
Health care and public health sector: Cybersecurity guidance for the  health care and public health sector covers a variety of topics specific to  the security of health information. For example, ISO and ASTM  International have issued health sector cybersecurity guidance. issued guidance for security management in health, and ASTM  International issued guidance on user authentication and authorization.  Also, according to a sector coordinating council representative, Electronic  Data Interchanges are critical to data exchange within the sector and  have cybersecurity implications.and public health sector annual report, the sector is engaged in an  international effort to develop standardized security guidelines for health  information technology that will facilitate the confidentiality, availability,  and integrity of health information systems and the data residing on those  systems.
ASTM International was previously known as the American Society of Testing and  Materials. implementing an information security program. In addition, a Department  of Health and Human Services (HHS) Office for Civil Rights official  familiar with health information privacy issues said that the department  developed guidance on how to develop a risk-based approach for  protecting electronic health information and is working with NIST to  develop a self-assessment tool that entities in the health sector can use  to assess their security posture.
Information technology sector: Cybersecurity guidance for the  information technology sector covers a number of topics, including  security management system requirements, operational security, and  identity management. Also, the information technology sector’s 2010  sector annual report and information provided by DHS’s National  Protection and Programs Directorate reference the following  organizations as providing cybersecurity guidance relevant to the  sector:  the Internet Engineering Task Force, an international organization that  develops Internet standards and protocols; ISO/IEC, which provides standards and practices for managing  information security systems; the Institute of Electrical and Electronics Engineers, which establishes standards and practices for managing information security systems;and
NIST, which issues special publications and interagency reports.
According to the chairperson of the IT SCC, the IT sector is very complex  and there is no “short list” of cyber standards. From the industry’s  perspective, there is an “ecosystem of cybersecurity standards” that  includes many different components, comprising hundreds, or even  thousands, of individual standards related to technologies, practices, and  products and that perform a variety of functions such as enabling  interoperability and assurance of security policies and controls. Further,  the standards ecosystem constantly evolves in response to new  technologies, cyber threats and risks, and business models. The SCC  chairperson confirmed the identified cybersecurity guidance, as shown in  appendix II, as an illustrative list containing examples of cybersecurity  guidance available to sector entities.
Nuclear reactors, materials, and waste sector: The cybersecurity- specific guidance for this sector includes documents issued by the  Nuclear Regulatory Commission (NRC) and Nuclear Energy Institute.  SCC representatives stated that the NRC and Nuclear Energy Institute  guidance documents were widely used for nuclear power plants within the  sector. NRC, under its regulatory authority, requires, among other things,  that licensees provide high assurance that digital computer and  communication systems and networks are adequately protected against  cyber attacks. Both NRC and the institute have issued guidance  containing methods that entities may use to meet the regulatory  requirements. This guidance includes NRC’s Regulatory Guide 5.71 for  cybersecurity programs at nuclear facilities, the most recent version of  which was issued in January 2010, and the institute’s cybersecurity plan  for nuclear power reactors, the most recent version of which was issued  in April 2010. NRC officials and institute representatives familiar with both  guides stated that they contain similar cybersecurity controls. However,  these guides are not substitutes for compliance with regulations, and  compliance with the guides is not mandatory. According to NRC  representatives responsible for NRC’s cybersecurity-related efforts, the  guides provide an approach that the NRC staff deems acceptable for  complying with the commission’s regulations regarding the protection of  digital computers, communications systems, and networks from a cyber  attack. Although licensees may use methods other than those described  within this guidance to meet the commission’s regulations, the NRC  representatives said that all licensees have used one of these two  methods. In addition, the NRC representatives said that they are  developing a new guide to facilitate inspections of cybersecurity  programs.
NRC’s cybersecurity regulations are currently only applicable to power- generating facilities. The NRC representative familiar with cybersecurity  guidance said that, in general, NRC’s rule-making process is based on  the risk to the public and has included the issuance of regulations for the  power generation facilities first, which are then typically promulgated to   and then to other nuclear facilities (such as research  fuel cycle facilities,reactors), as needed. Also, NRC issued a series of orders recommending  greater cybersecurity after September 11, 2001.
According to the 2010 sector annual report, the Nuclear Sector Cyber  Subcouncil is working on a road map to secure control systems in the  nuclear sector. The annual report states that the road map will build on  existing government and industry efforts to enhance the security of  control systems in the power and nonpower reactor segments of the  sector, taking into account NRC’s cybersecurity requirements. According  to a DHS official, the scope of the road map was limited to commercial  nuclear power plants.
Water sector: Cybersecurity guidance for the water sector covers a  number of topics, including risk analysis and management and industrial  control systems. However, information compiled from the SCC  membership and provided by the Secretariat of the Water SCC showed  that several documents cited as relevant to cybersecurity were not widely  used by entities within the sector for various reasons, including the lack of  resources and funding to implement a cybersecurity program. The  representatives further stated that while the larger utilities have the  staffing levels and budgets that enable them to more fully implement  cybersecurity for their control systems, many medium-size or small  utilities struggle to maintain the staff needed just to keep their systems  properly running.
Furthermore, Water SCC representatives familiar with cybersecurity  guidance associated with the sector said that while they have not  specified any specific cybersecurity guidance that water utilities are to  use, some utilities are using and implementing cybersecurity guidance  that has been used in other sectors. Also, the Cybersecurity Working  Group of the Water SCC prepared with DHS a road map to define gaps  and a strategy for addressing outstanding needs in securing process  control systems. It states that planned cybersecurity activities include (1)  isolating control systems from public switched networks and (2) adopting  recommended practices for control systems in the water sector.
