Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority
Released: 2016-09-15T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Federal agencies face an ever-increasing array of cyber threats to their information systems and information. To address these threats, FISMA 2014 requires agencies to designate a CISO—a key position in agency efforts to manage information security risks.

GAO was asked to review current CISO authorities. This report identifies (1) the key responsibilities of federal CISOs established by federal law and guidance and the extent to which federal agencies have defined the role of the CISO in accordance with law and guidance and (2) key challenges of federal CISOs in fulfilling their responsibilities. GAO reviewed agency security policies, administered a survey to 24 CISOs, interviewed current CISOs, and spoke with officials from OMB.

section_title: What GAO Found
paragraphs: Under the Federal Information Security Modernization Act of 2014 (FISMA 2014), the agency chief information security officer (CISO) has the responsibility to ensure that the agency is meeting the requirements of the law, including developing, documenting, and implementing the agency-wide information security program. However, 13 of the 24 agencies GAO reviewed had not fully defined the role of their CISO in accordance with these requirements. For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place. Thus, CISOs' ability to effectively oversee these agencies' information security activities can be limited.

The 24 CISOs GAO surveyed identified challenges that limited their authority to carry out their responsibilities to oversee information security activities. These challenges can impact agencies' ability to effectively manage information security risk. The table below shows the factors that CISOs reported as being the most challenging to their authority.

The 24 CISOs also reported that other factors posed challenges to their abilities to carry out their responsibilities effectively, including difficulties related to having sufficient staff; recruiting, hiring, and retaining security personnel; ensuring that security personnel have appropriate expertise and skills; and a lack of sufficient financial resources. Several government-wide activities are under way to address many of these challenges. However, while the Office of Management and Budget (OMB) has a statutory responsibility under FISMA 2014 to provide guidance on information security in federal agencies, it has not issued such guidance addressing how agencies should ensure that officials carry out their responsibilities and personnel are held accountable for complying with the agency-wide information security program. As a result, agencies lack clarity on how to ensure that their CISOs have adequate authority to effectively carry out their duties in the face of numerous challenges.

section_title: What GAO Recommends
paragraphs: GAO is making 33 recommendations to 13 agencies to fully define the role of their CISOs in accordance with FISMA 2014. Twelve of the 13 agencies concurred with the recommendations addressed to them. One agency partially concurred or did not concur with the recommendations directed to it. GAO continues to believe that these recommendations are valid and should be implemented as discussed in this report. GAO also recommends that OMB issue guidance for clarifying CISOs' roles in light of identified challenges. OMB partially concurred with the recommendation. GAO maintains that action is needed as discussed further in the report.

section_title: Letter
paragraphs: The widespread use of the Internet has changed the way that our  government, our nation, and the rest of the world communicate and  conduct business. While the benefits have been enormous, this  connectivity—without effective cybersecurity—can also pose significant  risks to computer systems and networks as well as to the critical  operations and key infrastructures they support. Resources may be lost,  information—including sensitive personal information—may be  compromised, and the operations of government and critical  infrastructures could be disrupted, with potentially catastrophic effects.  Accordingly, since 1997, we have designated information security as a  government-wide high-risk area. In 2003, we expanded this high-risk  area to include computerized systems supporting our nation’s critical  infrastructure. In our 2015 High-Risk update, we further expanded this  area to include protecting the privacy of personally identifiable information  (PII).

To address these challenges in the federal government, the Federal  Information Security Management Act of 2002 (FISMA 2002), and its  successor, the Federal Information Security Modernization Act of 2014  (FISMA 2014), require each agency in the executive branch to develop,  document, and implement an information security program to provide  information security for the information and information systems that  support the operations and assets of the agency, including those provided  or managed by another agency, contractor, or other source.  Nonetheless, our work and reviews by inspectors general have shown  that federal agencies continue to have weaknesses in information security  controls that place critical information and information systems used to  support the operations, assets, and personnel of federal agencies at risk.

FISMA directs agency heads to delegate authority to ensure compliance  with the law to agency chief information officers (CIO), who in turn are  required to designate a senior agency information security officer to carry  out the CIO’s responsibilities. These officials are generally referred to as  chief information security officers (CISO).

Recognizing the importance of the CISO position in addressing the  information security risks facing the federal government, you asked us to  conduct a government-wide review of CISO authorities. Our objectives  were to (1) identify the key responsibilities of federal CISOs established  by federal law and guidance and determine the extent to which federal  agencies have defined the role of the CISO in accordance with this law  and guidance; and (2) describe key challenges of federal agency CISOs  in fulfilling their responsibilities to ensure that agency-wide information  security programs are developed, documented, and implemented.

To address these objectives, we reviewed relevant laws, National Institute  of Standards and Technology (NIST) guidance, and Office of  Management and Budget (OMB) guidance to identify the key  responsibilities of federal CISOs established by federal law and guidance.  We also evaluated information security policies and procedures from  each of the 24 departments and agencies covered by the Chief Financial  Officers Act to determine if CISOs had been assigned a role in ensuring  that information security activities were implemented in accordance with  relevant laws and guidance.

Additionally, we administered a web-based survey to the CISOs of the 24  departments and agencies. In the survey, we asked the CISOs to identify  (1) whether they felt that they had sufficient levels of responsibility and  authority, and (2) challenges they faced in exercising their authority. We  then interviewed each of the CISOs who were in place at the time of our  review in order to validate responses from the survey and to obtain  additional insight into the challenges they identified. In addition, we met  with representatives from OMB to discuss OMB’s role in providing  guidance to clarify the responsibilities and authorities of federal CISOs.

We conducted this performance audit from June 2015 to August 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. A more complete description  of our objectives, scope, and methodology is provided in appendix I.
subsections: section_title: Background
paragraphs: Safeguarding federal computer systems and the systems supporting the  nation’s critical infrastructures is essential to protecting national and  economic security, and public health and safety. For government  organizations, information security is also a key element in maintaining  the public trust. Inadequately protected systems may be vulnerable to  insider threats as well as the risk of intrusion by individuals or groups with  malicious intent who could use their illegitimate access to obtain sensitive  information, disrupt operations, or launch attacks against other computer  systems and networks. Our previous reports, and those of agency  inspectors general, describe persistent information security weaknesses  that place a variety of federal operations at risk of disruption, fraud, and  inappropriate disclosure.

The emergence of increasingly sophisticated cyber threats underscores  the need to manage and bolster the security of federal information  systems. For example, advanced persistent threats—where an adversary  that possesses sophisticated levels of expertise and significant resources  can attack using multiple means such as cyber, physical, or deception to  achieve its objectives—pose increasing risks. In addition, the number and  types of cyber threats are on the rise. The attack on federal personnel  and background investigation files that breached the PII of more than 20  million federal employees and contractors illustrates the need for strong  security over information and systems. Further, in February 2015, the  Director of National Intelligence testified that cyber threats to U.S.  national and economic security are increasing in frequency, scale,  sophistication, and severity of impact.
subsections: section_title: Federal Law and Guidance Establish Information Security Requirements
paragraphs: FISMA establishes information security program and evaluation  requirements for federal agencies in the executive branch. To help protect  against threats to federal systems, FISMA requires each agency to  develop, document, and implement an agency-wide information security  program to provide security for the information and information systems  that support its operations and assets, including those provided or  managed by another agency, contractor, or another organization on its  behalf. FISMA also states that the agency head is to delegate authority to  ensure compliance with the law to the CIO, who in turn is to designate a  senior agency information security officer to carry out the CIO’s  responsibilities under the law. In most federal organizations, this official is  referred to as the CISO.

FISMA also assigns responsibilities to OMB, the Department of  Homeland Security (DHS), NIST, and agency inspectors general:

OMB’s responsibilities include, among other things, developing and  overseeing the implementation of policies, principles, standards, and  guidelines on information security in federal agencies except with  regard to national security systems. Since 2003, OMB has issued  requirements and guidance to agencies on many information security  issues, such as an initiative to consolidate and secure agencies’  connections to the Internet; the security of cloud computing; privacy  and the protection of PII; and continuous monitoring of security  controls in federal information systems. Additionally, OMB has issued  annual instructions for agencies and inspectors general to meet  requirements for reporting on the effectiveness of agency security  programs.

DHS’s responsibilities under FISMA 2014 include, among other  things, developing, issuing, and overseeing implementation of binding  operational directives to agencies, including directives for incident  reporting, contents of annual agency reports, and other operational  requirements. DHS issued the first binding operational directive under  its FISMA 2014 authorities in May 2015, mandating that federal  agencies mitigate all critical vulnerabilities in Internet-accessible  systems within 30 days.

NIST’s chief responsibility under FISMA is to develop security  standards and guidelines for agencies. In accordance with its  statutory responsibilities, NIST has developed a risk management  framework of standards and guidelines for agencies to follow in  developing and implementing information security programs.

Each agency inspector general, or other independent auditor, is  required to annually evaluate and report on the information security  program and practices of the agency. In September 2015, we  reported that, according to agency inspectors general, the extent of  agencies’ implementation of requirements for establishing and  maintaining an information security program was mixed. We noted  that our work and reviews by inspectors general had highlighted  information security control deficiencies at agencies that exposed  information and information systems supporting federal operations  and assets to elevated risk of unauthorized use, disclosure,  modification, and disruption.

