Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but More Can Be Done to Promote Its Use
Released: 2012-01-09T00:00:00

Letter

Background

Critical infrastructures are systems and assets, whether physical or virtual, so vital to our nation that their incapacity or destruction would have a debilitating impact on national security, economic well-being, public health or safety, or any combination of these. Critical infrastructure includes, among other things, banking and financial institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned by the private sector. As these critical infrastructures have become increasingly dependent on computer systems and networks, the interconnectivity among information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt critical systems, with potentially harmful effects. To better manage cyber-based risks that the nation’s cyber-reliant critical infrastructure faces, public and private organizations use available cybersecurity standards and guidance that promote the security of their critical systems.

Cyber-Reliant Critical Infrastructures Face a Proliferation of Threats

Threats to systems supporting critical infrastructure are evolving and growing. In February 2011, the Director of National Intelligence testified that, in the past year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, including a more than tripling of the volume of malicious software since 2009. Cyber threats can be unintentional or intentional. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists.

GAO, Information Security: TVA Needs to Address Weaknesses in Control Systems and Networks, GAO-08-526 (Washington, D.C.: May 21, 2008). continue to move to networked operations, the threat will continue to grow. Table 1 provides descriptions of common types of cyber exploits.

Reports of cyber attacks illustrate that such attacks could have a debilitating impact on national and economic security and on public health and safety.

In June 2011, a major bank reported that hackers had broken into its systems and gained access to the personal information of hundreds of thousands of customers. Through the bank’s online banking system, the attackers were able to view certain private customer information. In February 2011, media reports stated that computer hackers had broken into and stolen proprietary information worth millions of dollars from the networks of six U.S. and European energy companies. In July 2010, a sophisticated computer attack, known as Stuxnet, was discovered. It targeted control systems used to operate industrial processes in the energy, nuclear, and other critical sectors. It is designed to exploit a combination of vulnerabilities to gain access to its target and modify code to change the process.

Federal Law and Policy Emphasizes Public-Private Coordination and the Provision of Guidance for the Protection of Cyber- Reliant Critical Assets

Federal law and policy have established roles and responsibilities for federal agencies working with the private sector and other entities in enhancing the cyber and physical security of critical public and private infrastructures. These include the Homeland Security Act of 2002, Homeland Security Presidential Directive 7 (HSPD-7), and the National Infrastructure Protection Plan (NIPP). In addition, regulatory entities oversee entities within critical infrastructure sectors and develop and publish various types of cybersecurity guidance to assist their examiners and organizations.

The Homeland Security Act of 2002 created the Department of Homeland Security (DHS). Among other things, it assigned the department the following critical infrastructure protection responsibilities: (1) developing a comprehensive national plan for securing the key resources and critical infrastructures of the United States; (2) assisting in the development and promotion of private sector best practices to secure critical infrastructure; and (3) disseminating, as appropriate, information to assist in the deterrence, prevention, and preemption of, or response to, terrorist attacks.

HSPD-7 established DHS as the principal federal agency to lead, integrate, and coordinate the implementation of efforts to protect cyber- critical infrastructures and key resources. In addition, HSPD-7 identified lead federal agencies, referred to as sector-specific agencies, which are responsible for coordinating critical infrastructure protection efforts with the public and private stakeholders in their respective sectors. For example, the Department of the Treasury and the Department of Health and Human Services are the sector-specific agencies for the banking and finance and the health care and public health sectors, respectively.

The NIPP states that, in accordance with HSPD-7, DHS is a principal focal point for the security of cyberspace and is responsible for coordinating efforts to protect the cyber infrastructure to ensure its confidentiality, integrity, and availability. These responsibilities, among other things, include providing guidance on effective cyber-protective measures, assisting the sector-specific agencies in understanding and mitigating cyber risk, and assisting in developing effective and appropriate protective measures. To accomplish these responsibilities, DHS is to help in the development of comprehensive cybersecurity guidance that homeland security partners may adopt to meet accepted industry-based standards that measurably reduce the risk of cyber disruption or exploitation.