Cross-sector guidance: In addition to sector-specific guidance,  cybersecurity guidance from national and international organizations can  be and is utilized by sector entities and was frequently mentioned as  important in developing sector-specific guidance. These include NIST’s  risk management framework and security controls for information systems  and industrial control systems; DHS’s recommended security controls for  control systems; ISO guidance on establishing an information system  security control program, including security control guidance; and the  International Society of Automation’s security guidance for industrial  control systems.
section_title: Implementation of Cybersecurity Can Be Enforced through a Variety of Mechanisms, but More Could Be Done to Disseminate and Promote Guidance
paragraphs: Implementation of cybersecurity guidance can occur through a variety of  mechanisms, including enforcement of regulations and voluntarily in  response to business incentives; however, responsible federal entities  could take additional steps to promote the most applicable and effective  guidance throughout the sectors. Entities operating under a federal  regulatory environment are required to adhere to cybersecurity standards  to meet their regulatory requirements or face enforcement mechanisms.  Entities not subject to regulation do not face such enforcement  mechanisms, but may voluntarily implement cybersecurity guidance in  response to business incentives, such as mitigating risk, ensuring  interoperability among systems, or protecting intellectual property. With  respect to promoting cybersecurity guidance, sector-specific agencies,  and, in particular, DHS, have specific roles to play in coordinating  cybersecurity efforts, which include the promotion and dissemination of  guidance and practices. While DHS and other agencies have taken a  number of steps in this area, more could be done to identify guidance and  standards applicable to entities within the sectors and to promote their  implementation.
subsections: section_title: Regulated Entities Are Required to Comply with Federal Cybersecurity Regulations or Face Enforcement Actions
paragraphs: Critical infrastructure entities covered under regulation, such as  depository institutions in the banking and finance sector; the bulk power  system in the electricity subsector of the energy sector; health care and  public health sector; and the nuclear reactors, materials, and waste  sector, are regulated by the federal government and thus are required to  meet mandatory cybersecurity standards established by regulation under  federal law. When an entity is determined to be not compliant with these  requirements, various types of enforcement mechanisms can be  employed. These mechanisms include administrative actions such as a  supervisory directive or memorandum of understanding. More severe  enforcement actions include cease and desist orders, remedial directives,  revocations of license or certification, and civil monetary penalties.
Depository Institutions  (Banking and Finance Sector)
Cybersecurity oversight functions are conducted by FFIEC member  agencies through examinations. Subcommittee Chairperson, for most larger financial institutions,  examiners have a continuous, on-site presence and are constantly  evaluating their assigned financial institutions’ programs, in particular in  regard to cybersecurity, which is considered high risk, to ensure that the  institutions operate safely and soundly. For smaller financial institutions,  examinations for cybersecurity risks occur every 12 to 18 months or after  the issuance of significant regulatory guidance.
For example, the Federal Deposit Insurance Corporation can initiate enforcement  actions and orders against state nonmember banks, and insured foreign banks. The  National Credit Union Administration can initiate enforcement actions and orders against  federally insured credit unions and credit union–affiliated parties. The Office of the  Comptroller of the Currency can initiate enforcement actions and orders against national  banks and federal savings associations, federally chartered branches, and agencies of  foreign banks. The Federal Reserve System can initiate enforcement actions and orders  against state member banks; financial, bank, and thrift holding companies; and U.S.  operations of foreign banking organizations. weaknesses identified by the examiners. Informal enforcement actions  can consist of the following: a memorandum of understanding or document of resolution, a supervisory directive, a notice of deficiency and request for a safety and soundness  individual minimum capital requirement directives.
Formal actions are authorized by statute and mandated in some cases,  are generally more severe, and are disclosed to the public. Depending on  whether the institution is a credit union or a bank, formal enforcement  actions for any violations of laws and regulations, including various  cybersecurity provisions, can take the following forms:  cease and desist orders, termination of insurance, and liquidation.
For example, an agency can assess civil monetary penalties of $7,500  per day for any violation of law or regulation, or assess a fine up to  $37,000 per day for a violation that is, for instance, likely to cause more  than a minimal loss to the financial institution, or assess a penalty of up to  $1,375,000 million per day for knowingly engaging, for instance, in any  unsafe or unsound practice when the offender knowingly or recklessly  caused a substantial loss to the financial institution or received a  substantial pecuniary gain or other benefit. However, according to the  FFIEC IT Subcommittee Chairperson, while depository institutions have  been cited for operating in an unsafe and unsound manner as it relates to  cybersecurity, none of these cases have reached the level of formal  actions with civil monetary penalties.
Bulk Power System (Electricity  Subsector of the Energy  Sector)
NERC, as the Electric Reliability Organization, has the authority to  enforce compliance with mandatory cybersecurity standards through its  Compliance Monitoring and Enforcement Program, subject to FERC  review. While FERC has authorized NERC to enforce mandatory  reliability standards in the United States, the commission retains its own  authority to enforce the same standards and assess penalties for  violations. The commission also has the ability to review each penalty  NERC proposes for noncompliance with a reliability standard in the  United States, either by its own action or upon an appeal by a penalized  entity.
Monitoring functions are carried out by NERC inspectors through a  number of actions:
Performing compliance audits for bulk power system owners,  operators, and users on a schedule established by NERC.
Periodically conducting a self-certification to attest to compliance or  noncompliance with reliability standards.
Initiating spot checks or performing compliance violation  investigations in response to an event or complaint.