Additionally, OMB Circular A-130 requires that agency information  security and privacy programs provide for agency information security  and privacy policies, planning, budgeting, management, implementation,  and oversight; and cost-effectively manage information security and  privacy risks, including reducing such risks to an acceptable level. It also  requires agencies to implement a risk management framework to guide  and inform (1) the categorization of federal information and information  systems, (2) the selection, implementation, and assessment of security  and privacy controls, (3) the authorization of information systems and  common controls, and (4) the continuous monitoring of information  systems. Additionally, the circular requires agencies to ensure that the  CIO designates a senior agency information security officer to develop  and maintain an agency-wide information security program in accordance  with FISMA 2014.

section_title: Most Federal Agencies Defined the Role of the CISO in Accordance with Federal Law and Guidance
paragraphs: FISMA states that each agency head is responsible for securing agency  information and information systems, including by delegating to the  agency CIO the authority to ensure compliance with the law’s  requirements. The CIO, in turn, is directed to designate a CISO to carry  out the CIO’s responsibilities. Those responsibilities include ensuring the  development, documentation, and implementation of the agency-wide  information security program. We found that most agencies had defined  the role of the CISO in ensuring that most security program activities were  developed, documented, or implemented in their policies. However, 14  agencies had not defined the CISO’s role for all required activities,  potentially limiting these officials’ ability to effectively oversee these  agencies’ information security programs. In particular, for several  components of their information security programs, these agencies either  assigned these responsibilities to other officials within the agency or did  not document the role their CISO played. Without fully defining this role  for all of the elements of their information security programs, agencies are  not positioning their CISOs to most effectively carry out their  responsibilities for ensuring compliance with federal information security  requirements and effectively manage risks to the their operations.
subsections: section_title: Federal Law and Guidance Establish Responsibilities of CISOs
paragraphs: Under FISMA, the agency CISO is to carry out the CIO’s responsibilities  for ensuring agency compliance with the law, including development,  documentation, and implementation of the agency-wide information  security program that includes the following eight components:

Periodic risk assessments: FISMA requires agencies to conduct  periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems.  These risk assessments help determine whether controls are in place  to remediate or mitigate risk to the agency. According to NIST  guidance, risks are addressed from an organizational perspective with  the development of, among other things, risk management policies,  procedures, and strategy. The risk decisions made at the  organizational level are to guide the entire risk management program.  At the information system level, risk management activities include  categorizing organizational information systems, allocating security  controls to organizational information systems, and managing the  selection, implementation, assessment, authorization, and ongoing  monitoring of security controls.

Policies and procedures: Agencies are required to develop,  document, and implement policies and procedures that (1) are based  on risk assessments, (2) cost-effectively reduce information security  risks to an acceptable level, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements.

Security plans: Information security programs are required to include  plans for providing adequate information security for networks,  facilities, and systems or groups of information systems, as  appropriate. According to NIST, the purpose of a system security plan  is to provide an overview of the security requirements of the system  and describe the controls in place or planned for meeting those  requirements. In addition, NIST recommends that the plan be  reviewed and updated at least annually.

Security awareness training: FISMA requires agencies to provide  security awareness training to personnel, including contractors and  other users of information systems that support the operations and  assets of the agency. Training is intended to inform agency personnel  of the information security risks associated with their activities and  their responsibilities in complying with agency policies and procedures  designed to reduce these risks.

Periodic testing: Federal agencies are required to periodically test  and evaluate the effectiveness of their information security policies,  procedures, and practices as part of implementing an agency-wide  security program. This testing is to be performed with a frequency  depending on risk, but no less than annually. Testing should include  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information  systems. This type of oversight is a fundamental element that  demonstrates management’s commitment to the security program,  reminds employees of their roles and responsibilities, and identifies  and mitigates areas of noncompliance and ineffectiveness. Although  control tests and evaluations may encourage compliance with security  policies, the full benefits are not achieved unless the results are used  to improve security.

Remedial actions: FISMA requires agencies to plan, implement,  evaluate, and document remedial actions to address any deficiencies  in their information security policies, procedures, and practices. In  addition, NIST guidance states that federal agencies should develop a  plan of action and milestones (POA&M) for information systems to  document the agency’s planned remedial actions to correct  weaknesses or deficiencies noted during the assessment of the  security controls and to reduce or eliminate known vulnerabilities in  the system. Furthermore, the POA&M should identify, among other  things, the resources required to accomplish the tasks and scheduled  completion dates for the milestones. According to OMB, remediation  plans assist agencies in identifying, assessing, prioritizing, and  monitoring the progress of corrective efforts for security weaknesses  found in programs and systems.

Incident response: FISMA requires that agency security programs  include procedures for detecting, reporting, and responding to security  incidents and that agencies report incidents to the United States  Computer Emergency Readiness Team. According to NIST, incident  response capabilities are necessary for rapidly detecting an incident,  minimizing loss and destruction, mitigating the weaknesses that were  exploited, and restoring computing services.

Contingency planning: FISMA requires federal agencies to  implement plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. According to NIST, contingency planning is part of overall  information system continuity of operations planning, which fits into a  much broader security and emergency management effort that  includes, among other things, organizational and business process  continuity and disaster recovery planning. These plans and  procedures are essential steps in ensuring that agencies are  adequately prepared to cope with the loss of operational capabilities  due to a service disruption such as an act of nature, fire, accident, or  sabotage. According to NIST, these plans should cover all key  functions, including assessing an agency’s information technology (IT)  and identifying resources, minimizing potential damage and  interruption, developing and documenting the plan, and testing it and  making the necessary adjustments.

Other important requirements of FISMA that are required to be carried out  by the CISO include the following:

Specialized security training: Agencies are required to train and  oversee personnel who have significant information security  responsibilities. According to NIST, a needs assessment is crucial to  identify the individuals with significant IT security responsibilities,  assess their functions, and identify their training needs. Training  material should be developed that provides the skill sets necessary for  attendees to accomplish the security responsibilities associated with  their jobs. Examples of positions that would typically require  specialized training include system administrators, system owners,  security program managers, and senior agency leaders.

Contractor system security oversight: Under FISMA, agency  information security programs are to provide security for the  information and systems supporting the operations and assets of the  agency, including systems provided or managed by contractors. In  addition, OMB’s annual FISMA reporting instructions require agencies  to develop policies and procedures for agency officials to follow when  performing oversight of the implementation of security and privacy  controls by contractors.

Additionally, OMB requirements and NIST guidance call for agencies,  as part of the information security program, to authorize the operation of  information systems and explicitly accept any associated risks to  organizational operations and assets, individuals, other organizations,  and the nation, based on the implementation of an agreed-on set of  security controls. According to NIST, the system security plan, the results  of the security control assessment, and POA&Ms describing planned  remedial actions provide the authorizing official with essential information  needed to make a risk-based decision on whether to authorize operation  of an information system or a designated set of common controls.

section_title: Most Agencies Defined the Role of the CISO for Most Information Security Program Activities
paragraphs: For the 11 activities that we evaluated, 11 of the 24 agencies had fully  defined the role of the CISO for all 11 activities. The other 13 agencies  varied in their definitions of the CISO’s role, from defining the role for  most activities (11 agencies) to a few activities (2 agencies). Table 1  outlines the extent to which each of the 24 federal agencies defined the  role of the CISO in their information security policies in accordance with  FISMA and other federal requirements and guidance.

section_title: ● ● ● ● ● ● ● ○ ● ● ● ● ● ● ○ ● ● ● ● ● ● Department of Housing and Urban Development ● ● ● ● ● ○ ● ○ ● ● ● ● ● ● ● ● ● ○ ● ● ○ ● ● ● ● ● ○ ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●
paragraphs: Each of the 24 agencies defined the responsibilities of the CISO or CISO  office in ensuring that risk to the agency’s information and information  systems was assessed periodically. For example:

The Department of Commerce (Commerce) assigned responsibility  for developing and implementing a department-wide risk management  strategy and implementing a cyber security risk management  framework to the Office of Cyber Security, which is headed by the  CISO.

The Department of Veterans Affairs’ (VA) risk management policy  stated that the CISO is responsible for working with other VA IT  organizations to establish risk action plans, working with stakeholders  on implementing those plans, and evaluating and monitoring the  internal risk environment.

The Social Security Administration (SSA) delegated responsibility for  risk management to the Office of Information Security, which is  headed by the SSA CISO.

By defining the CISO’s role in periodic risk assessments, agencies will  have greater assurance that the CISO is aware of the risks to essential  computing resources and can make informed decisions about needed  security protections.
subsections: section_title: Nearly All Agencies Defined the CISO’s Responsibilities for Information Security Policies and Procedures
paragraphs: Twenty-two of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that risk-based information security policies and  procedures were established. For example:

The U.S. Department of Agriculture (USDA) information security  program assigned responsibility for formulating and issuing  departmental cyber security policies and procedures to the CISO.

The Department of Transportation (DOT) CISO was responsible for  providing management leadership in cybersecurity policy and  guidance. Additionally, the CISO was responsible for reviewing and  approving cybersecurity policies and procedures developed by  departmental components.

The General Services Administration assigned the CISO responsibility  for annually reviewing and revising the agency’s information security  policy, and for developing and publishing IT security procedural  guides.

However, two agencies—the Departments of Defense and Justice—did  not define the CISO’s responsibilities for this activity in their policies:

The Department of Defense (DOD) senior information security officer  (SISO) told us that the responsibilities of the SISO organization  included developing and maintaining policies and procedures;  however, these responsibilities were not documented in DOD policy.

The Department of Justice (DOJ) CISO indicated that the information  security office was responsible for security policies and procedures;  however, this was not described in the department’s information  technology security policy.

By ensuring that the CISO’s role is defined for establishing policies and  procedures, these two agencies will have increased assurance that  CISOs are able to effectively reduce risks to their information and  information systems, and that the information security practices that are  driven by these policies and procedures are consistently applied.

section_title: Agencies Did Not Always Define the CISO’s Responsibilities for Security Plans
paragraphs: Nineteen of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that plans for providing security for information  systems were in place. For example:

The Department of Education security policy assigned the CISO  responsibility for ensuring that security authorization documents,  including system security plans, are complete, consistent, and in  compliance with security standards.

The Department of Labor’s security policy stated that the information  security team, which is headed by the CISO, reviews the system  security plan for each information system as part of its authorization  oversight responsibilities.

The Small Business Administration assigned the CISO responsibility  for reviewing system security plans and other system documentation  to ensure that security requirements have been adequately  addressed.

