Information Security: Cyber Threats and Data Breaches Illustrate Need for Stronger Controls across Federal Agencies
Published: 2015-07-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Effective cybersecurity for federal information systems is essential to preventing the loss of resources, the compromise of sensitive information, and the disruption of government operations. Since 1997, GAO has designated federal information security as a government-wide high-risk area, and in 2003 expanded this area to include computerized systems supporting the nation's critical infrastructure. Earlier this year, in GAO's high-risk update, the area was further expanded to include protecting the privacy of personal information that is collected, maintained, and shared by both federal and nonfederal entities.
This statement summarizes (1) cyber threats to federal systems, (2) challenges facing federal agencies in securing their systems and information, and (3) government-wide initiatives aimed at improving cybersecurity. In preparing this statement, GAO relied on its previously published and ongoing work in this area.
section_title: What GAO Found
paragraphs: Federal systems face an evolving array of cyber-based threats. These threats can be unintentional—for example, from equipment failure or careless or poorly trained employees; or intentional—targeted or untargeted attacks from criminals, hackers, adversarial nations, or terrorists, among others. Threat actors use a variety of attack techniques that can adversely affect federal information, computers, software, networks, or operations, potentially resulting in the disclosure, alteration, or loss of sensitive information; destruction or disruption of critical systems; or damage to economic and national security. These concerns are further highlighted by recent incidents involving breaches of sensitive data and the sharp increase in information security incidents reported by federal agencies over the last several years, which have risen from 5,503 in fiscal year 2006 to 67,168 in fiscal year 2014.
GAO has identified a number of challenges federal agencies face in addressing threats to their cybersecurity. For example, agencies have been challenged with designing and implementing risk-based cybersecurity programs, as illustrated by 19 of 24 major agencies declaring cybersecurity as a significant deficiency or material weakness for financial reporting purposes. Other challenges include:
enhancing oversight of contractors providing IT services,
improving security incident response activities,
responding to breaches of personal information, and
implementing cybersecurity programs at small agencies.
Until federal agencies take actions to address these challenges—including implementing the hundreds of recommendations GAO and agency inspectors general have made—federal systems and information will be at an increased risk of compromise from cyber-based attacks and other threats.
Several government-wide initiatives are under way to bolster cybersecurity.
Personal Identity Verification: The President and the Office of Management and Budget (OMB) directed agencies to issue credentials with enhanced security features to control access to federal facilities and systems. OMB recently reported that only 41 percent of user accounts at 23 civilian agencies had required these credentials to access agency systems.
Continuous Diagnostics and Mitigation: This program is to provide agencies with tools for continuously monitoring cybersecurity risks. The Department of State adopted a continuous monitoring program, and GAO reported on the benefits and challenges in implementing the program.
National Cybersecurity Protection System: This system is to provide capabilities for monitoring network traffic and detecting and preventing intrusions. GAO has ongoing work reviewing the system's implementation. Preliminary observations indicate that implementation of the intrusion detection and prevention capabilities may be limited and requirements for future capabilities appear to have not been fully defined.
While these initiatives are intended to improve security, no single technology or tool is sufficient to protect against all cyber threats. Rather, agencies need to employ a multi-layered approach to security that includes well-trained personnel, effective and consistently applied processes, and appropriate technologies.
section_title: What GAO Recommends
paragraphs: In previous work, GAO and agency inspectors general have made hundreds of recommendations to assist agencies in addressing cybersecurity challenges. GAO has also made recommendations to improve government-wide initiatives.

section_title: Letter
paragraphs: Thank you for inviting me to testify at today’s hearing on data breaches at  the Office of Personnel Management (OPM) and cybersecurity challenges  faced by federal agencies. As you know, the federal government faces an  array of cyber-based threats to its systems and data, as illustrated by the  recently reported data breaches at OPM, which affected millions of  current and former federal employees. Such incidents underscore the  urgent need for effective implementation of information security controls  at federal agencies.