Encouraging self-reporting versus formal NERC reporting when a  user, owner, or operator of the bulk power system becomes aware of  a violation of a reliability standard or of a change in the violation  severity level of a previously reported violation.
Requiring periodic data submissions. Under this circumstance, a team  of industry experts is established to review the data and provide a  report to NERC.
Requiring technical feasibility exception reporting for the reliability  standards that allow such exceptions. Those reliability standards  require reporting of exceptions to compliance with the reliability  standard and approval by NERC of the exceptions as a form of  compliance monitoring.
Reviewing complaints received alleging violations of a reliability  standard to determine if a compliance violation investigation is  required.
Enforcement mechanisms include monetary penalties, nonmonetary  sanctions, and remedial actions, according to NERC sanction guidelines.  NERC can levy monetary penalties for the violation of requirements of the  reliability standards. For example, NERC or regional entities, upon  delegation of NERC’s authority, can impose a monetary penalty or fine of  up to $1 million per day per violation, depending on the risk factors and  level of violation severity involved. NERC must file all penalties it or a  regional entity proposes to impose with FERC. If FERC takes no action  after 31 days, the penalties go into effect, or FERC can either reject or  take up the proposed penalty for further action. Entities can appeal the  penalties with FERC.
For the month of July 2011, a Notice of Penalty was issued for violations  of NERC Cyber Security Standards, one of which included a high  violation risk factor that had a monetary penalty of $75,000 imposed,  according to NERC’s publicly available enforcement information on  penalties. In addition, there were 65 cybersecurity violations with a medium violation risk factor reported that had total monetary penalties of  approximately $496,000 imposed and 24 cybersecurity violations with a  low violation risk factor that had total monetary penalties of approximately  $375,000 imposed.
NERC, the regional entities, and FERC can also levy nonmonetary  sanctions against a violator that include limitations or restrictions that may  result in economic or other impacts. In addition to monetary and  nonmonetary sanctions, NERC, the regional entities, and FERC can  direct bulk power system entities to take remedial action to correct  conditions, practices, or any other relevant action or activity underlying  the noncompliance involved, including cybersecurity-related issues. For  example, remedial actions may include the following:  specifying operating or planning criteria, limits, or limitations; requiring specific system studies; defining operating practices or guidelines;  requiring confirmation of data, practices, or procedures through  inspection testing or other methods; requiring specific training for personnel; and requiring development of specific operating plans.
HHS’s Office for Civil Rights (OCR) is responsible under HIPAA for  oversight and enforcement of the protection of electronic protected health  information held by covered entities within the health care and public  health sector. Cybersecurity requirements are also applicable to this  sector’s reimbursement and supply chain functions.
Oversight of HIPAA’s Security Rule is carried out through compliance  reviews and complaints that can be received through one of HHS’s 10  regional offices. According to an OCR official familiar with health  information privacy issues, HHS has undertaken oversight of Security  Rule compliance. For example, during calendar year 2010, HHS reported  opening 243 complaints and compliance reviews involving Security Rule  issues, which represents a 95 percent increase in the number of Security  Rule cases opened over the average caseload of the previous 4 years. In  addition, OCR reported resolving a total of 128 complaints, which is an  increase of 16 percent over the average number of resolved complaints in  the previous 4 years. More importantly, 55 percent of the resolved  complaints required the regulated entity to take corrective action to  achieve compliance with the Security Rule, whereas on average only 18 percent of the resolved complaints in prior years required such action.
Additionally, HIPAA-covered entities and their business associates are to  provide notification following a breach of unsecured protected health  information. Clinical Health Act’s Breach Notification Interim Final Rule, OCR  processes and initiates investigations of reports involving 500 or more  individuals. According to the OCR health information privacy official, since  the inception of the breach notification requirement, over 70 percent of  the 280 major breaches reported (as of May 30, 2011) involved electronic  protected health information, and thus required investigation for Security  Rule compliance. Of these cases, the official stated that 6 percent of  breach reports involving more than 500 individuals have been due to  hacking or cybersecurity incidents, compared with 67 percent of these  breaches being due to the physical loss or theft of protected health  information.
Under the Health Information Technology for Economic and  Enforcement mechanisms include the imposition of civil money penalties  for violations. HHS can levy fines or penalties for failure to comply with  the cybersecurity standards or specifications of the Security Rule, Privacy  Rule, and Breach Notification Interim Final Rule.
Breach notification was implemented under the Health Information Technology for  Economic and Clinical Health (HITECH) Act.
When considering civil monetary penalties, there are four categories of  violations that reflect increasing levels of culpability. The categories and  minimum penalties are as follows:  For each violation, the maximum penalty amount in every category is  $50,000. For multiple violations in a calendar year, the maximum penalty  amount in each category is $1.5 million. HHS determines the penalty  amounts based on the nature and extent of the violation, resulting harm,  and other factors.
The OCR health information privacy official also indicated that the office  has executed resolution agreements and corrective action plans in  several cases where investigation has found systemic failures to comply  with the Security Rule for protecting electronic health information. For  example, the official stated that OCR executed a resolution agreement  with a major university in the amount of $865,000, which also included a  3-year corrective action plan to implement stronger safeguards for  electronic protected health information as well as comprehensive  employee training on the appropriate use of patient information. In  another case, OCR executed a resolution agreement with a major  hospital in the amount of $1 million that included a 3-year corrective  action plan to address stronger safeguards for the removal of protected  health information from the hospital by employees for work-related  purposes, including the removal of electronic protected health  information.