However, five agencies—the Departments of Energy, the Interior,  Transportation, and the Treasury; and the Environmental Protection  Agency—did not define developing, reviewing, or updating system  security plans as a CISO responsibility in their policies:

Although the Department of Energy (DOE) delegated the authority to  carry out the responsibilities of the CIO under FISMA, including  developing and maintaining the DOE-wide information security  program, to the DOE CISO, the department’s cybersecurity program  order did not document any responsibilities for the CISO in overseeing  system security plans.

In a written response, officials from the Department of the Interior  (Interior) stated that CISO staff oversees security plans through the  department’s central FISMA compliance repository. However,  although Interior’s assessment and authorization package  documentation policy stated that system authorization documentation  is to be maintained in the repository, it did not document the CISO  office’s responsibilities for oversight of this documentation, including  security plans.

DOT officials stated in a written response that the CISO’s office  reviews a sample of system security plans and documentation  annually, based on prior year audit findings or systems of significant  criticality or impact. However, although DOT’s guide for security  authorization and continuous monitoring stated that the CISO  conducts oversight reviews of component cybersecurity programs, it  did not indicate that security plans were included in these reviews.

In a written response, officials from the Department of the Treasury  (Treasury) stated that, although the department’s policy required  FISMA reporting and other cybersecurity information, including  security plans, to be reported to the CIO, the CISO organization  actually collects, oversees, and manages this process. However,  these responsibilities were not specified in policy.

The Environmental Protection Agency (EPA) senior agency  information security officer (SAISO) stated that the agency was  working to implement a new process in which system authorization  packages—which include security plans—would be routed through  the SAISO organization for review. He indicated that the process was  expected to be implemented in the summer of 2016.

Until these five agencies appropriately define the role of the CISO in  ensuring that system security plans are appropriately documented, these  CISOs may be unable to effectively ensure that their agency’s officials are  aware of system security requirements or whether controls are in place.

section_title: Nearly All Agencies Defined the CISO’s Responsibilities for Security Awareness Training
paragraphs: Twenty-two of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that all employees received information security  training. For example:

Commerce assigned the Office of Cyber Security, headed by the  CISO, the responsibility to maintain the department’s information  security awareness and training program, including establishing  requirements for training for operating units and monitoring  compliance.

DHS’s information security policy directive stated that the CISO is  responsible for ensuring that department personnel, contractors, and  others working on behalf of DHS receive information security  awareness training.

SSA assigned the CISO the responsibility to develop SSA’s security  awareness training policy, provide information on training  opportunities that meet the requirements of the policy, and oversee  the implementation of the training program.

However, two agencies—the Departments of Energy and the Treasury— did not define the CISO’s responsibilities for security awareness training  in their policies:

Although DOE delegated the authority to carry out the responsibilities  of the CIO under FISMA, including developing and maintaining the  DOE-wide information security program, to the DOE CISO, the  department’s Cybersecurity Awareness and Training Program policy  did not define the roles and responsibilities of the CISO with respect  to security awareness training.

In a written response, Treasury officials stated that the department  CISO collects and manages department-wide data on training  completion. However, although Treasury policy states that bureaus  are to provide materials and assistance to support the oversight and  central reporting roles of the Treasury Cybersecurity Office, it did not  specify that training completion data are to be provided. Additionally,  officials stated that the CISO provides a web-based security  awareness training tool for bureaus, but this was not documented in  Treasury’s security policies.

By defining the CISO’s role in ensuring that all users receive security  awareness training, DOE and Treasury can better equip their CISOs to  ensure that their agency personnel have a basic understanding of  information security requirements to protect the systems they use.

section_title: Most Agencies Defined the CISO’s Roles in Oversight of Security Control Testing Activities
paragraphs: Twenty-two of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that security controls are tested periodically in  accordance with FISMA and NIST guidance. For example:

VA assigned the CISO responsibility for establishing and monitoring  the department’s Information Security Continuous Monitoring  program, including ensuring that reports are monitored and that  issues identified are escalated for appropriate action.

DHS’s security policy stated that the CISO is responsible for ensuring  that organizational security testing plans are executed in a timely  manner.

The Office of Personnel Management’s (OPM) security policy and  guidance indicated that the CISO is responsible for reviewing the  results of periodic testing as part of the oversight of system  authorization activities.

However, two agencies—the Departments of Transportation and the  Treasury—did not define the CISO’s responsibilities for ensuring that  security controls are tested periodically across the agency in their  policies:

DOT officials stated in a written response that the CISO office  annually tests a sample of security controls as part of its compliance  activities. However, although DOT’s guide for security authorization  and continuous monitoring stated that the CISO conducts oversight  reviews of component cybersecurity programs, it did not indicate that  the reviews included any oversight of security testing.

Treasury officials stated in a written response that responsibility for  security testing had been delegated to bureaus. They also stated that  the security policy describes oversight of security testing by the CISO;  however, although the policy stated that security controls are to be  tested on an ongoing basis as part of a continuous monitoring  process, it did not describe any responsibilities for the CISO or the  CISO office for ensuring that security controls are periodically tested.

If these two federal agencies define the CISOs role in ensuring that  security controls are periodically tested, these officials will be better able  to ensure that security controls have been implemented correctly, are  operating as intended, and are producing the desired outcome with  respect to meeting the security requirements of the agency.

section_title: Nearly All Agency Policies Defined CISO Responsibilities for Oversight of Remedial Actions
paragraphs: Twenty-three of the 24 agencies defined the responsibilities of the CISO  or CISO office in ensuring that remedial actions are documented and  used to address identified deficiencies in security controls. For example:

The Department of Housing and Urban Development assigned the  Office of Information Technology Security, which is headed by the  CISO, the responsibility for ensuring that POA&Ms for the security  program and information systems are maintained and documented.

Treasury’s information security policy stated that the CISO is  responsible for monitoring information system weaknesses at the  bureaus and implementation of corrective actions.

Interior assigned responsibility for reviewing bureau- and office-level  POA&Ms and ensuring that they comply with department-wide and  OMB guidance to the CISO. Additionally, the CISO is responsible for  ensuring that all bureau and office information systems’ weaknesses  are adequately described and that planned corrective actions  appropriately address the weaknesses.

However, DOE did not identify who was responsible for ensuring that  remedial actions are taken and are effective in its policies. Specifically,  DOE delegated the authority to carry out the responsibilities of the CIO  under FISMA, including developing and maintaining the DOE-wide  information security program, to the DOE CISO. However, the  department’s cybersecurity program order did not specify any  responsibilities for the CISO in overseeing remedial actions. The DOE  CISO stated that overall responsibility for the remedial action process is  assigned to the CIO, and that the CIO reviews POA&M reports for  significant weaknesses. He also stated that the CISO uses POA&Ms to  understand the environment of a particular site prior to going on a site  visit. However, these responsibilities were not documented in DOE’s  cyber security program policy. By defining the CISO’s role in ensuring that  the agency has remediation processes, DOE will have greater assurance  that their CISOs are able to ensure that control weaknesses affecting the  agency’s information and information systems are being corrected and  addressed in a timely manner.

section_title: Agencies Almost Always Defined the CISO’s Responsibilities for Incident Detection, Response, and Reporting in Policy
paragraphs: Twenty-two of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that the agency has procedures for detecting,  reporting, and responding to security incidents. For example:  Interior assigned responsibility for this activity to its Computer Incident  Response Center, which is part of the Information Assurance Division  led by the CISO.

The U.S. Agency for International Development’s (USAID) security  policies stated that the CISO is to establish and update incident  response policies and procedures, and that the CISO is the central  authority for coordinating and reporting sensitive and national security  incidents for the agency.

The National Science Foundation assigned the CISO responsibility for  overseeing the Computer Incident Response Team during responses  to reported incidents.

However, two agencies—the Departments of Defense and State—did not  define the CISO’s responsibilities for this activity in their policies:

DOD assigned responsibility for incident response to Cyber  Command, within U.S. Strategic Command. The DOD SISO told us  that the SISO organization is involved in Cyber Command’s incident  response activities; however, these responsibilities and activities were  not documented in the department’s security policies.

The Department of State (State) assigned responsibility for incident  response to the Office of Cybersecurity in the Bureau of Diplomatic  Security. The State CISO and the Director of the Office of  Cybersecurity stated that the department has deliberately assigned  certain operational cybersecurity functions and program  responsibilities to the Bureau of Diplomatic Security.

By defining the role of the CISO in ensuring that the agency has  procedures for incident detection, reporting, and response, DOD and  State will help their CISOs ensure that the agency’s information and  information systems are adequately protected from cyber attacks.

section_title: CISO Responsibilities for Contingency Planning Were Not Always Defined
paragraphs: Seventeen of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that plans and procedures are in place to ensure  recovery and continued operations of their information systems in the  event of a disruption. For example:

VA’s information security program policy stated that the CISO is  responsible for working closely with IT and other business units to  develop and maintain an enterprise business continuity program;  managing the planning, design, maintenance of business continuity  program projects and ensuring compliance with industry standards  and regulatory requirements; monitoring the development of business  continuity plans and reviewing plans to ensure compliance; and  providing business and technical guidance relative to business  continuity.

DHS assigned the CISO responsibility for reviewing and approving  contingency plans, and for ensuring that plans for ensuring the  continuity of operations for information systems are developed and  maintained.

OPM’s security policy stated that the CISO reviews system  contingency plans and requires that the results of contingency plan  tests and exercises be provided to the CISO.

However, seven agencies—the Departments of Commerce, Energy,  Health and Human Services, the Interior, Justice, and the Treasury; and  the Environmental Protection Agency—did not define the CISO’s  responsibilities for contingency planning in their policies:

Commerce assigned this responsibility to the Critical Infrastructure  Protection Manager, and did not describe any role for the CISO in the  department’s information technology security program policy.

Although DOE delegated the authority to carry out the responsibilities  of the CIO under FISMA, including developing and maintaining the  DOE-wide information security program, to the DOE CISO, the  department’s continuity program order did not describe any  responsibilities for the CISO.

The Department of Health and Human Services’ policy assigned  responsibility for updating and maintaining the information technology  contingency plan to a Contingency Planning Coordinator; the policy  did not describe the oversight responsibilities of the CISO.