Since 1997, we have designated federal information security as a  government-wide high-risk area, and in 2003 expanded this area to  include computerized systems supporting the nation’s critical  infrastructure. Most recently, in the February 2015 update to our high-risk  list, we further expanded this area to include protecting the privacy of  personally identifiable information (PII)—that is, personal information that  is collected, maintained, and shared by both federal and nonfederal  entities.
My statement today will discuss (1) cyber threats facing federal systems,  (2) challenges that federal agencies face in securing their systems and  information, and (3) government-wide initiatives aimed at improving  agencies’ cybersecurity. In preparing this statement, we relied on our  previous work in these areas, as well as the preliminary observations  from our ongoing review of the Department of Homeland Security’s (DHS)  National Cybersecurity Protection System (NCPS) initiative. We  discussed these observations with DHS officials. The prior reports cited  throughout this statement contain detailed discussions of the scope of the  work and the methodology used to carry it out. All the work on which this  statement is based was conducted or is being conducted in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform audits to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
subsections: section_title: Background
paragraphs: As computer technology has advanced, both government and private  entities have become increasingly dependent on computerized  information systems to carry out operations and to process, maintain, and  report essential information. Public and private organizations rely on  computer systems to transmit proprietary and other sensitive information,  develop and maintain intellectual capital, conduct operations, process  business transactions, transfer funds, and deliver services. In addition,  the Internet has grown increasingly important to American businesses  and consumers, serving as a medium for hundreds of billions of dollars of  commerce each year, and has developed into an extended information  and communications infrastructure that supports vital services such as  power distribution, health care, law enforcement, and national defense.
Ineffective protection of these information systems and networks can  result in a failure to deliver these vital services, and result in  loss or theft of computer resources, assets, and funds;  inappropriate access to and disclosure, modification, or destruction of  sensitive information, such as national security information, PII, and  proprietary business information; disruption of essential operations supporting critical infrastructure,  national defense, or emergency services; undermining of agency missions due to embarrassing incidents that  erode the public’s confidence in government; use of computer resources for unauthorized purposes or to launch  attacks on other systems; damage to networks and equipment; and high costs for remediation.
Recognizing the importance of these issues, Congress enacted laws  intended to improve the protection of federal information and systems.
These laws include the Federal Information Security Modernization Act of  2014 (FISMA), which, among other things, authorizes DHS to (1) assist  the Office of Management and Budget (OMB) with overseeing and  monitoring agencies’ implementation of security requirements; (2) operate  the federal information security incident center; and (3) provide agencies  with operational and technical assistance, such as that for continuously  diagnosing and mitigating cyber threats and vulnerabilities. The act also  reiterated the 2002 FISMA requirement for the head of each agency to  provide information security protections commensurate with the risk and  magnitude of the harm resulting from unauthorized access, use,  disclosure, disruption, modification, or destruction of the agency’s  information or information systems.
In addition, the act continues the requirement for federal agencies to  develop, document, and implement an agency-wide information security  program. The program is to provide security for the information and  information systems that support the operations and assets of the  agency, including those provided or managed by another agency,  contractor, or other source.
section_title: The Federal Government Faces an Evolving Array of Cyber-Based Threats
paragraphs: Risks to cyber-based assets can originate from unintentional or  intentional threats. Unintentional threats can be caused by, among other  things, natural disasters, defective computer or network equipment, and  careless or poorly trained employees. Intentional threats include both  targeted and untargeted attacks from a variety of sources, including  criminal groups, hackers, disgruntled employees, foreign nations engaged  in espionage and information warfare, and terrorists.
These adversaries vary in terms of their capabilities, willingness to act,  and motives, which can include seeking monetary gain or a political,  economic, or military advantage. For example, adversaries possessing  sophisticated levels of expertise and significant resources to pursue their  objectives—sometimes referred to as “advanced persistent threats”— pose increasing risks. Table 1 describes common cyber adversaries.
These adversaries make use of various techniques— or exploits—that  may adversely affect federal information, computers, software, networks,  and operations. Table 2 describes common types of cyber exploits.