Nuclear Reactors (Nuclear  Reactors, Materials, and Waste  Sector)
NRC is responsible for both physical security and cybersecurity oversight.  To enhance its current cybersecurity program, NRC has issued a  cybersecurity-focused regulation and a cybersecurity regulatory guide.
Current cybersecurity oversight functions are carried out through  inspections of licensed facilities to ensure that they are in compliance with  NRC regulations and the terms of their licenses. Although NRC has not  imposed a civil penalty for cybersecurity violations at its facilities under its  current enforcement policy, failure to comply with NRC’s regulations may  result in the imposition of enforcement sanctions such as notices of  violation, civil penalties, and the issuance of orders.
Prior to implementing its new cybersecurity program, NRC must review  and approve the cybersecurity plans for all operational nuclear power  plants. Once a cybersecurity plan is approved for a particular nuclear  power plant, implementing the program defined within that plan becomes  both a condition of that plant’s operating license and an inspection  requirement.
In addition to approving cybersecurity plans, NRC is also developing a  cybersecurity inspection program that is scheduled for implementation  during 2012 and is in the early stages of revising its cybersecurity  enforcement policy to account for the new cybersecurity inspection  program. The cybersecurity inspection program will be implemented in  three stages. In the first stage, NRC intends to develop its initial  inspection guidance. In the second stage, NRC intends to commence  specialized inspector cybersecurity training and education in preparation  for on-site cybersecurity inspections at licensed facilities. In the final  stage, NRC will leverage the results of and the insights gained from its  initial inspections to develop program guidance and procedures for future  periodic inspections.
Finally, NRC is in the early stages of revising its cybersecurity  enforcement policy to account for the new cybersecurity inspection  program.
section_title: Although No Enforcement Mechanisms Exist, Nonregulated Entities Have Business Reasons to Implement Cybersecurity Based on Available Guidance
paragraphs: According to officials familiar with cybersecurity issues in their respective  SCCs, the information technology, communications, and water critical  infrastructure sectors and oil and natural gas subsector of the energy  sector are not subject to direct federal cybersecurity-related regulation.
Although the use of cybersecurity guidance is not mandatory, entities may  voluntarily implement such guidance in response to business incentives,  including to mitigate risks, protect intellectual property, ensure  interoperability among systems, and encourage the use of leading  practices. For example, officials familiar with cybersecurity issues from  both the communications sector and information technology sector stated  that the competitive market place, desire to maintain profits, and  customer expectation of information security—rather than federal  regulation—drive the adoption of best practices. Oil and gas SCC officials  said that their member companies are not required to follow industry  guidelines, but legal repercussions regarding standard of care may  motivate the incorporation of such cybersecurity standards into their  operations.
section_title: DHS and Sector-Specific Agencies Have Taken Steps to Disseminate and Promote Guidance, but More Could Be Done
paragraphs: As recognized in federal policy, the dissemination and promotion of  cybersecurity standards and guidance is a goal in enhancing the security  of our nation’s cyber-reliant critical infrastructure. The NIPP states that, in  accordance with HSPD-7, DHS is a principal focal point for the security of  cyberspace and is responsible for coordinating efforts to protect the cyber  infrastructure to ensure its confidentiality, integrity, and availability. These  responsibilities, among other things, include providing guidance on  effective cyber-protective measures, assisting the sector-specific  agencies in understanding and mitigating cyber risk, and assisting in  developing effective and appropriate protective measures. To accomplish  these responsibilities, DHS is to help in the development of  comprehensive cybersecurity guidance that homeland security partners  may adopt to meet accepted industry-based standards that measurably  reduce the risk of cyber disruption or exploitation.
In this regard, DHS and the other sector-specific agencies for the sectors  selected for review have disseminated and promoted cybersecurity  guidance among and within sectors. For example, officials from DHS’s  National Cybersecurity Division (NCSD) stated that they work within the  public-private partnership model to identify and prioritize cybersecurity  risks within sectors, then coordinate with the sectors to encourage entities  to adopt cybersecurity guidance to mitigate identified vulnerabilities.  NCSD also engages with standards-developing organizations to provide  input, resources, and support. For example, NCSD has provided  resources, including time and expertise, supporting the development of  security standards with NIST, ANSI, ISO, and the International  Telecommunication Union. In addition, NCSD leverages a variety of  resources to promote specific cybersecurity standards and practices. For  example, through its Control Systems Security Program, NCSD has taken  several actions, such as developing a catalog of recommended security  practices for control systems, developing a cybersecurity evaluation tool  that allows asset owners to assess their control systems and overall  security posture, and collaborating with the Industrial Control Systems  Joint Working Group to promote control standards and system security.
In addition, officials from the Department of Energy’s Office of Electricity  Delivery and Energy Reliability stated that the department, as the energy- sector-specific agency, is involved in many ongoing efforts to assist the  sector in the development, assessment, and sharing of cybersecurity  standards. For example, the department is working with NIST to enable  state power producers to use current cybersecurity guidance. The  department is also the Vice Chair of the Cyber Security Working Group  and provides funds that will enable private sector power producers to  share practices. In addition, according to Department of Energy officials,  the department is currently leading an initiative to develop a risk  management guideline for the electric grid to ensure that cybersecurity  risks are addressed at the organization, mission or business process, and  information system levels. This is modeled after NIST Special Publication  800-39 and tailored to the needs of the energy sector. Further,  Department of Health and Human Services officials responsible for the  agency’s sector-specific efforts also stated that they encourage the  sharing of existing standards. For example, a public-private cybersecurity  workgroup was formed that developed a cybersecurity primer to educate  members of the sector.