Interior officials stated in a written response that the CISO office funds  a yearly audit which evaluates the implementation of security program  activities, including continuity of operations activities, across the  department; they also stated that the CISO office works with the  Department’s Office of Emergency Management to ensure integration  of IT system contingency plans with the larger departmental continuity  of operations plans. However, these activities were not defined in  Interior’s policies.

The DOJ CISO stated that her office regularly reviews system  contingency plans and test results. However, this responsibility was  not documented in DOJ’s security policies.

Treasury officials provided documentation showing that the CISO  office tracks contingency plan testing activities as part of its oversight  activities. However, these responsibilities were not described in policy.

EPA’s SAISO told us that the agency plans to implement a procedure  for reviewing authorization packages, including contingency plans; he  indicated that the process was expected to be implemented in the  summer of 2016.

By not defining the CISO’s role in contingency planning, these seven  agencies may hinder their CISOs’ ability to effectively ensure that  information system contingency planning plans and procedures are in  place, reducing the likelihood that these agencies will be able to  successfully recover their systems in a timely manner in the event of a  service disruption.

section_title: Nearly All Agencies Defined the CISO’s Responsibilities for Specialized Security Training
paragraphs: Twenty-two of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that personnel with significant information security  responsibilities were trained. For example:

EPA assigned its SAISO the responsibility to develop and maintain  role-based training, education, and credentialing requirements for  personnel with significant information security responsibilities.

USAID’s security policy stated that the CISO is responsible for  establishing and managing an information security training program,  including training for personnel with significant security responsibilities  and maintaining training records.

The General Services Administration assigned the CISO responsibility  for ensuring that Information Systems Security Officers and  Information Systems Security Managers receive applicable training  specific to their information security responsibilities.

However, two agencies—the Department of the Treasury and the Small  Business Administration—did not define the CISO’s responsibilities for  this activity in their policies:  In a written response, Treasury officials stated that the department  CISO collects and manages department-wide data on training  completion. However, although Treasury policy states that bureaus  are to provide materials and assistance to support the oversight and  central reporting roles of the Treasury Cybersecurity Office, it did not  specify that training completion data are to be provided.

The Small Business Administration CIO told us that the CISO is  responsible for overseeing role-based security training across the  agency; however, this responsibility was not reflected in the agency’s  security policies.

Unless these two agencies define the roles of their CISOs in ensuring that  personnel with significant security responsibilities receive appropriate  training, their CISOs may be unable to ensure that these individuals have  the knowledge, skills, and abilities consistent with their roles to protect the  confidentiality, integrity, and availability of the information housed within  the information systems to which they are assigned.

section_title: Agency Policies Did Not Always Describe CISO Responsibilities for Oversight of Contractor System Security
paragraphs: Eighteen of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that contractor systems adhere to agency and  federal information security requirements. For example:

Thirteen agencies’ policies indicated that the CISO exercises  oversight of contractor system security as part of the CISO’s overall  oversight of the system authorization process.

OPM’s security policy stated that the CISO is to conduct and  coordinate information security audits at OPM and contractor facilities,  and that the CISO organization reviews security clauses in contracts  and statements of work.

USDA assigned the CISO responsibility for conducting reviews of  system documentation, including the system security plan, security  assessment report, and plans of action and milestones, for all  systems including contractor systems.

However, six agencies—the Departments of Defense, Energy, the  Interior, and the Treasury; the National Aeronautics and Space  Administration; and the U.S. Agency for International Development—did  not define the CISO’s responsibilities in ensuring that contractor systems  met security requirements in their policies:

DOD policies did not describe the responsibilities of the SISO in  ensuring that contractor systems met security requirements. The DOD  SISO told us that the information security oversight organization was  not currently conducting inspections of unclassified contractor  networks. He also stated that the SISO office monitors self-reported  data from contractors; however, these responsibilities were not  defined in DOD’s policies.

The DOE CISO stated that the CISO exercises some oversight of  contractor system security through FISMA reporting responsibilities.  However, although DOE delegated the authority to carry out the  responsibilities of the CIO under FISMA, including developing and  maintaining the DOE-wide information security program, to the DOE  CISO, the department did not define the CISO’s responsibilities for  oversight of contractor system security in its policies.

In a written response, Interior officials stated that contractor systems  are included in the authorization process, and that the CISO office  oversees the authorization activities through yearly program audits  and the audit activities of the Compliance and Audit Management  Branch. However, these activities were not defined in Interior’s  policies.

Treasury’s information technology security program specified that it  applied to contractor systems and department-owned systems;  however, it did not define the CISO’s role in ensuring that contractor  systems met security requirements.

At the National Aeronautics and Space Administration, the SAISO  issued the agency’s policy for conducting security assessments of  third-party information systems. However, the policy did not define the  SAISO’s responsibilities for oversight of contractor security.

USAID’s policy stated that responsibility for oversight of contractor  system security was assigned to the contracting officer’s  representative; the policy did not describe any role for the CISO or  CISO office in this process. The USAID CISO agreed, and stated that  the CISO had no way to verify that contractors were meeting security  requirements.

Because these six agencies have not defined their CISOs’ responsibilities  for oversight of contractor systems security, increased risk exists that  weaknesses in these agencies’ contractor-operated systems may go  undetected and unresolved.

section_title: Most Agencies Defined the CISO’s Responsibilities for Oversight of the System Authorization Process
paragraphs: Twenty of the 24 agencies defined the responsibilities of the CISO or  CISO office in ensuring that information systems are authorized to  operate in accordance with federal requirements. For example:

The Department of Labor’s information security organization, headed  by the CISO, administers the security authorization oversight process,  which includes security plan reviews and verification of a sample of  security controls.

The Department of State’s information security policies state that the  Information Assurance office, which is headed by the CISO, is  responsible for ensuring that all departmental information systems go  through the approved system authorization process.

The Nuclear Regulatory Commission assigned the CISO responsibility  for ensuring that information security risks are managed consistently  throughout the agency by being incorporated into the system  authorization process.

However, four agencies—the Departments of Energy, the Interior, and the  Treasury; and the Environmental Protection Agency—did not define the  CISO’s role in ensuring that systems were authorized in their policies:

Although DOE delegated the authority to carry out the responsibilities  of the CIO under FISMA, including developing and maintaining the  DOE-wide information security program, to the DOE CISO, the  department’s cybersecurity program order did not describe any  specific roles or responsibilities for the CISO in ensuring that  information systems are authorized to operate.

Interior officials stated in a written response that the CISO office  oversees authorization activities through yearly program audits and  the audit activities of the Compliance and Audit Management branch.  However, these activities were not defined in Interior’s policies.

Treasury’s information security policy indicated that the CISO is  responsible for implementing the IT security program and performing  compliance oversight, but did not describe any oversight  responsibilities for the system authorization process beyond this  general statement. In a written response, officials stated that, although  the department’s policy required FISMA reporting and other  cybersecurity information to be reported to the CIO, the CISO  organization actually collects, oversees, and manages this process;  they also stated that the CISO office tracks the status of security  authorization activities as part of its oversight activities. However,  these responsibilities were not specified in policy.

EPA’s information security policy stated that the SAISO is to develop,  implement, and maintain security authorization and reporting  capabilities; however, it did not describe any role for the SAISO in the  authorization process. The agency planned to update its processes to  ensure that authorization packages were vetted through the SAISO’s  office. The EPA SAISO indicated that the process was expected to be  implemented in the summer of 2016.

Unless CISOs at these four agencies have a clear role in system  authorization decisions, the agencies will face greater difficulty ensuring  that such decisions appropriately consider information security risks.

section_title: Federal CISOs Identified Challenges to Their Authority That Limit Their Ability to Effectively Manage Agency-Wide Information Security Programs
paragraphs: Agency CISOs identified a number of challenges to their authority.  Specifically, in our survey of 24 agency-level CISOs, the following factors  were frequently cited as presenting challenges to CISOs’ ability to  effectively carry out their responsibilities to ensure that information  security program activities are implemented: (1) competing priorities  between agency operations and information security, (2) coordination with  component organizations and other offices, (3) availability of security- related information from component organizations and IT contractors, (4)  oversight of indirect reports and IT contractors, and (5) the position of the  CISO in the agency’s hierarchy. Respondents also reported challenges  related to other factors that did not directly affect their authority but  nevertheless may limit their ability to carry out their responsibilities.

There are several government-wide initiatives under way that are  intended to help address some of these challenges. However, although  OMB has responsibility under FISMA for providing guidance to federal  agencies, it has not issued guidance clarifying how agencies should  implement recent provisions in federal law aimed at strengthening their  oversight of information security activities or the role of agency CISOs in  carrying them out. This lack of clarity further hinders CISOs’ ability to  address challenges to their authority, including balancing operational and  security needs, overseeing security activities, obtaining adequate and  timely information, and ensuring that senior managers are aware of  information security risks facing the agency.
subsections: section_title: Many CISOs Reported Challenges to Their Authority
subsections: section_title: Competing Priorities between Operations and Security
paragraphs: Eighteen CISOs reported that competing priorities between agency  operations and information security challenged their ability to exercise  their responsibilities to ensure the implementation of the agency-wide  information security program to a large or moderate extent, as shown in  figure 1 below.

Respondents identified several specific challenges related to this factor.  For example, one respondent stated that security personnel at the  component level report to the component’s management chain rather  than to the CISO; consequently, they are often driven by the operational  imperatives of the component agency rather than the security priorities of  the department. The respondent also noted that programs often view  cybersecurity as a drain on limited resources. Another CISO explained  that agency operations drive procurements at a faster pace than is  feasible for their cyber team to track. Another CISO expressed a similar  sentiment, stating that technology is advancing rapidly and security is  often seen as getting in the way of progress. Another respondent noted  that the operational priorities of the agency tend to favor maintaining  existing operations rather than correcting weaknesses and vulnerabilities  in a timely fashion.