An adversary may employ multiple tactics, techniques, and exploits to  conduct a cyber attack. The National Institute of Standards and  Technology (NIST) has identified several representative events that may  constitute a cyber attack:
Perform reconnaissance and gather information: An adversary  may gather information on a target by, for example, scanning its  network perimeters or using publicly available information.
Craft or create attack tools: An adversary prepares its means of  attack by, for example, crafting a phishing attack or creating a  counterfeit (“spoof”) website.
Deliver, insert, or install malicious capabilities: An adversary can  use common delivery mechanisms, such as e-mail or downloadable  software, to insert or install malware into its target’s systems.
Exploit and compromise: An adversary may exploit poorly  configured, unauthorized, or otherwise vulnerable information systems  to gain access.
Conduct an attack: Attacks can include efforts to intercept  information or disrupt operations (e.g., denial of service or physical  attacks).
Achieve results: Desired results include obtaining sensitive  information via network “sniffing” or exfiltration, causing degradation  or destruction of the target’s capabilities; damaging the integrity of  information through creating, deleting, or modifying data; or causing  unauthorized disclosure of sensitive information.
Maintain a presence or set of capabilities: An adversary may try to  maintain an undetected presence on its target’s systems by inhibiting  the effectiveness of intrusion-detection capabilities or adapting  behavior in response to the organization’s surveillance and security  measures.
More generally, the nature of cyber-based attacks can vastly enhance  their reach and impact. For example, cyber attacks do not require  physical proximity to their victims, can be carried out at high speeds and  directed at multiple victims simultaneously, and can more easily allow  attackers to remain anonymous. These inherent advantages, combined  with the increasing sophistication of cyber tools and techniques, allow  threat actors to target government agencies and their contractors,  potentially resulting in the disclosure, alteration, or loss of sensitive  information, including PII; theft of intellectual property; destruction or  disruption of critical systems; and damage to economic and national  security.
Since fiscal year 2006, the number of information security incidents  affecting systems supporting the federal government has steadily  increased each year: rising from 5,503 in fiscal year 2006 to 67,168 in  fiscal year 2014, an increase of 1,121 percent. (See fig. 1.)
Furthermore, the number of reported security incidents involving PII at  federal agencies has more than doubled in recent years—from 10,481  incidents in fiscal year 2009 to 27,624 incidents in fiscal year 2014.
Figure 2 shows the different types of incidents reported in fiscal year  2014.
These incidents and others like them can adversely affect national  security; damage public health and safety; and lead to inappropriate  access to and disclosure, modification, or destruction of sensitive  information. Recent examples highlight the impact of such incidents:  In June 2015, OPM reported that an intrusion into its systems affected  personnel records of about 4 million current and former federal  employees. The Director of OPM also stated that a separate incident  may have compromised OPM systems related to background  investigations, but its scope and impact have not yet been  determined.
In June 2015, the Commissioner of the Internal Revenue Service  (IRS) testified that unauthorized third parties had gained access to  taxpayer information from its “Get Transcript” application. According to  IRS, criminals used taxpayer-specific data acquired from non-IRS  sources to gain unauthorized access to information on approximately  100,000 tax accounts. These data included Social Security  information, dates of birth, and street addresses.
In April 2015, the Department of Veterans Affairs (VA) Office of  Inspector General reported that two VA contractors had improperly  accessed the VA network from foreign countries using personally  owned equipment.
In February 2015, the Director of National Intelligence stated that  unauthorized computer intrusions were detected in 2014 on OPM’s  networks and those of two of its contractors. The two contractors were  involved in processing sensitive PII related to national security  clearances for federal employees.
In September 2014, a cyber-intrusion into the United States Postal  Service’s information systems may have compromised PII for more  than 800,000 of its employees.
section_title: Federal Agencies Face Ongoing Cybersecurity Challenges
paragraphs: Given the risks posed by cyber threats and the increasing number of  incidents, it is crucial that federal agencies take appropriate steps to  secure their systems and information. We and agency inspectors general  have identified challenges in protecting federal information and systems,  including those in the following key areas:
Designing and implementing risk-based cybersecurity programs  at federal agencies. Agencies continue to have shortcomings in  assessing risks, developing and implementing security controls, and  monitoring results. Specifically, for fiscal year 2014, 19 of the 24  federal agencies covered by the Chief Financial Officers (CFO) Actreported that information security control deficiencies were either a  material weakness or a significant deficiency in internal controls over   Moreover, inspectors general at 23 of the 24  their financial reporting.agencies cited information security as a major management challenge  for their agency.