While these are significant steps, DHS and the other sector-specific  agencies have not identified the key cybersecurity guidance applicable to  or widely used in each of their respective critical infrastructure sectors. In  addition, DHS guidance for preparing the sector-specific critical  infrastructure protection plans calls for, among other things, outlining the  sector’s cyber protection and resilience strategies; however, these plans  largely do not identify key guidance and standards for cybersecurity.  Specifically, only one of the seven sectors reviewed (banking and  finance) listed cybersecurity guidance in its current sector-specific plan.  The other six sectors mentioned certain guidance in these plans, but did  not list applicable guidance.
Sectors reported that they did not identify this guidance in their plans in  part because DHS did not specifically address listing cybersecurity  guidance in its guidance for the revision of the sector-specific plans. In  addition, officials from DHS’s NCSD noted that their engagement in the  area of standards focuses on promoting standards and practices from a  cross-sector perspective, rather than focusing on individual sectors.  However, given the plethora of guidance available, individual entities  within the sectors may be challenged in identifying the guidance that is  most applicable and effective in improving their security posture.  Improved knowledge of the guidance that is available could help both  federal and private sector decision makers better coordinate their efforts  to protect critical cyber-reliant assets.
section_title: Cybersecurity Guidance For Three Subsectors Is Substantially Similar to Federal Guidance
paragraphs: Sector cybersecurity guidance related to three subsectors (electricity,  depository institutions, and nuclear reactors) is substantially similar to  guidance applicable to federal agencies. Specifically, sector  cybersecurity guidance and supplementary documents that we analyzed  addressed most of NIST’s risk management framework steps and most of  the 198 recommended security controls in NIST SP 800-53 (listed in table  3) that are specified for federal information systems. In cases where  differences existed in terms of security controls, sector representatives  provided supplementary documents with controls that resolved the  difference, or explained that some federally recommended security  controls were not applicable for sector-specific reasons.
subsections: section_title: Bulk Power System (Electricity Subsector of the Energy Sector)
paragraphs: NERC Cyber Security Standards 002 through 009, Version 3, and  supplementary documents are substantially similar to guidance  applicable to federal agencies. As discussed previously, the NIST risk  management framework describes the activities important to an effective  information security program (e.g., categorize information systems, select  security controls). Similarly, the NERC Cyber Security Standards provide  a cybersecurity framework for the identification and protection of entity- identified critical cyber assets to support reliable operation of the bulk  power system.Security Management Controls and Systems Security Management),  which contain mandatory and enforceable minimum security requirements  (e.g., critical cyber asset identification and cyber vulnerability  assessment).
The standards also cover eight cybersecurity areas (e.g.,  As discussed previously, NIST SP 800-53, Revision 3, addresses one of  the steps in the NIST risk management framework, which is to select a  baseline of security controls and tailor and supplement the baseline  based on an organizational risk assessment. SP 800-53 contains 18  control families (e.g., Access Control and Risk Assessment), which in  total, contain 198 recommended security controls (e.g., Account  Management and Malicious Code Protection) for federal information  systems and organizations.
We determined that the eight NERC Cyber Security Standards and  supplementary documents addressed 151 of the 198 SP 800-53 controls,  and NERC officials responsible for the Cyber Security Standards deemed  46 of the remaining controls to be not applicable, and stated that 1  control—transmission integrity—was not considered when revising the  latest NERC Cyber Security Standards. The NERC officials provided  specific reasons as to why the 46 controls were not applicable to the bulk  power system, as illustrated by the following examples:
A control had the potential to increase risk to operations of bulk power  system entities.
A control was inappropriate and not feasible in a real-time control  system environment.
A control did not have universal applicability.
A control based on FISMA compliance did not apply to the bulk power  system environment.
Additionally, the NERC officials expressed their concerns about  comparing NERC Cyber Security Standards with those of SP 800-53.  They said that the authority and scope of their standards derived from  Section 215 of the Federal Power Act, as amended, while SP 800-53  derived from FISMA; therefore, the intended purpose of their standards is  different from that of the guidance for federal agencies. The officials also  said that the NERC Cyber Security Standards are mandatory and  enforceable, whereas SP 800-53 provides a menu of possibilities to  choose from depending on the specific situation and relies on the  concepts of compensating controls and risk management to make trade- offs.
Table 4 provides a summary of the comparison between the electricity  subsector guidance and federal guidance, including the controls deemed  not applicable by sector officials.
Examples of commonalities between the electricity subsector  cybersecurity guidance and federal guidance, as well as the controls  deemed not applicable, are described below.
Commonality: SP 800-53 recommends that personnel report suspected  security incidents to the organizational incident response capability and  report security incident information to designated authorities. The NERC  Cyber Security Standard on Incident Reporting and Response Planning  contains a similar control by requiring that the responsible entity report  cybersecurity incidents to the Electricity Sector Information Sharing and  Analysis Center.
Commonality: SP 800-53 recommends protecting the confidentiality of  transmitted information. NERC Security Guidelines for the Electricity  Sector, Protecting Potentially Sensitive Information, Version 1.0, contain a  similar control by specifying that, among other things, critical  infrastructure owners and operators should have an information security  or confidentiality policy in place as an integral part of their business-level  policies and that the policy should address the production, storage,  transmission, and disposal of both physical and electronic information.
Commonality: SP 800-53 recommends maintaining and monitoring  temperature and humidity levels within the facility where the information  system resides to prevent fluctuations potentially harmful to the  information system. The NERC officials stated that the physical  infrastructure requirements in the Emergency Preparedness and  Operations Reliability Standards require backup control center  functionality in the event of any kind of failure of the primary control  center.