According to NIST SP 800-39, effective risk management requires an  organization’s mission/business processes to explicitly account for  information security risk when making operational decisions. When  organizations make operational decisions without adequately considering  information security risk, CISOs are hindered in ensuring that appropriate  security controls are applied or that weaknesses are addressed prior to  new systems or technology being deployed.

section_title: Coordination with Component Organizations and Other Offices
paragraphs: About half of the CISOs we surveyed reported challenges when  coordinating with component organizations or with other offices (e.g.,  program, human capital, and contracting offices). Specifically, 13 reported  that coordination with component organizations was challenging to a  large or moderate extent, and 12 reported that coordination with other  offices was challenging to a large or moderate extent, as shown in figure  2 below.

Respondents identified several specific challenges related to these  factors. For example:

Coordination with component organizations. One CISO stated that  risk decisions made by authorizing officials or system owners within  components often exceeded the department’s standards for risk  acceptance, because component organizations often had risk  tolerances that were not consistent with the department’s. Another  stated that coordinating with component organizations can slow  incident response efforts, depending on the components’ resources,  expertise, and priorities. Another respondent noted that the  department-level CISO lacks the authority to mandate that  components implement decisions that have to be applied across the  enterprise, although the CISO also noted that considerable support  could be gained through using a collaborative approach. Another  respondent indicated that system development life cycle management  is not a mature process at many component organizations, and that  some components do not apply a formal system development life  cycle process.

Coordination with other offices. One CISO noted that other offices that  are responsible for enterprise controls have not always fully assumed  the responsibility for overseeing, testing, and evaluating those  controls. Another CISO stated that security controls that depend on  other offices in the agency are not always recognized by those offices  as priorities—or even as responsibilities—because the requirements  do not arise from their own chain of authority. Another CISO stated  that program offices at his agency frequently challenge the CISO’s  authority to oversee contractors’ implementation of security controls in  order to maintain the business relationship with the contractor. One  respondent noted that, in system development efforts, security is seen  by the project as a burden, making it difficult for the security  organization to conduct oversight of the project life cycle.

NIST guidance states that organizations may choose to delegate  authority, responsibility, and decision-making power for information  security to individual subordinate organizations, such as bureaus or  components within a federal agency, in order to accommodate  subordinate organizations with divergent mission/business needs and  operating environments. However, if CISOs face difficulties coordinating  with component organizations or other offices within their agencies, their  ability to help ensure that information security risks are being identified  and mitigated across the enterprise may be hindered.

section_title: Limited Access to Information Security Data from Component Organizations and IT Contractors
paragraphs: Nine CISOs reported challenges to a moderate or large extent when  receiving information security information from component organizations,  and twelve reported that receiving information security information from IT  contractors as challenges. Figure 3 below shows the extent to which  CISOs identified these factors as challenging.

Respondents identified several specific challenges related to these  factors. For example:

Availability of information from components: One respondent stated  that a number of networks and systems are independently managed  and maintained by components, which are frequently reluctant to  share information with the department-level security organization.  Another noted that the department-level security organization does  not always have visibility into the networks or systems at component  organizations. Another CISO stated that components do not always  share complete information on security incidents with the central  security organization, and that some do not involve the department- level security organization in incident investigations. The respondent  further noted that system authorization data are self-reported by  component organizations, making it difficult for the CISO organization  to verify that the components are complying with departmental policy.

Availability of information from IT contractors: One respondent noted  that contractual limitations can prevent access to information that  would normally be available in a government-owned and -operated  environment. Another stated that, even when language requiring  contractors to provide the agency access to security information is  included in contracts, it can still be very difficult to obtain necessary  information from contractors. One CISO noted that there are no  means by which the agency can validate data reported by contractors.

According to NIST guidance for managing information security risk, it is  important to ensure that risk-related information is shared among  subordinate organizations and with the parent organization because the  risk decisions by subordinate organizations may have an effect on the  organization as a whole. When CISOs have difficulty receiving adequate  information security information from components or contractors, they  may lack all of the information that they need to effectively carry out their  responsibilities to oversee the security program activities for which those  components or contractors are responsible.

section_title: Oversight of Indirect Reports and IT Contractors
paragraphs: Half of CISOs reported that their ability to exercise oversight of individuals  and offices outside of the CISO’s direct reporting structure challenged  them to a large or moderate extent. Additionally, half of the CISOs we  surveyed also reported challenges related to oversight of IT contractors.  Figure 4 below identifies the extent to which CISOs identified these  factors as challenging.

Respondents identified several specific challenges related to these  factors. For example:

Oversight of indirect reports. One respondent indicated that the CISO  lacks the authority to hold indirect reports, such as information system  security officers (ISSO), accountable for carrying out their  information security responsibilities. Another stated that the personnel  supporting ongoing and deployed projects are not accountable to the  CISO; rather, they are overseen by operations and engineering  teams, whose priorities are focused on operations and delivering  functionality and not on security.

Oversight of IT contractors. For example, one respondent stated that  contractors not directly assigned to IT security reported to their  sponsor program offices, and consequently oversight activities had to  be coordinated through program managers, contracting officers, or  their representatives. Another stated that the CISO did not have  control over the cybersecurity contract that supports the information  security organization. One CISO expressed difficulties in establishing  a consistent interpretation of security requirements across component  agencies’ contracting organizations. Another also stated that the  security organization lacks the authority to validate security  documentation submitted by contractors.

NIST guidance states that leaders and managers at all levels of an  organization need to understand their responsibilities and be held  accountable for managing information security risk. When CISOs  experience difficulties overseeing the information security responsibilities  of individuals outside of their reporting hierarchy or of IT contractors, they  can be hindered in their ability to ensure that the actions of these  individuals comply with the agency’s security policies or sufficiently  address the risks facing the agency.

section_title: CISOs’ Organizational Placement
paragraphs: Ten of the 24 CISOs reported that their position in the agency hierarchy  challenged their ability to carry out their responsibilities to a large or  moderate extent. Figure 5 below identifies the extent to which CISOs  identified their position in the agency hierarchy as challenging.

Respondents identified several specific challenges related to this factor.  For example, one respondent noted that the department-level CISO  resided under a department under secretary, which often blurred the lines  of authority and accountability between the IT organization and other  components. Another indicated that being positioned higher in the  organization would make it easier to gain concurrence and support for  security initiatives, and that the CISO’s current position made it difficult to  ensure that identified weaknesses are addressed and that incidents are  being handled appropriately. Another respondent noted that the CISO’s  placement in the organization can limit their ability to elevate significant  information security risks to upper management. However, one noted that  an increased focus on cybersecurity issues at the agency in recent  months has resulted in the CISO having greater access to agency  leadership.

If CISOs are unable to hold component and office personnel accountable  for taking action or elevate security concerns to upper management, they  will be challenged in their ability to ensure that agency leaders have a  clear understanding of the agency’s risk profile, and agencies may be  less able to effectively manage and respond to these risks.

section_title: CISOs Reported That Other Factors Presented Challenges
paragraphs: The 24 CISOs also reported that other factors posed challenges to their  ability to carry out their responsibilities effectively, including the following  examples:

Lack of sufficient staff. CISOs identified challenges with having  insufficient personnel to oversee security activities effectively. For  example, one CISO noted that the information security office did not  have enough personnel to oversee the implementation of the number  and scope of requirements described in NIST SP 800-53 as well as to  respond to FISMA audits and OMB data calls. Another noted that the  agency’s security operations center did not have enough staff to  operate around the clock.

Recruiting, hiring, and retaining security personnel. One CISO stated  that the agency could not offer salaries that are competitive with the  private sector for candidates with high-demand technical skills.  Another described a similar challenge, stating that the government’s  General Schedule system restricts agencies from offering bonuses  commensurate with what private sector organizations can offer.  Additionally, another respondent stated that, although hiring security  personnel with less experience is cheaper than hiring at higher  grades, the security organization has to devote significant time and  effort to bringing new staff up to speed; additionally, once those staff  obtain skills and experience, they often begin looking for new jobs  where they can receive a higher salary.

Expertise of security personnel. CISOs described challenges with  ensuring that personnel in highly technical roles have sufficient  training opportunities and expertise in the skill sets needed. Others  noted that a lack of expertise among staff limited their ability to  evaluate risk, support internal testing, or oversee the security of IT  acquisitions. Two noted that ISSOs at their agencies often are  assigned these duties in addition to other responsibilities; others  noted that ISSOs lack security skills or are not sufficiently trained.  Another stated that the personnel supporting incident response at the  agency had relatively little experience.

Financial resources. One CISO stated that the information security  organization is funded through components’ contributions to the  department’s working capital fund, which creates tension between the  department-wide security needs and the operational priorities of the  component agencies. Another stated that the CISO organization does  not have a dedicated budget, but is funded out of the budget for the  CIO organization. Another respondent stated that the CISO’s ability to  drive the agency to resolve POA&Ms in a timely manner is limited in  part due to financial constraints. One respondent stated that his  financial resources are insufficient for the human resources, training,  and necessary tools and technologies needed to provide sufficient  oversight of security authorization decisions made by component  agencies. Other CISOs stated that efforts to test security controls and  remediate weaknesses are hampered due to budgetary constraints.

section_title: Federal Efforts Are Under Way to Address Selected Challenges, but OMB Has Not Issued Guidance Addressing Challenges to CISOs’ Authority
paragraphs: In accordance with their statutory responsibilities under FISMA, OMB and  NIST have taken steps to assist federal agencies in implementing  information security activities, and have instituted initiatives that can  assist federal agencies in addressing challenges related to human and  financial resources. For example:

The National Initiative for Cybersecurity Education: This is an  interagency effort coordinated by NIST to improve cybersecurity  education, including efforts directed at training, public awareness, and  the federal cybersecurity workforce. This initiative is intended to  support the federal government’s evolving strategy for education,  awareness, and workforce planning and provide a comprehensive  cybersecurity education program.