As we testified in April 2015, for fiscal year 2014, most of the agencies  had weaknesses in the five key security control categories. These  control categories are (1) limiting, preventing, and detecting  inappropriate access to computer resources; (2) managing the  configuration of software and hardware; (3) segregating duties to  ensure that a single individual does not have control over all key  aspects of a computer-related operation; (4) planning for continuity of  operations in the event of a disaster or disruption; and (5)  implementing agency-wide security management programs that are  critical to identifying control deficiencies, resolving problems, and  managing risks on an ongoing basis. (See fig. 3.)
Examples of these weaknesses include: (1) granting users access  permissions that exceed the level required to perform their legitimate  job-related functions; (2) not ensuring that only authorized users can  access an agency’s systems; (3) not using encryption to protect  sensitive data from being intercepted and compromised; (4) not  updating software with the current versions and latest security  patches to protect against known vulnerabilities; and (5) not ensuring  employees were trained commensurate with their responsibilities. We  and agency inspectors general have made hundreds of  recommendations to agencies aimed at improving their  implementation of these information security controls.
Enhancing oversight of contractors providing IT services. In  August 2014, we reported that five of six agencies we reviewed were  inconsistent in overseeing assessments of contractors’  implementation of security controls. This was partly because  agencies had not documented IT security procedures for effectively  overseeing contractor performance. In addition, according to OMB, 16  of 24 agency inspectors general determined that their agency’s  program for managing contractor systems lacked at least one required  element. We recommended that the reviewed agencies establish and  implement IT security oversight procedures for such systems. The  agencies generally concurred with our recommendations. We also  made one recommendation to OPM and the agency concurred, but  has not yet implemented this recommendation.
Improving security incident response activities. In April 2014, we  reported that the 24 agencies did not consistently demonstrate that  they had effectively responded to cyber incidents. Specifically, we  estimated that agencies had not completely documented actions  taken in response to detected incidents reported in fiscal year 2012 in  about 65 percent of cases. In addition, the 6 agencies we reviewed  had not fully developed comprehensive policies, plans, and  procedures to guide their incident response activities. We  recommended that OMB address agency incident response practices  government-wide and that the 6 agencies improve the effectiveness of  their cyber incident response programs. The agencies generally  agreed with these recommendations.
Responding to breaches of PII. In December 2013, we reported that  eight federal agencies had inconsistently implemented policies and  procedures for responding to data breaches involving PII. In  addition, OMB requirements for reporting PII-related data breaches  were not always feasible or necessary. Thus, we concluded that  agencies may not be consistently taking actions to limit the risk to  individuals from PII-related data breaches and may be expending  resources to meet OMB reporting requirements that provide little  value. We recommended that OMB revise its guidance to agencies on  responding to a PII-related data breach and that the reviewed  agencies take specific actions to improve their response to PII-related  data breaches. OMB neither agreed nor disagreed with our  recommendation; four of the reviewed agencies agreed, two partially  agreed, and two neither agreed nor disagreed.
Implementing security programs at small agencies. In June 2014,  we reported that six small agencies (i.e., agencies with 6,000 or fewer  employees) had not implemented or not fully implemented their  information security programs. For example, key elements of their  plans, policies, and procedures were outdated, incomplete, or did not  exist, and two of the agencies had not developed an information  security program with the required elements. We recommended that  OMB include a list of agencies that did not report on the  implementation of their information security programs in its annual  report to Congress on compliance with the requirements of FISMA,  and include information on small agencies’ programs. OMB generally  concurred with our recommendations. We also recommended that  DHS develop guidance and services targeted at small agencies. DHS  agreed and has implemented this recommendation.