Not applicable: SP 800-53 recommends implementing a session lock  control after a period of inactivity or upon receiving a request from a user.  According to the NERC officials, this control is not applicable and not  feasible in a real-time control system environment because session lock  on an operational console could result in a loss of system operations and  system monitoring, leading to a loss of present situational awareness.  The NERC officials also stated that a lack of situational awareness was a  key factor leading to the August 14, 2003, blackout.
Not applicable: SP 800-53 recommends employing virtualization  techniques to present information system components as other types of  components, or components with differing configurations. According to  the NERC officials, given the variety of technology and scale  implemented by their members, this control would not have universal  applicability.
Not applicable: SP 800-53 recommends separating duties of individuals  as necessary to prevent malevolent activity without collusion. According  to the NERC officials, the control is not applicable because it would have  the potential to increase risk to operations of bulk power system entities.  The NERC officials also stated that the electricity industry typically  maintains a practice of separation of duties between IT system  developers and support, but placing further separation of duties  requirements on operations personnel would result in decreased  operational responsiveness and reliability.
section_title: Depository Institutions (Banking and Finance Sector)
paragraphs: The FFIEC IT Examination Handbook (IT Handbook), which is composed  of 11 booklets, is substantially similar to guidance applicable to federal  agencies. Similar to the NIST risk management framework, the IT  Handbook addresses various information technology topics (e.g.,  information security, operations, and management). Specifically, the  Information Security Booklet is intended to provide guidance to examiners  and organizations for assessing the level of security risks to the  organization and evaluating the adequacy of the organization’s risk  management. In addition, this booklet states that financial institutions  protect their information by instituting a security process that identifies  risks, forms a strategy to manage the risks, implements the strategy, tests  the implementation, and monitors the environment to control the risks.
We determined that the IT Handbook addressed 196 of 198 SP 800-53  controls; the FFIEC officials deemed the remaining 2 controls to be not  applicable. Additionally, FFIEC officials responsible for cybersecurity- related issues and guidance expressed concerns about comparing  NIST guidelines with those of the IT Handbook. According to the FFIEC  officials, although the general purpose for both information resources is to  protect information security assets, the process by which they  communicate their intended purpose is different. Specifically, according to  these officials, while many NIST controls directly compare with those of  the IT Handbook, the target audiences are vastly different. The IT  Handbook provides a higher-level overview (i.e., risk-based principles)  detailing the controls and standards, while NIST describes specific  controls for a standard. Therefore, comparisons between the two sets of  guidance can best be accomplished by comparing information security  concepts and principles.
Table 5 provides a summary of the comparison between the banking and  finance sector cybersecurity guidance and federal guidance, including the  controls deemed not applicable by sector officials.
Examples of commonalities between the banking and finance sector  cybersecurity guidance and federal guidance, as well as the controls  deemed not applicable, are described below.
Commonality: SP 800-53 recommends implementing a session lock  control after a period of inactivity or upon receiving a request from a user.  The IT Handbook contains a similar control by specifying that controls  include automatically logging the workstation out after a period of  inactivity and heuristic intrusion detection.
Commonality: SP 800-53 recommends usage restrictions and  implementation guidance for wireless access. The IT Handbook contains  a similar control by specifying that financial institutions determine whether  appropriate device and session authentication takes place, particularly for  remote and wireless machines.
Not applicable: SP 800-53 recommends identifying specific user actions  that can be performed on the information system without identification or  authentication. According to the FFIEC officials, this control is not  applicable because it would be excessive and burdensome to identify  user actions within systems that do not require controls to protect  sensitive, classified, or nonpublic information. In addition, the Information  Security Booklet provides guidance as to how access should be given  (i.e., sufficient access required to perform the work to be done).
Not applicable: SP 800-53 recommends employing diverse information  technologies in the implementation of the information system to reduce  the impact of the exploitation of a specific technology. According to the  FFIEC officials, this control is not applicable because it could add  complexity and management overhead that could lead to mistakes and  misconfigurations that could increase overall risk.
section_title: Nuclear Reactors (Nuclear Reactors, Materials, and Waste Sector)
paragraphs: NRC Regulatory Guide 5.71, Cyber Security Programs for Nuclear  Facilities (RG 5.71) and supplementary documents are substantially  similar to guidance applicable to federal agencies. According to NRC  representatives responsible for NRC’s cybersecurity-related efforts, RG  5.71 sets forth methods that NRC has found acceptable for licensees to  use in complying with the requirements of 10 CFR §73.54. Similar to the  NIST risk management framework, these methods describe the activities  important to an effective cybersecurity program for nuclear power plants.  For example, RG 5.71 provides a method to aid in the categorization and  identification of digital assets that must be protected from cyber attacks. It  also provides a method to address and manage the potential  cybersecurity risks of digital assets by applying a defensive architecture  and a collection of security controls. Moreover, according to RG 5.71, it is  based on standards provided in NIST SP 800-53 and NIST SP 800-82,  among others.
Further, we determined that RG 5.71 and supplementary documents  addressed 178 of 198 SP 800-53 controls, and the NRC representatives  deemed the remaining 20 controls to be not applicable to their sector.  Although not exactly a one-to-one match, the security controls in RG 5.71  often closely resembled the language and terminology of security controls  found in SP 800-53. However, according to NRC, where applicable, the  security controls in RG 5.71 have been tailored for nuclear power plants  by leveraging NIST guidance in appendix I of SP 800-53 on tailoring  security controls for industrial control systems. The NRC representatives  provided specific reasons why the 20 controls were not applicable, as  illustrated by the following examples:
A control is not allowed because it would have a direct impact on the  operational integrity of safety functions at a nuclear power plant.