Cybersecurity National Action Plan: Announced by the White  House in February 2016, the Cybersecurity National Action Plan is  intended to foster long-term improvements in the cybersecurity across  the federal government, the private sector, and individuals. Among  other things, the plan announces (1) the establishment of the  Commission on Enhancing National Cybersecurity, which is to make  recommendations on actions to enhance cybersecurity awareness  and protections throughout the private sector and at all levels of  government, to protect privacy, to maintain public safety and  economic and national security, and to empower Americans to take  better control of their digital security; (2) the creation of the Federal  Chief Information Security Officer position to drive cybersecurity  policy, planning, and implementation across the federal government;  (3) efforts to enhance cybersecurity education and training nationwide  and hire more cybersecurity experts to secure federal agencies; and  (4) a proposal for $19 billion of funding for cybersecurity in fiscal year  2017, a 35 percent increase over fiscal year 2016.

Cybersecurity Strategy and Implementation Plan: Issued in  October 2015, the Cybersecurity Strategy and Implementation Plan  was created as a result of the 30-day Cybersecurity Sprint initiated in  June 2015. The plan is intended to identify and address critical  cybersecurity gaps and emerging priorities, and make specific  recommendations to address those gaps and priorities. The plan is to  strengthen federal civilian cybersecurity through five objectives: (1)  prioritized identification and protection of high-value information and  assets, (2) timely detection of and rapid response to cyber incidents,  (3) rapid recovery from incidents when they occur and accelerated  adoption of lessons learned from the Cybersecurity Sprint  assessment, (4) recruitment and retention of cybersecurity workforce  talent, and (5) efficient and effective acquisition and deployment of  existing and emerging technology.

If effectively implemented, these initiatives should help address several of  the challenges identified by CISOs, particularly those related to  insufficient numbers of staff; recruiting, hiring, and retaining qualified staff;  personnel expertise; and funding. However, they do not address concerns  raised by CISOs regarding their authority to carry out their  responsibilities.
subsections: section_title: Existing OMB Implementation Guidance Does Not Address New FISMA Requirements for Ensuring Senior Agency Officials Are Held Accountable
paragraphs: Recognizing the importance of oversight of agency-wide information  security activities, in enacting FISMA 2014 Congress added two new  requirements that agency heads ensure that (1) senior agency officials  carry out their information security responsibilities and (2) all agency  personnel are held accountable for complying with the agency-wide  information security program. Given CISOs’ statutory responsibilities for  ensuring that their agencies comply with the requirements of the law, it is  vitally important to address the challenges to their authority that the  CISOs have identified, such as ensuring that the agency appropriately  considers security in operational decisions; coordinating with and  overseeing security activities of component organizations, other offices,  and contractors; and elevating security concerns to upper management.

According to OMB, recent guidance addresses the implementation of  these new requirements. Specifically, OMB officials stated that the office’s  June 2015 memorandum that provides implementation guidance for the  recently enacted IT reform legislation, commonly referred to as the  Federal Information Technology Acquisition Reform Act (FITARA),  addresses the CISO’s role in ensuring that senior officials are held  accountable because it is intended to strengthen the agency CIO’s  accountability and oversight for information security across the agency.  They added that under FISMA, this accountability and involvement would  necessarily be delegated to the agency CISO.

Officials also stated that OMB’s efforts to oversee agencies’  implementation of the requirements in the memo, including PortfolioStat  sessions, included discussions with agency CIOs and CISOs regarding  whether they have been given appropriate authority. They further stated  that the annual FISMA reporting instructions issued by the office contain  guidance on how agencies can ensure that CISOs are assigned  appropriate responsibility and authority to ensure that information security  activities are implemented. Officials also stated that the CyberStat  meetings—in which OMB and DHS meet with agency CIOs, CISOs, and  other agency officials to discuss and assist in developing focused  strategies for improving their agency’s cybersecurity posture—focus on  FISMA-related security metrics and issues where the CISO should be  involved.

In July 2016, OMB issued its update to Circular A-130, Managing  Information as a Strategic Resource. Among other things, the circular  requires agencies to ensure that the CIO designates a senior agency  information security officer to develop and maintain an agency-wide  information security program in accordance with FISMA 2014. The  circular reiterates the new FISMA 2014 requirement for agencies to  implement policies and procedures to ensure that all personnel are held  accountable for complying with agency-wide information security and  privacy requirements and policies and specifies that this requirement be  part of the agency-wide information security program.

However, neither the FITARA implementation guidance, FISMA reporting  instructions, nor CyberStat meetings provide guidance for federal  agencies on how to implement the new FISMA 2014 requirements or the  CISO’s role in carrying them out, nor do they indicate that OMB is  evaluating CISOs’ authority. Furthermore, while the updated Circular A- 130 restates the new requirement to ensure that all personnel are held  accountable, it does not provide guidance clarifying how this requirement  should be implemented. The lack of clarity about how agencies are  expected to implement these new requirements further hinders CISOs’  ability to address the challenges to their authority that they reported  facing. Additional guidance from OMB addressing how agencies should  ensure that officials carry out their responsibilities and personnel are held  accountable for complying with the agency-wide information security  program could assist CISOs in more effectively carrying out their duties in  the face of numerous challenges.

section_title: Conclusions
paragraphs: Defining the role of a federal agency CISO is key to ensuring that this  official is able to ensure that agency-wide information security programs  are developed, documented, and implemented. Most agencies  documented the role of the agency CISO in ensuring the implementation  of security program activities in their information security policies;  however, most agencies also had gaps in policies defining their CISO’s  responsibilities, leaving it unclear what role, if any, these officials play in  some aspects of agencies’ information security programs. By not fully  defining this role, agencies may be unable to ensure that their CISOs are  able to effectively oversee the implementation of their information security  programs.

Although federal law and agency policies vest CISOs with responsibility  for ensuring that agency-wide information security programs are  developed, documented, and implemented, many CISOs reported  challenges to their authority to effectively carry out these responsibilities,  such as difficulties in coordinating with component organizations or other  offices, obtaining reliable and timely information from other entities within  the agency, and an inability to raise concerns to agency leadership. They  also cited concerns in having adequate staff with relevant expertise and  sufficient resources to implement security requirements. These can limit  CISOs’ ability to effectively ensure that the information security program  is implemented and that agency-wide information security risk is  managed appropriately. Several government-wide initiatives that are  under way can address issues related to staffing and financial resources  if fully implemented. However, OMB’s current implementation guidance  does not address how to implement the new FISMA 2014 requirements or  the CISO’s role in carrying them out, nor does it identify how OMB will  evaluate the role of the CISO. Further guidance from OMB could assist  agencies in making sure that CISOs have adequate authority and could  help ensure that agencies are fully defining the role of the CISO with  respect to all elements of their information security programs.

section_title: Recommendations for Executive Action
paragraphs: To assist CISOs in carrying out their responsibilities, we recommend that  the Director of OMB issue guidance for agencies’ implementation of the  FISMA 2014 requirements to ensure that (1) senior agency officials carry  out information security responsibilities and (2) agency personnel are held  accountable for complying with the agency-wide information security  program. This guidance should clarify the role of the agency CISO with  respect to these requirements, as well as implementing the other  elements of an agency-wide information security program, taking into  account the challenges identified in this report.

We are also making 33 recommendations to 13 of the 24 departments  and agencies in our review to ensure that the role of the CISO is defined  in agency policy in accordance with FISMA. Appendix II contains these  recommendations.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a copy of a draft of this report to OMB and all 24  departments and agencies for review and comment. We received written  comments from 12 agencies which are reprinted in appendices III through  XIV. We received comments by email from 5 agencies and no comments  from the remaining agencies. We also received technical comments from  three agencies that we incorporated into the report as appropriate.

Of the 13 agencies to which we made specific recommendations, 12  concurred with our recommendations and 9 identified steps that they are  taking or plan to take to address them. One agency, DOD, did not concur  or partially concurred with the three recommendations we made to it. For  a summary of each of the 13 agencies’ comments and our response,  please see appendix II.

In comments provided via e-mail on July 29, 2016, by OMB’s audit liaison  in the Office of General Counsel, OMB stated that it partially concurred  with our recommendation. OMB also stated that it believes that its annual  FISMA 2014 guidance provides sufficient and clear details on the  expectations for agencies, to include procedures for overseeing and  managing their information security programs, and that the guidance  incorporates agency feedback and information security best practices to  better reflect challenges and solutions within the current government  operating environment. OMB noted that developing prescriptive guidance  to address or streamline variances in information security management  practices may unintentionally hamper agencies’ ability to conduct their  missions. It added that, in place of issuing such guidance, OMB plans to  continue utilizing several oversight mechanisms to drive performance and  address challenges, including quarterly FISMA performance reviews and  face-to-face CyberStat Reviews.

We disagree that existing guidance and oversight mechanisms provide  sufficient clarity for agencies on how to implement the new FISMA 2014  provisions. As stated in this report, neither the annual FISMA guidance  nor CyberStat meetings provide guidance for federal agencies on how to  implement the new FISMA 2014 requirements or the CISO’s role in  carrying them out. In addition, OMB’s recently revised Circular A-130 is  clear that the CISO is to have a role in ensuring that all personnel are  held accountable for complying with information security requirements,  but it does not provide guidance on how agencies are to implement this  requirement. As we note in our report, CISOs are not always able to  effectively hold personnel accountable for complying with information  security requirements. Accordingly, additional guidance from OMB  addressing how agencies should ensure that officials carry out their  responsibilities and personnel are held accountable for complying with the  agency-wide information security program could help address many of  the challenges to authority identified by federal CISOs. We therefore  believe our recommendation is warranted.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to interested  congressional committees, the Director of the Office of Management and  Budget, the secretaries and agency heads of the departments and  agencies addressed in this report, and other interested parties. In  addition, this report will be available at no charge on the GAO website at  http://www.gao.gov.

If you have any questions regarding this report, please contact me at  (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix XV.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) identify the key responsibilities of federal chief  information security officers (CISO) established by federal law and  guidance and determine the extent to which federal agencies have  defined the role of the CISO in accordance with this law and guidance  and (2) describe key challenges of federal agency CISOs in fulfilling their  responsibilities to ensure that agency-wide information security programs  are developed, documented, and implemented. The scope of our review  included the 24 major departments and agencies covered by the Chief  Financial Officers Act of 1990.