Until federal agencies take actions to address these challenges— including implementing the hundreds of recommendations we and  inspectors general have made—federal systems and information will be  at an increased risk of compromise from cyber-based attacks and other  threats.
section_title: Government-wide Cybersecurity Initiatives Present Potential Benefits and Challenges
paragraphs: In addition to the efforts of individual agencies, DHS and OMB have  several initiatives under way to enhance cybersecurity across the federal  government. While these initiatives all have potential benefits, they also  have limitations.
Personal Identity Verification: In August 2004, Homeland Security  Presidential Directive 12 ordered the establishment of a mandatory,  government-wide standard for secure and reliable forms of identification  for federal government employees and contractor personnel who access  government-controlled facilities and information systems. Subsequently,  NIST defined requirements for such personal identity verification (PIV)  credentials based on “smart cards”—plastic cards with integrated circuit  chips to store and process data—and OMB directed federal agencies to  issue and use PIV credentials to control access to federal facilities and  systems.
In September 2011, we reported that OMB and the eight agencies in our  review had made mixed progress for using PIV credentials for controlling  access to federal facilities and information systems.mixed progress to a number of obstacles, including logistical problems in  issuing PIV credentials to all agency personnel and agencies not making  this effort a priority. We made several recommendations to the eight  agencies and to OMB to more fully implement PIV card capabilities.  Although two agencies did not comment, seven agencies agreed with our  recommendations or discussed actions they were taking to address them.  For example, we made four recommendations to DHS. The department  concurred and has taken action to implement them.
In February 2015, OMB reported that, as of the end of fiscal year 2014,  only 41 percent of agency user accounts at the 23 civilian CFO Act  agencies required PIV cards for accessing agency systems. only 1 percent of user accounts required PIV cards for such access.
Continuous Diagnostics and Mitigation (CDM): According to DHS, this  program is intended to provide federal departments and agencies with  capabilities and tools that identify cybersecurity risks on an ongoing basis,  prioritize these risks based on potential impacts, and enable cybersecurity  personnel to mitigate the most significant problems first. These tools  include sensors that perform automated searches for known cyber  vulnerabilities, the results of which feed into a dashboard that alerts  network managers. These alerts can be prioritized, enabling agencies to  allocate resources based on risk. DHS, in partnership with the General  Services Administration, has established a government-wide contract that  is intended to allow federal agencies (as well as state, local, and tribal  governmental agencies) to acquire CDM tools at discounted rates.
OMB, Annual Report to Congress: Federal Information Security Management Act  (Washington, D.C.: Feb. 27, 2015). visibility over information security at the department and helped IT  administrators identify, monitor, and mitigate information security  weaknesses. However, we also noted limitations and challenges with  State’s approach, including ensuring that its risk-scoring program  identified relevant risks and that iPost data were timely, complete, and  accurate. We made several recommendations to improve the  implementation of the iPost program, and State partially agreed.
National Cybersecurity Protection System (NCPS): The National  Cybersecurity Protection System, operationally known as “EINSTEIN,” is  a suite of capabilities intended to detect and prevent malicious network  traffic from entering and exiting federal civilian government networks. The  EINSTEIN capabilities of NCPS are described in table 3.
In March 2010, we reported that while agencies that participated in  EINSTEIN 1 improved their identification of incidents and mitigation of  attacks, DHS lacked performance measures to understand if the initiative  was meeting its objectives.the management of the EINSTEIN program, and DHS has since taken  action to address them.
We made four recommendations regarding  Currently, we are reviewing NCPS in response to provisions of the  Senate and House reports accompanying the Consolidated  Appropriations Act, 2014. The objectives of our review are to determine  the extent to which (1) NCPS meets stated objectives, (2) DHS has  designed requirements for future stages of the system, and (3) federal  agencies have adopted the system.
Our final report is expected to be released later this year, and our  preliminary observations include the following:
DHS appears to have developed and deployed aspects of the  intrusion detection and intrusion prevention capabilities, but potential  weaknesses may limit their ability to detect and prevent computer  intrusions. For example, NCPS detects signature anomalies using  only one of three detection methodologies identified by NIST:  signature-based, anomaly-based, and stateful protocol analysis.  Further, the system has the ability to prevent intrusions, but is  currently only able to proactively mitigate threats across a limited  subset of network traffic (i.e., Domain Name System traffic and e- mail).