The NIPP also describes a partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. For each sector, the model requires formation of government coordinating councils—composed of federal, state, local, or tribal agencies with purview over critical sectors—and encourages voluntary formation of SCCs—composed of owner-operators of these critical assets (some of which may be state or local agencies) or their respective trade associations. These councils create the structure through which representative groups from all levels of government and the private sector are to collaborate in planning and implementing efforts to protect critical infrastructure. The sector councils are envisioned to be policy- related and to represent a primary point of contact for government to plan the entire range of infrastructure protection activities, including those associated with mitigating cyber threats.

According to the NIPP, sector-specific agencies are to work with their private sector counterparts to understand and mitigate cyber risk by, among other things, determining whether approaches for critical infrastructure inventory, risk assessment, and protective measures address assets, systems, and networks; require enhancement; or require the use of alternative approaches. They are also to review and modify existing and future sector efforts to ensure that cyber concerns are fully integrated into sector security activities and protective activities. Table 2 shows the 18 critical infrastructure sectors and the sector-specific agencies assigned to each sector.

Further, the NIPP called for the sector-specific agencies, in close collaboration with the sector coordinating councils, government coordinating councils, and others, including state, local, and tribal critical infrastructure key resources partners, to develop sector-specific plans and sector annual reports to address how the sectors would implement the national plan, including how the security of cyber and other (physical) assets and functions was to be improved. More specifically, according to the NIPP, sector plans were to, among other things, describe how the sector will identify and prioritize its critical cyber and other assets and define approaches to be taken to assess risks and develop programs to protect these assets, and sector annual reports were to provide status and progress on each sector’s efforts to carry out the sector plans.

In September 2009, we reported that sector-specific agencies had made limited progress in updating their sector-specific plans to fully address key cyber elements. As a result, we recommended that the Secretary of Homeland Security, consistent with any direction from the Office of the Cybersecurity Coordinator, (1) assess whether the existing sector- specific planning process should continue to be the nation’s approach to securing cyber and other critical infrastructure and, in doing so, consider whether proposed and other options would provide more effective results and (2) if the existing approach is deemed to be the national approach, work with the sector-specific agencies to develop their plans to fully address DHS cybersecurity criteria. In response to our recommendations, DHS took steps to make sector-specific planning a priority. For example, in 2009 and 2010, DHS met and worked with the sector-specific agencies and sector representatives to update sector plans with the goal of fully addressing cyber-related criteria. As of October 2011, of the 18 plans, DHS reported that 17 have been finalized and approved and 1 is still in the process of being reviewed.

In addition, DHS’s Quadrennial Homeland Security Review Report identified key strategic outcomes for the department’s safeguarding and securing cyberspace mission, including, among others, that the (1) homeland security partners develop, update, and implement guidelines, regulations, and standards that ensure the confidentiality, integrity, and reliability of systems, networks, and data, and (2) critical infrastructure sectors adopt and sector partners meet accepted standards that measurably reduce the risk of cyber disruption or exploitation.

In addition to public-private partnership-related efforts, regulatory entities oversee entities within critical infrastructure sectors that are under the purview of federal law, regulation, or mandatory standards pertaining to securing privately owned information systems or data. For example, depository financial institutions (such as commercial banks and credit unions) in the banking and finance sector are regulated by members of the Federal Financial Institutions Examination Council (FFIEC). The mechanisms used to perform oversight include continuous examinations, periodic examinations, self-reporting, and compliance reviews, and various types of mechanisms exist to enforce compliance. Federal regulators also develop and publish various types of cybersecurity guidance to assist (1) the examiners and inspectors in carrying out their responsibilities and (2) the regulated entities in fulfilling requirements, addressing specific threats, or mitigating identified risks. For example, FFIEC has issued handbooks that are intended to provide guidance to examiners and organizations.

Many Organizations Develop Cybersecurity Guidance to Help Manage Cyber-Based Risks

Cybersecurity guidance provides general guidelines and principles as well as technical security techniques for maintaining the confidentiality, integrity, and availability of information systems and data. When implementing cybersecurity technologies and processes, organizations can avoid making common implementation mistakes by consulting guidance developed by various other organizations. Public and private organizations may decide to voluntarily adopt this guidance to help them manage cyber-based risks. Some entities may also be required to meet regulations or mandatory requirements that address cybersecurity.