To identify the key responsibilities of federal CISOs established by federal  law and guidance, we reviewed relevant laws including relevant  provisions of the Federal Information Security Management Act of 2002  (FISMA 2002), the Federal Information Security Modernization Act of  2014 (FISMA 2014) and the Federal Information Technology Acquisition  Reform Act (FITARA). In addition, we reviewed relevant special  publications from the National Institute of Standards and Technology  (NIST) addressing information security management topics and Office of  Management and Budget (OMB) memoranda and circulars addressing  federal information security.

To determine the extent to which federal agencies have defined the role  of the CISO in accordance with law and guidance, we collected  information security policies and procedures from the 24 major  departments and agencies. We then evaluated each agency’s policies to  determine responsibility for ensuring that information security activities  are implemented had been assigned to the CISO in accordance with  FISMA 2014. In addition, we collected and reviewed each agency’s  current organization chart(s) depicting the CISO’s position relative to the  head of the agency, other senior officials, and component CISOs, if  applicable. We also asked each agency to supply the name of each of the  individuals who had served as CISO at the agency since 2010.

To describe key challenges of federal agency CISOs in exercising their  authority to ensure that agency-wide information security programs are  developed, documented, and implemented, we developed and  administered a web-based survey instrument to the CISO at each of the  24 major departments and agencies in coordination with our survey  methodology expert. In the survey, we asked CISOs to identify whether  they felt that they had sufficient levels of responsibility and authority. In  addition, we asked CISOs to identify factors that challenged them in  exercising their authority, and to identify specific challenges related to  these factors. We then reviewed the responses provided by the CISOs  and interviewed each of them in order to validate responses from the  survey and to obtain additional insight into the challenges they identified.  From the survey and interview responses, we analyzed CISOs’  comments to identify challenges common across multiple agencies.

To minimize errors that might occur from respondents interpreting our  questions differently from our intended purpose, we pretested the  questionnaire in person and by phone with the CISOs at three agencies.  The selection of agencies for pretesting was based on agency availability  to assist us with pretesting, variation in size of agency, and variation in  agency security governance models (i.e., centralized or decentralized).  During these pretests, we asked each CISO to complete the survey as we  listened to the process. We then interviewed the respondents to check  whether the questions were applicable, clear, unambiguous, and easy to  understand. We then revised the survey based on the feedback provided  during the pretests prior to sending the final survey to the agency CISOs.  All 24 Chief Financial Officers Act agency CISOs completed the final  survey, although not all survey respondents answered every question.

The practical difficulties of conducting any survey may introduce non- sampling errors. For example, differences in how a particular question is  interpreted, the sources of information available to respondents, or the  types of respondents who do not respond to a question can introduce  errors into the survey results. We included steps in both the data  collection and data analysis stages to minimize such non-sampling errors.  We examined the survey results and performed computer analyses to  identify inconsistencies and other indications of error, and addressed  such issues as necessary. We analyzed responses to closed-ended  questions by counting the responses for all agencies. For questions that  asked respondents to provide a narrative answer, we compiled the  answers in one spreadsheet that was analyzed and used as examples in  the report.

To assess any OMB efforts to provide guidance on the implementation of  new FISMA 2014 requirements for agencies to ensure that senior officials  carry out their responsibilities and to hold personnel accountable, we  analyzed OMB memoranda establishing requirements for federal  information security to determine whether they addressed matters of  information security governance and the role of the CISO. We also met  with representatives from OMB to obtain their views on the new FISMA  requirements, the role of CISOs in carrying them out, and the role of OMB  in providing guidance for agencies in implementing the new requirements.

We conducted this performance audit from June 2015 to August 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: Recommendations to Departments and Agencies
subsections: section_title: Department of Commerce
paragraphs: To ensure that the role of the chief information security officer (CISO) is  defined in department policy in accordance with the Federal Information  Security Modernization Act of 2014 (FISMA 2014), we recommend that  the Secretary of Commerce take the following action:

Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption.

In its comments on a draft of this report, the Department of Commerce  concurred with our recommendation and stated that it planned to update  the department’s IT policy and program documents that define the roles  and responsibilities of the CISO by September 30, 2017, with progress to  be tracked quarterly. The department’s comments are reprinted in  appendix III. The department also provided technical comments which we  have incorporated into the final report as appropriate.

section_title: Department of Defense
paragraphs: To ensure that the role of the senior information security officer (SISO) is  defined in department policy in accordance with FISMA 2014, we  recommend that the Secretary of Defense take the following three  actions:

Define the SISO’s role in department policy for ensuring that  information security policies and procedures are developed and  maintained.

Define the SISO’s role in department policy for ensuring that the  department has procedures for incident detection, response, and  reporting.

Define the SISO’s role in department policy for oversight of security  for information systems that are operated by contractors on the  department’s behalf.

In its comments on a draft of this report, DOD stated that it did not concur  with the first recommendation and partially concurred with the other two.

Our draft report included five additional recommendations to DOD: that  the department define the SISO's role in department policy (1) for  ensuring that subordinate security plans are documented for the  department's information systems; (2) for ensuring that security controls  are tested periodically; (3) for ensuring that the department has a process  for planning implementing, evaluating, and documenting remedial actions;  (4) for ensuring that plans and procedures are in place to ensure recovery  and continued operations of the department’s information systems in the  event of a disruption, and (5) in the periodic authorization of the  department's information systems. DOD did not concur with four of these  draft recommendations and partially concurred with one of them. DOD  stated that the SISO organization maintains a knowledge service that  provides component organizations with DOD-specific assignment values  for contingency planning security controls, implementation guidance, and  assessment procedures, and that the department’s risk management  framework policy defines the SISO’s role in security planning, security  control testing, remedial actions, and system authorization activities. We  reviewed DOD’s cybersecurity instruction and risk management  framework policy and confirmed that the department’s statements are  accurate. Therefore, we have made appropriate changes in the report to  reflect this information, including withdrawing these five recommendations  from the final report.

DOD did not concur with our recommendation that the department define  the SISO’s role in department policy for ensuring that information security  policies and procedures are developed and maintained. The department’s  response stated that according to the DOD cybersecurity instruction, the  SISO is responsible for directing and coordinating the DOD cybersecurity  program and carrying out the CIO’s responsibilities in accordance with  FISMA 2014; accordingly, the SISO is responsible for developing and  maintaining information security policies as stated in FISMA 2014. The  department also noted that it had provided us with an organization chart  showing that the DOD SISO organization included a cybersecurity policy  division. However, we still believe that the SISO’s role with respect to  information security policies and procedures is not sufficiently defined.  This is because neither the cybersecurity instruction nor any other policy  document provided to us described any specific responsibilities of the  SISO in ensuring that information security policies and procedures are  developed and maintained, nor did they describe the responsibilities of  the cybersecurity policy division. The SISO is the official with  responsibility for directing and coordinating the department’s  cybersecurity program. Therefore, it is important that the SISO’s role in  ensuring that information security policies and procedures are developed  and maintained be clearly defined in DOD policy. We therefore believe  that our recommendation is warranted.

DOD partially concurred with our recommendation that it define the  SISO's role in department policy for ensuring that the department has  procedures for incident detection, response, and reporting. The  department stated that responsibility for managing the incident handling  program has been assigned to Cyber Command within U.S. Strategic  Command by the Secretary of Defense, and that the department’s  incident handling program is documented in Chairman of the Joint Chiefs  of Staff Manual 6510.01 B, "Cyber Incident Handling Program." The  department also noted that the SISO organization plans to publish a new  cyber incident handling manual to replace the existing Chairman of the  Joint Chiefs of Staff Manual. It will be important for the new manual to  clearly define the role of the SISO in the incident handling process. We  therefore continue to believe that our recommendation is warranted.

DOD partially concurred with our recommendation that it define the  SISO's role in department policy for oversight of contractor system  security, and stated that the SISO organization has developed and  maintains policies providing direction to DOD components on oversight of  contractor system security, including policies on defense industrial base  cyber security/information assurance activities and on the security of  unclassified DOD information on non-DOD information systems. DOD  also stated that the SISO will review the CIO and component SISO  responsibilities in the regularly scheduled updates to these policies. The  department further stated that its national industrial security program  operating manual describes that the Director of the Defense Security  Service monitors and oversees information security practices of  contractors and vendors processing classified DOD information, and that  the Defense Federal Acquisition Regulation Supplement Subpart 204.73  requires contractors to implement security requirements.

However, neither the policies on defense industrial base cyber  security/information assurance activities or the security of unclassified  DOD information on non-DOD information systems, the national industrial  security program operating manual, nor the Defense Federal Acquisition  Regulation Supplement specify any roles or responsibilities for the DOD  SISO in the area of contractor system security. While it may be  appropriate to review the responsibilities of the DOD CIO and component  SISOs, because the SISO is the official with responsibility for directing  and coordinating the department’s cybersecurity program, it is important  that the responsibilities of the SISO in overseeing the security of  contractor systems be clearly defined in DOD policy. We therefore believe  that our recommendation is warranted.

DOD’s comments are reprinted in appendix IV.

section_title: Department of Energy
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Secretary of  Energy take the following six actions:

Define the CISO’s role in department policy for ensuring that  subordinate security plans are documented for the department’s  information systems.

Define the CISO’s role in department policy for ensuring that all users  receive information security awareness training.

Define the CISO’s role in department policy for ensuring that the  department has a process for planning implementing, evaluating, and  documenting remedial actions.

Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption.

Define the CISO’s role in department policy for oversight of security  for information systems that are operated by contractors on the  department’s behalf.

Define the CISO’s role in department policy in the periodic  authorization of the department’s information systems.