DHS has identified a set of NCPS capabilities that are planned to be  implemented in fiscal year 2016, but it does not appear to have  developed formalized requirements for capabilities planned through  fiscal year 2018.
The NCPS intrusion detection capability appears to have been  implemented at 23 CFO Act agencies.capability appears to have limited deployment at portions of only 5 of  these agencies. Deployment may have been hampered by various  implementation and policy challenges.
In conclusion, the danger posed by the wide array of cyber threats facing  the nation is heightened by weaknesses in the federal government’s  approach to protecting its systems and information. While recent  government-wide initiatives hold promise for bolstering the federal  cybersecurity posture, it is important to note that no single technology or  set of practices is sufficient to protect against all these threats. A “defense  in depth” strategy is required that includes well-trained personnel,  effective and consistently applied processes, and appropriately  implemented technologies. While agencies have elements of such a  strategy in place, more needs to be done to fully implement it and to  address existing weaknesses. In particular, implementing GAO and  inspector general recommendations will strengthen agencies’ ability to  protect their systems and information, reducing the risk of a potentially  devastating cyber attack.
Chairwoman Comstock, Chairman Loudermilk, Ranking Members Lipinski  and Beyer, and Members of the Subcommittees, this concludes my  statement. I would be happy to answer your questions.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions about this statement, please contact Gregory  C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other staff  members who contributed to this statement include Larry Crosland and  Michael Gilmore (assistant directors), Bradley Becker, Christopher  Businsky, Nancy Glover, Rosanna Guerrero, Kush Malhotra, and Lee  McCracken.
section_title: Related GAO Products
paragraphs: Cybersecurity: Recent Data Breaches Illustrate Need for Strong Controls  across Federal Agencies. GAO-15-725T. June, 24, 2015.
Cybersecurity: Actions Needed to Address Challenges Facing Federal  Systems. GAO-15-573T. April 22, 2015.
Information Security: IRS Needs to Continue Improving Controls over  Financial and Taxpayer Data. GAO-15-337. March 19, 2015.
Information Security: FAA Needs to Address Weaknesses in Air Traffic  Control Systems. GAO-15-221. January 29, 2015.
Information Security: Additional Actions Needed to Address  Vulnerabilities That Put VA Data at Risk. GAO-15-220T.   November 18, 2014.
Information Security: VA Needs to Address Identified Vulnerabilities.  GAO-15-117. November 13, 2014.
Federal Facility Cybersecurity: DHS and GSA Should Address Cyber Risk  to Building and Access Control Systems. GAO-15-6. December 12, 2014.
Consumer Financial Protection Bureau: Some Privacy and Security  Procedures for Data Collections Should Continue Being Enhanced.   GAO-14-758. September 22, 2014.
Healthcare.Gov: Information Security and Privacy Controls Should Be  Enhanced to Address Weaknesses. GAO-14-871T. September 18, 2014.
Healthcare.Gov: Actions Needed to Address Weaknesses in Information  Security and Privacy Controls. GAO-14-730. September 16, 2014.
Information Security: Agencies Need to Improve Oversight of Contractor  Controls. GAO-14-612. August 8, 2014.
Information Security: FDIC Made Progress in Securing Key Financial  Systems, but Weaknesses Remain. GAO-14-674. July 17, 2014.
Information Security: Additional Oversight Needed to Improve Programs  at Small Agencies. GAO-14-344. June 25, 2014.
Maritime Critical Infrastructure Protection: DHS Needs to Better Address  Port Cybersecurity. GAO-14-459. June 5, 2014.
Information Security: Agencies Need to Improve Cyber Incident  Response Practices. GAO-14-354. April 30, 2014.
Information Security: SEC Needs to Improve Controls over Financial  Systems and Data. GAO-14-419. April 17, 2014.
Information Security: IRS Needs to Address Control Weaknesses That  Place Financial and Taxpayer Data at Risk. GAO-14-405. April 8, 2014.