Many organizations exist that develop standards and guidance that, among other things, promote the confidentiality, integrity, and availability of computer systems and information. Examples of such organizations include the following: International Organization for Standardization (ISO): a nongovernmental organization that develops and publishes international standards. The standards, among other things, address information security by establishing guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization.

International Electrotechnical Commission (IEC): an organization for standardization comprising all national eletrotechnical committees. The commission publishes international standards, technical specifications, technical reports, and publicly available specifications and guides. The information security standards address safety, security, and reliability in the design and operations of systems in the power industry, among other things.

The International Telecommunication Union: a United Nations agency whose mission includes, among other things, developing technical standards and providing technical assistance and capacity building to developing countries. The union has also developed technical standards for security and, more recently, engaged in other cybersecurity activities. For example, the union has established a study group for telecommunications security to focus on developing standards and recommendations associated with network and information security, application security, and identity management. Similarly, the union, through its members’ efforts, prepared a report on cybersecurity best practices for countries seeking to organize national cybersecurity efforts.

The International Society of Automation (ISA): a global and nonprofit organization that develops standards for automation. It has developed a series of standards to address security in industrial automation and control systems.

The American National Standards Institute (ANSI): a U.S. organization that is responsible for coordinating and promoting voluntary consensus-based standards and information sharing to minimize overlap and duplication of U.S. standards-related efforts.

In addition, it is the representative of U.S. interests in international standards-developing organizations.

Individual industries and sectors also have their own specific standards. These include standards or guidance developed by regulatory agencies that assist entities within sectors in complying with cybersecurity-related laws and regulations. In addition, organizations that operate in a specific industry develop cybersecurity standards and guidance and promote practices for their industries.

In the United States, the National Institute of Standards and Technology (NIST), a standards-setting agency under the U.S. Department of Commerce, issues Federal Information Processing Standards that, pursuant to the Federal Information Security Management Act of 2002 (FISMA), are mandatory for federal agencies and special publications that provide guidance for information systems security for non-national security systems. For example, NIST Special Publication (SP) 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, provides guidance for an integrated, organizationwide program for managing information security risk to organizational operations, organizational assets, individuals, other organizations, and the nation resulting from the operation and use of NIST also developed a risk management federal information systems.framework that is one of several NIST guidelines for federal agencies to follow in developing information security programs. The framework is specified in NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, which provides agencies with guidance for applying the risk management framework to federal information systems.framework consists of a six-step process involving (1) security categorization, (2) security control selection, (3) security control implementation, (4) security control assessment, (5) information system authorization, and (6) security control monitoring. It also provides a process that integrates information security and risk management activities into the system development life cycle.

NIST SP 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations, provides a catalog of security controls and technical guidelines that federal agencies use to protect federal information and information systems. such as those in the nation’s critical infrastructure sectors, are encouraged but not required to use this NIST guidance where appropriate. Table 3 lists SP 800-53’s 18 control families and the 198 recommended controls.

DHS’s National Cyber Security Division’s Control Systems Security Program has also issued recommended practices to reduce risks to industrial control systems within and across all critical infrastructure and key resources sectors. For example, in April 2011, the program issued the Catalog of Control Systems Security: Recommendations for Standards Developers, which is intended to provide a detailed listing of recommended controls from several standards related to control systems.

Wide Variety of Sector Cybersecurity Guidance Is Available

A wide variety of cybersecurity guidance from national and international organizations is available to critical infrastructure sector entities. Much of this guidance is tailored to the unique characteristics of each sector. Further, entities within regulated subsectors have specific cybersecurity guidance that is required or recommended to be used, while entities operating outside of a regulatory environment have standards and guidance available, but not required, for their use. Furthermore, industry regulators, associations, and other groups have also developed and issued voluntary guidance available for use by entities within their respective sectors that is tailored to the business needs of entities or provides methods to address unique risks or operations.

While SCC representatives confirmed lists of cybersecurity guidance that they stated was used within their respective sectors, the representatives emphasized that the lists were not comprehensive and that additional standards and guidance are likely used within the sectors. In addition, SCC representatives stated that they were not always aware of the extent to which the identified guidance was used by entities within their sectors.

The following discussion describes cybersecurity guidance identified for each of the sectors in our review. A list of specific guidance for each sector is provided in appendix II.