In its comments on a draft of this report, DOE concurred in principle with  our recommendations, and stated that it is meeting implementation  requirements as stated in FISMA 2014 through delegation memoranda  and other supporting directives in a manner that supports the  department’s diverse missions while focusing on ensuring an enterprise- wide approach to cyber security. The department also agreed that further  codification of the role of the CISO is appropriate within department  policies. DOE stated that it is undertaking a review of its cybersecurity  program order and will consider GAO’s recommendations during that  process.

section_title: Department of Health and Human Services
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Secretary of  Health and Human Services take the following action:

Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption.

In its comments on a draft of this report, HHS concurred with our  recommendation and stated that the updates to policy are to be made in  conjunction with anticipated revisions of NIST SP 800-53, revision 5. The  department’s comments are reprinted in appendix VI.

section_title: Department of the Interior
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Secretary of the  Interior take the following four actions:

Define the CISO’s role in department policy for ensuring that  subordinate security plans are documented for the department’s  information systems.

Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption.

Define the CISO’s role in department policy for oversight of security  for information systems that are operated by contractors on the  department’s behalf.

Define the CISO’s role in department policy in the periodic  authorization of the department’s information systems.

In its comments on a draft of this report, the Department of the Interior  concurred with our four recommendations and stated that it is currently  updating policy to ensure that they are implemented. The department’s  comments are reprinted in appendix VIII.

section_title: Department of Justice
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Attorney General  take the following two actions:

Define the CISO’s role in department policy for ensuring that  information security policies and procedures are developed and  maintained.

Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption.

In its comments on a draft of this report, DOJ concurred with our  recommendations and stated that the department has clarified the CISO  responsibilities in a revised policy which is expected to be released in  August 2016. The department’s comments are reprinted in appendix IX.

section_title: Department of State
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Secretary of State  take the following action:

Define the CISO’s role in department policy for ensuring that the  department has procedures for incident detection, response, and  reporting.

In its comments on a draft of this report, the Department of State stated  that it concurred with our finding and plans to correct policy guidance to  reflect that the Security Infrastructure/Cybersecurity/ Monitoring and  Incident Response Division within the Bureau of Diplomatic Security is the  entity responsible for incident response. Further, it stated that the bureaus  of Information Resource Management and Diplomatic Security are  continuing to work to further coordinate communications for incident  response. The department’s comments are reprinted in appendix X.

section_title: Department of Transportation
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Secretary of  Transportation take the following two actions:

Define the CISO’s role in department policy for ensuring that  subordinate security plans are documented for the department’s  information systems.

Define the CISO’s role in department policy for ensuring that security  controls are tested periodically.

In comments on a draft of this report provided via e-mail on July 22, 2016,  by an Audit Relations Analyst in DOT’s Audit Relations and Program  Improvement office, the department stated that it concurred with the  findings and recommendations in our report.

section_title: Department of the Treasury
paragraphs: To ensure that the role of the CISO is defined in department policy in  accordance with FISMA 2014, we recommend that the Secretary of the  Treasury take the following seven actions:

Define the CISO’s role in department policy for ensuring that  subordinate security plans are documented for the department’s  information systems.

Define the CISO’s role in department policy for ensuring that all users  receive information security awareness training.

Define the CISO’s role in department policy for ensuring that security  controls are tested periodically.

Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption.

Define the CISO’s role in department policy for ensuring that  personnel with significant security responsibilities receive appropriate  training.

Define the CISO’s role in department policy for oversight of security  for information systems that are operated by contractors on the  department’s behalf.

Define the CISO’s role in department policy in the periodic  authorization of the department’s information systems.

In comments on a draft of this report provided via e-mail on August 3,  2016, a representative from Treasury’s Office of the Associate CIO stated  that Treasury concurred with our recommendations. The department also  provided technical comments which we have incorporated into the final  report as appropriate.

section_title: Environmental Protection Agency
paragraphs: To ensure that the role of the senior agency information security officer  (SAISO) is defined in agency policy in accordance with FISMA 2014, we  recommend that the Administrator of the Environment Protection Agency  take the following three actions:

Define the SAISO’s role in agency policy for ensuring that subordinate  security plans are documented for the department’s information  systems.

Define the SAISO’s role in agency policy for ensuring that plans and  procedures are in place to ensure recovery and continued operations  of the department’s information systems in the event of a disruption.

Define the SAISO’s role in agency policy in the periodic authorization  of the department’s information systems.

In its comments on a draft of this report, the Environmental Protection  Agency agreed with our report’s recommendations and stated that the  agency expected to implement them by July 29, 2016. The agency’s  comments are reprinted in appendix XI.

section_title: National Aeronautics and Space Administration
paragraphs: To ensure that the role of the SAISO is defined in agency policy in  accordance with FISMA 2014, we recommend that the Administrator of  the National Aeronautics and Space Administration take the following  action:

Define the SAISO’s role in agency policy for oversight of security for  information systems that are operated by contractors on the agency’s  behalf.

In its comments on a draft of this report, NASA concurred with our  recommendation and stated that the agency expects to implement it by  December 9, 2016. NASA’s comments are reprinted in appendix XII.

section_title: Small Business Administration
paragraphs: To ensure that the role of the CISO is defined in agency policy in  accordance with FISMA 2014, we recommend that the Administrator of  the Small Business Administration take the following action:

Define the CISO’s role in agency policy for ensuring that personnel  with significant security responsibilities receive appropriate training.

In comments on a draft of this report provided via e-mail on July 22, 2016,  a program manager in SBA’s Office of Congressional and Legislative  Affairs stated that the agency agreed with our recommendation and had  no comments on the report.

section_title: U.S. Agency for International Development
paragraphs: To ensure that the role of the CISO is defined in agency policy in  accordance with FISMA 2014, we recommend that the Administrator of  the U.S. Agency for International Development take the following action:

Define the CISO’s role in agency policy for oversight of security for  information systems that are operated by contractors on the agency’s  behalf.

In its comments on a draft of this report, USAID agreed with our  recommendation and stated that the Office of the Administrator, in  coordination with the Office of the Chief Information Officer, will update  operational policy to define the CISO's role for oversight of contractor  system security. The agency’s comments are reprinted in appendix XIII.

section_title: Appendix III: Comments from the Department of Commerce

section_title: Appendix IV: Comments from the Department of Defense

section_title: Appendix V: Comments from the Department of Energy

section_title: Appendix VI: Comments from the Department of Health and Human Services

section_title: Appendix VII: Comments from the Department of Housing and Urban Development

section_title: Appendix VIII: Comments from the Department of the Interior

section_title: Appendix IX: Comments from the Department of Justice

section_title: Appendix X: Comments from the Department of State

section_title: Appendix XI: Comments from the Environmental Protection Agency

section_title: Appendix XII: Comments from the National Aeronautics and Space Administration

section_title: Appendix XIII: Comments from the U.S. Agency for International Development

section_title: Appendix XIV: Comments from the Social Security Administration

section_title: Appendix XV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Nick Marinos (assistant  director), William Cook (analyst in charge), Quintin Dorsey, Wayne  Emilien, Paris Hawkins, Wil Holloway, Alan MacMullin, Lee McCracken,  David Plocher, Kelly Rubin, Edward Varty, Brian Vasquez, and Adam  Vodraska made significant contributions to this report.


Question-summary annotations: questions: question: What agency has the responsibility to ensure that the agency is meeting the requirements of the law?
answer: Under the Federal Information Security Modernization Act of 2014 (FISMA 2014), the agency chief information security officer (CISO) has the responsibility to ensure that the agency is meeting the requirements of the law, including developing, documenting, and implementing the agency-wide information security program.
child_questions: question: What was discovered about 13 of the 24 agencies?
answer: However, 13 of the 24 agencies GAO reviewed had not fully defined the role of their CISO in accordance with these requirements.
child_questions: question: What examples are there of agencies failing to define the role of their CISO in accordance with these requirements?
answer: For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place. Thus, CISOs' ability to effectively oversee these agencies' information security activities can be limited.

questions: question: What did the CISOs report?
answer: The 24 CISOs also reported that other factors posed challenges to their abilities to carry out their responsibilities effectively, including difficulties related to having sufficient staff; recruiting, hiring, and retaining security personnel; ensuring that security personnel have appropriate expertise and skills; and a lack of sufficient financial resources.

question: What is the response of the government?
answer: Several government-wide activities are under way to address many of these challenges.
child_questions: question: What barriers are there to gaining guidance?
answer: However, while the Office of Management and Budget (OMB) has a statutory responsibility under FISMA 2014 to provide guidance on information security in federal agencies, it has not issued such guidance addressing how agencies should ensure that officials carry out their responsibilities and personnel are held accountable for complying with the agency-wide information security program.
child_questions: question: As a result of this guidance, what do agencies struggle to do?
answer: As a result, agencies lack clarity on how to ensure that their CISOs have adequate authority to effectively carry out their duties in the face of numerous challenges.

questions: question: What was the GAO asked to do?
answer: GAO was asked to review current CISO authorities.
child_questions: question: What does this report identify and review?
answer: This report identifies (1) the key responsibilities of federal CISOs established by federal law and guidance and the extent to which federal agencies have defined the role of the CISO in accordance with law and guidance and (2) key challenges of federal CISOs in fulfilling their responsibilities. GAO reviewed agency security policies, administered a survey to 24 CISOs, interviewed current CISOs, and spoke with officials from OMB.

questions: question: What is GAO doing in order to fully define the role of their CISOs?
answer: GAO is making 33 recommendations to 13 agencies to fully define the role of their CISOs in accordance with FISMA 2014.
child_questions: question: What was the response of 13 of the agencies to the recommendations?
answer: Twelve of the 13 agencies concurred with the recommendations addressed to them. One agency partially concurred or did not concur with the recommendations directed to it.

question: What does the GAO believe about these recommendations?
answer: GAO continues to believe that these recommendations are valid and should be implemented as discussed in this report.

question: What other recommendations does the GAO make?
answer: GAO also recommends that OMB issue guidance for clarifying CISOs' roles in light of identified challenges.
child_questions: question: What was the reaction of the OMB?
answer: OMB partially concurred with the recommendation.

question: What does GAO maintain regarding future action?
answer: GAO maintains that action is needed as discussed further in the report.