A control is not within the scope of NRC’s regulatory authority.
A control was not selected because it is not included in the NIST  security control baseline for industrial control systems in NIST SP  800-53, Revision 3, Appendix I.
Table 6 provides a summary of the comparison between the nuclear  sector cybersecurity guidance and federal guidance, including the  controls deemed not applicable by sector representatives.
Examples of commonalities between the nuclear sector cybersecurity  guidance and federal guidance, as well as the controls deemed not  applicable, are described below.
Commonality: SP 800-53 recommends basic security awareness  training to all information system users. RG 5.71 contains a similar control  by specifying that, among other things, the licensee or applicant establish,  implement, and document training requirements for training programs to  provide basic cybersecurity training for facility personnel.
Commonality: SP 800-53 recommends protection against supply chain  threats by employing defense-in-breadth strategy. RG 5.71 contains a  similar control by specifying that the licensee or applicant protect against  supply chain threats and vulnerabilities by employing the following  measures: establishing trusted distribution paths, validating vendors, and  requiring tamper-proof products or tamper-evident seals on acquired  products.
Commonality: SP 800-53 recommends enforcing a limit of consecutive  invalid access attempts by a user. RG 5.71 contains a similar control by  specifying that the licensee or applicant ensure that security controls are  implemented to limit the number of invalid access attempts by a user.
Not applicable: SP 800-53 recommends limiting the number of  concurrent sessions for each system account. According to the NRC  representatives, the concurrent session control is not applicable because  it was determined that implementation of this control presents a safety  risk to digital safety systems, or that systems under the scope of NRC  regulations cannot support concurrent session control.
Not applicable: SP 800-53 recommends protecting information systems  from damage resulting from water leakage by providing master shutoff  valves that are accessible to key personnel. According to the NRC  representatives, as a result of their tailoring process, the control was not  selected as part of the final security control baseline in RG 5.71 because  systems used at nuclear power plants are designed and built to maintain  the safe operation of the plant in the event of flooding. Additionally, plant  operators who are licensed by NRC are authorized to manipulate  components in the facilities to control their plants.
Not applicable: SP 800-53 recommends all capital planning and  investment requests include the resources needed to implement the  information security program and document all exceptions to this  requirement. According to the NRC representatives, this security control  is not necessary as licensees, by definition, must have the resources to  implement their cybersecurity programs.
section_title: Conclusions
paragraphs: A wide variety of cybersecurity guidance is available to owners and  operators of our nation’s cyber-reliant critical infrastructure. Both required  and voluntary guidance has been developed and issued by industry  regulators, associations, and other groups that is tailored to the business  needs of entities or provides methods to address unique risks or  operations. While entities operating in a federal regulatory environment  face enforcement mechanisms for not adhering to standards in regulatory  requirements, entities not subject to regulation do not face such  enforcement mechanisms, but implement such guidance to, among other  things, mitigate risks, maintain profits, and meet customer expectations.  In carrying out their responsibilities for coordinating efforts to protect the  cyber-critical infrastructure, DHS and the other sector-specific agencies  have taken steps to disseminate and promote cybersecurity guidance.  However, these agencies have not identified the guidance applicable to or  widely used in each of their respective critical infrastructure sectors. In  addition, most sectors reviewed had not specified available guidance in  their respective planning documents, in part because DHS’s planning  guidance did not suggest the inclusion of cybersecurity guidance. Given  the plethora of guidance available, individual entities within the sectors  may be challenged in identifying the guidance that is most applicable and  effective in improving their security posture. Greater knowledge of the  guidance that is available could help both federal and private sector  decision makers better coordinate their efforts to protect critical cyber- reliant assets. Finally, the sector-specific cybersecurity guidance that we  compared was substantially similar to guidance applicable to federal  agencies.
section_title: Recommendation for Executive Action
paragraphs: We recommend that the Secretary of Homeland Security, in collaboration  with the sector-specific agencies, sector coordinating councils, and the  owners and operators of cyber-reliant critical infrastructure for the  associated seven critical infrastructure sectors, determine whether it is  appropriate to have key cybersecurity guidance listed in sector plans or  annual plans and adjust planning guidance accordingly to suggest the  inclusion of such guidance in future plans.
section_title: Agency Comments and Our Evaluation
paragraphs: DHS provided written comments on a draft of our report (see app. III),  signed by DHS’s Director of Departmental GAO/OIG Liaison Office. In its  comments, DHS concurred with our recommendation and stated that the  department will initiate steps to implement it. In particular, DHS stated  that it will work with its public and private sector partners to determine  whether it is appropriate to have cybersecurity guidance drafted for each  sector. DHS also indicated that the National Cyber Security Division will  explore these issues with the cross-sector community.
NRC also provided written comments on a draft of our report (see app.  IV), signed by the Executive Director for Operations. NRC generally  agreed with the draft report.