Banking and finance sector: The guidance documents for the banking and finance sector are diverse. For example, federal regulatory entities within the various sector segments issue specific risk-based cybersecurity requirements. In addition, financial institutions and the payment card industry have developed voluntary standards and practices.

FFIEC has issued handbooks that outline cybersecurity requirements for depository institutions within the sector. In addition, federal financial regulators have issued regulations that cover a comprehensive set of high-level requirements, including security programs, risk management, data security, incident response and anti-identity-theft. These regulations are in response to laws such as the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act.

The banking and finance sector-specific plan identified applicable laws, regulations, and a multitude of sector-specific guidance, especially for depository and financial institutions, that covered many cybersecurity topics such as access control authentication and phishing. Each of the FFIEC agencies often issues guidance that is similar in content but tailored to meet its legal requirements. The agencies deliver this guidance through their respective transmittal documents, such as bulletins, financial institution letters, letters to credit unions, and supervisory letters. In addition, according to an SCC representative familiar with cybersecurity guidance associated with the sector, the revision associated with the latest sector-specific plan will have more guidance on the investments and securities subsector.

Communications sector: The guidance documents for the communications sector cover a variety of topics such as telecommunication industry security standards, network engineering standards, and security configuration guides. The SCC representatives familiar with cybersecurity guidance associated with the sector stated that the identified guidance is all widely used within the sector. In addition, the representatives acknowledged that a number of the documents are overlapping and cover similar areas, and that on the basis of its particular needs an entity may select among several. Further, decisions on whether or not to implement a specific practice within guidance depend on the role of the responsible implementer (e.g., service provider, network operator, or equipment supplier) and an understanding of the impact on factors such as the systems, networks, and organizations.

According to SCC representatives responsible for cybersecurity efforts, cybersecurity standards and practices promoted and used by SCC members include those developed by the Alliance for Telecommunications Industry Solutions, Internet Engineering Task Force, and the International Telecommunication Union. For example, the Alliance for Telecommunications Industry Solutions issued a U.S. Standard for Signaling Security–Security Roadmap.

In addition, the Communications Security, Reliability, and Interoperability Council recently published a key guidance document to update and combine a large body of sector cybersecurity practices from a variety of sources. The guidance addresses the following areas: identity management, encryption, vulnerability management, and incident response for wireless, Internet protocol services, network, people, and legacy services. The document includes 397 cybersecurity practices intended to ensure the security of networks and systems for all segments of the communications industry. According to the document, the practices are not overly prescriptive, allowing network service providers, operators, and equipment suppliers enough latitude to make deployment decisions that best suit their business practices, which revolve around technology, capability, and customer requirements.

Energy sector: The energy sector is divided between the electricity and oil and natural gas subsectors. Within the electricity subsector, the Federal Energy Regulatory Commission (FERC) certified the North American Electric Reliability Corporation (NERC) as the Electric Reliability Organization that is responsible for developing reliability standards, subject to FERC oversight, review, and approval. If approved, the standards become mandatory and enforceable in the contiguous 48 states. NERC developed eight cybersecurity standards, which FERC approved in 2008, that address the following topics: critical cyber asset identification, security management controls, personnel and training, electronic security perimeter(s), physical security of critical cyber assets, systems security management, incident reporting and response planning, and recovery plans for critical cyber assets. NERC also publishes security guidelines for companies to consider for protecting electric infrastructure systems, although such guidelines are voluntary and are typically not checked for compliance. For example, NERC’s June 2010 Security Guideline for the Electricity Sector: Identifying Critical Cyber Assets is intended to assist entities in identifying and developing a list of critical cyber assets as described in the mandatory standards.

Cybersecurity guidance for the oil and natural gas subsector has been issued by various related organizations, as has applicable guidance from closely related sectors, such as transportation and chemical. Among others, sector-specific guidance was identified from the American Petroleum Institute, American Gas Association, and the Interstate Natural Gas Association of America. For example, the American Petroleum Institute’s Security Guidelines for the Petroleum Industry address cyber/information technology in the petroleum industry and endorse the ISO/IEC international standard 17799 for creating a cybersecurity program as voluntary guidance.covered various topics, including cryptography, third-party connections, and control systems.