Information Security: Federal Agencies Need to Enhance Responses to  Data Breaches. GAO-14-487T. April 2, 2014.
Critical Infrastructure Protection: Observations on Key Factors in DHS’s  Implementation of Its Partnership Model. GAO-14-464T. March 26, 2014.
Information Security: VA Needs to Address Long-Standing Challenges.  GAO-14-469T. March 25, 2014.
Critical Infrastructure Protection: More Comprehensive Planning Would  Enhance the Cybersecurity of Public Safety Entities’ Emerging  Technology. GAO-14-125. January 28, 2014.
Computer Matching Act: OMB and Selected Agencies Need to Ensure  Consistent Implementation. GAO-14-44. January 13, 2014.
Information Security: Agency Responses to Breaches of Personally  Identifiable Information Need to Be More Consistent. GAO-14-34.  December 9, 2013.
Federal Information Security: Mixed Progress in Implementing Program  Components; Improved Metrics Needed to Measure Effectiveness.   GAO-13-776. September 26, 2013.
Communications Networks: Outcome-Based Measures Would Assist  DHS in Assessing Effectiveness of Cybersecurity Efforts. GAO-13-275.  April 10, 2013.
Information Security: IRS Has Improved Controls but Needs to Resolve  Weaknesses. GAO-13-350. March 15, 2013.
Cybersecurity: A Better Defined and Implemented National Strategy is  Needed to Address Persistent Challenges. GAO-13-462T. March 7, 2013.
Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be  Better Defined and More Effectively Implemented. GAO-13-187. February  14, 2013.
Information Security: Federal Communications Commission Needs to  Strengthen Controls over Enhanced Secured Network Project.   GAO-13-155. January 25, 2013.
Information Security: Actions Needed by Census Bureau to Address  Weaknesses. GAO-13-63. January 22, 2013.
Information Security: Better Implementation of Controls for Mobile  Devices Should Be Encouraged. GAO-12-757. September 18, 2012.
Mobile Device Location Data: Additional Federal Actions Could Help  Protect Consumer Privacy. GAO-12-903. September 11, 2012.
Medical Devices: FDA Should Expand Its Consideration of Information  Security for Certain Types of Devices. GAO-12-816. August 31, 2012.
Privacy: Federal Law Should Be Updated to Address Changing  Technology Landscape. GAO-12-961T. July 31, 2012.
Information Security: Environmental Protection Agency Needs to Resolve  Weaknesses. GAO-12-696. July 19, 2012.
Cybersecurity: Challenges in Securing the Electricity Grid. GAO-12-926T.  July 17, 2012.
Electronic Warfare: DOD Actions Needed to Strengthen Management and  Oversight. GAO-12-479. July 9, 2012.
Information Security: Cyber Threats Facilitate Ability to Commit Economic  Espionage. GAO-12-876T. June 28, 2012.
Prescription Drug Data: HHS Has Issued Health Privacy and Security  Regulations but Needs to Improve Guidance and Oversight. GAO-12-605.  June 22, 2012.
Cybersecurity: Threats Impacting the Nation. GAO-12-666T.   April 24, 2012.
Management Report: Improvements Needed in SEC’s Internal Control  and Accounting Procedure. GAO-12-424R. April 13, 2012.
IT Supply Chain: National Security-Related Agencies Need to Better  Address Risks. GAO-12-361. March 23, 2012.
Information Security: IRS Needs to Further Enhance Internal Control over  Financial Reporting and Taxpayer Data. GAO-12-393. March 16, 2012.
Cybersecurity: Challenges in Securing the Modernized Electricity Grid.  GAO-12-507T. February 28, 2012.
Critical Infrastructure Protection: Cybersecurity Guidance is Available, but  More Can Be Done to Promote Its Use. GAO-12-92. December 9, 2011.
Cybersecurity Human Capital: Initiatives Need Better Planning and  Coordination. GAO-12-8. November 29, 2011.
Information Security: Additional Guidance Needed to Address Cloud  Computing Concerns. GAO-12-130T. October 6, 2011.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.