DHS, NRC, the Department of Commerce, the Department of the  Treasury, EPA, FERC, FFIEC, and HHS, also provided technical  comments, which we incorporated, where appropriate. In addition, we  provided relevant sections of the draft report to private sector participants.  We received technical comments via e-mail from some, but not all, of  these parties and incorporated their comments, where appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees; the Secretaries of Commerce, Energy, Health  and Human Services, Homeland Security, and the Treasury;  Administrator, Environmental Protection Agency; Executive Director,  Federal Energy Regulatory Commission; Executive Secretary, Federal  Financial Institutions Council; Executive Director for Operations, Nuclear  Regulatory Commission; Director, Office of Management and Budget; and  other interested congressional and private sector parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact Gregory Wilshusen at (202) 512-6244, or by e-mail at  wilshuseng@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to identify (1) cybersecurity guidance for entities  within selected critical infrastructure sectors, (2) the extent to which  implementation of cybersecurity guidance is enforced and promoted  within selected sectors, and (3) areas of commonalities and differences  that exist between sectors’ cybersecurity guidance and guidance  applicable to federal agencies.
We focused our efforts on seven sectors: banking and finance;  communications; energy (electricity and oil and natural gas); health care  and public health; information technology; nuclear reactors, materials,  and waste; and water. We selected these seven sectors because they are  cyber-reliant or have a pervasive impact on the public’s health and  welfare. This determination was based on our analysis of the critical  infrastructure sectors and interviews with agency officials and  representatives from the sector coordinating councils. Our findings and  conclusions are based on information gathered from the seven critical  infrastructure sectors and are not generalizable to a larger population.
To identify cybersecurity guidance for entities within the critical  infrastructure sectors, we identified and analyzed cybersecurity standards  and guidance developed by federal and international standards  development communities; cybersecurity policies and requirements  developed by regulators for their industry; and specific industry standards,  guidance, and practices developed by industry associations or groups.  We interviewed sector coordinating council representatives for the seven  critical infrastructure sectors to determine the cybersecurity standards  used in their specific areas. On the basis of the information gathered, we  developed lists of cybersecurity guidance for each sector. We provided  those lists to representatives from the respective sector coordinating  councils to confirm and update and to verify the applicability of the  identified guidance to entities within their respective sectors.
To identify the extent to which cybersecurity guidance is enforced within  the selected sectors, we gathered and analyzed related GAO reports,  federal laws, regulations, and regulatory guidance to determine the  various types of enforcement mechanisms that can be employed to  ensure compliance. In addition, we interviewed representatives from  regulatory entities: the Federal Energy Regulatory Commission, the  Federal Financial Institutions Examination Council, the Nuclear  Regulatory Commission, the North American Electric Reliability  Corporation, and the Department of Health and Human Service’s Office  for Civil Rights. We also interviewed representatives from the sector  coordinating councils to identify which critical infrastructure sectors have  mandatory and enforceable cybersecurity guidance. To determine efforts  to identify and promote cybersecurity guidance, we collected and  analyzed related federal law and policy to determine the responsibilities of  the Department of Homeland Security (DHS) and the other sector-specific  agencies for the seven selected sectors. In addition, we collected and  analyzed the most current approved sector-specific plans, annual reports,  and other related documents for the seven sectors reviewed to determine  the extent of cybersecurity guidance included in the plans. Further, to  determine DHS and sector-specific agency efforts related to cybersecurity  standards, we interviewed sector-specific agency representatives for the  seven critical infrastructure sectors to understand their programs and  efforts in promoting the use of cybersecurity standards, and then  collected and analyzed related supporting evidence.
To identify areas of commonalities and differences that exist between  sectors’ cybersecurity guidance and guidance applicable to federal  agencies, we selected, analyzed, and used National Institute of  Standards and Technology (NIST) Special Publication 800-37, Revision  1: Guide for Applying the Risk Management Framework to Federal  Information Systems, A Security Life Cycle Approach (February 2010),  and NIST Special Publication 800-53, Revision 3: Recommended  Security Controls for Federal Information Systems and Organizations  (May 2010). On the basis of our analysis of these NIST documents, we  identified key elements of managing cyber risk and 198 recommended  security controls. To select the sector guidance to compare with guidance  applicable to federal agencies, we judgmentally selected three subsectors  from three different regulated sectors: the banking and finance (financial  depositories); nuclear reactors, materials, and waste (reactors); and  energy (bulk power) sectors. For each subsector, sector representatives  identified the respective set of guidance as being widely used by entities  in the sectors to meet cybersecurity-related regulatory requirements. We  compared the sector cybersecurity guidance with NIST’s risk  management elements and recommended security controls. After our  initial comparison, we interviewed relevant representatives from the  regulatory entities and gathered and analyzed supplemental  documentation.
We conducted this performance audit from October 2010 to December  2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Cybersecurity Guidance Applicable within Critical Infrastructure Sectors
paragraphs: This appendix contains tables listing cybersecurity guidance identified as  applicable to entities within the seven critical infrastructure sectors:  banking and finance; communications; energy (electricity and oil and  natural gas); health care and public health; information technology;  nuclear reactors, materials, and waste; and water. These lists should not  be considered to include all cybersecurity guidance that may be available  or used within the sector and include cybersecurity guidance that has  been withdrawn by the publisher. Sector coordinating council  representatives for each of the seven critical infrastructure sectors  confirmed and provided additional examples, when appropriate, of the   See  cybersecurity guidance applicable to entities within their sectors.tables 7 through 13 for the specified guidance.
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: Comments from the Nuclear Regulatory Commission
section_title: Appendix V: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
paragraphs: Gregory C. Wilshusen, (202) 512-6244 or wilshuseng@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Michael W. Gilmore (Assistant  Director), Lon C. Chin, Wilfred B. Holloway, Franklin D. Jackson, Barbarol  J. James, Lee McCracken, Krzysztof Pasternak, and John A. Spence  made key contributions to this report.