Health care and public health sector: Cybersecurity guidance for the health care and public health sector covers a variety of topics specific to the security of health information. For example, ISO and ASTM International have issued health sector cybersecurity guidance. issued guidance for security management in health, and ASTM International issued guidance on user authentication and authorization. Also, according to a sector coordinating council representative, Electronic Data Interchanges are critical to data exchange within the sector and have cybersecurity implications.and public health sector annual report, the sector is engaged in an international effort to develop standardized security guidelines for health information technology that will facilitate the confidentiality, availability, and integrity of health information systems and the data residing on those systems.

ASTM International was previously known as the American Society of Testing and Materials. implementing an information security program. In addition, a Department of Health and Human Services (HHS) Office for Civil Rights official familiar with health information privacy issues said that the department developed guidance on how to develop a risk-based approach for protecting electronic health information and is working with NIST to develop a self-assessment tool that entities in the health sector can use to assess their security posture.

Information technology sector: Cybersecurity guidance for the information technology sector covers a number of topics, including security management system requirements, operational security, and identity management. Also, the information technology sector’s 2010 sector annual report and information provided by DHS’s National Protection and Programs Directorate reference the following organizations as providing cybersecurity guidance relevant to the sector: the Internet Engineering Task Force, an international organization that develops Internet standards and protocols; ISO/IEC, which provides standards and practices for managing information security systems; the Institute of Electrical and Electronics Engineers, which establishes standards and practices for managing information security systems;and

NIST, which issues special publications and interagency reports.

According to the chairperson of the IT SCC, the IT sector is very complex and there is no “short list” of cyber standards. From the industry’s perspective, there is an “ecosystem of cybersecurity standards” that includes many different components, comprising hundreds, or even thousands, of individual standards related to technologies, practices, and products and that perform a variety of functions such as enabling interoperability and assurance of security policies and controls. Further, the standards ecosystem constantly evolves in response to new technologies, cyber threats and risks, and business models. The SCC chairperson confirmed the identified cybersecurity guidance, as shown in appendix II, as an illustrative list containing examples of cybersecurity guidance available to sector entities.

Nuclear reactors, materials, and waste sector: The cybersecurity- specific guidance for this sector includes documents issued by the Nuclear Regulatory Commission (NRC) and Nuclear Energy Institute. SCC representatives stated that the NRC and Nuclear Energy Institute guidance documents were widely used for nuclear power plants within the sector. NRC, under its regulatory authority, requires, among other things, that licensees provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks. Both NRC and the institute have issued guidance containing methods that entities may use to meet the regulatory requirements. This guidance includes NRC’s Regulatory Guide 5.71 for cybersecurity programs at nuclear facilities, the most recent version of which was issued in January 2010, and the institute’s cybersecurity plan for nuclear power reactors, the most recent version of which was issued in April 2010. NRC officials and institute representatives familiar with both guides stated that they contain similar cybersecurity controls. However, these guides are not substitutes for compliance with regulations, and compliance with the guides is not mandatory. According to NRC representatives responsible for NRC’s cybersecurity-related efforts, the guides provide an approach that the NRC staff deems acceptable for complying with the commission’s regulations regarding the protection of digital computers, communications systems, and networks from a cyber attack. Although licensees may use methods other than those described within this guidance to meet the commission’s regulations, the NRC representatives said that all licensees have used one of these two methods. In addition, the NRC representatives said that they are developing a new guide to facilitate inspections of cybersecurity programs.

NRC’s cybersecurity regulations are currently only applicable to power- generating facilities. The NRC representative familiar with cybersecurity guidance said that, in general, NRC’s rule-making process is based on the risk to the public and has included the issuance of regulations for the power generation facilities first, which are then typically promulgated to and then to other nuclear facilities (such as research fuel cycle facilities,reactors), as needed. Also, NRC issued a series of orders recommending greater cybersecurity after September 11, 2001.

According to the 2010 sector annual report, the Nuclear Sector Cyber Subcouncil is working on a road map to secure control systems in the nuclear sector. The annual report states that the road map will build on existing government and industry efforts to enhance the security of control systems in the power and nonpower reactor segments of the sector, taking into account NRC’s cybersecurity requirements. According to a DHS official, the scope of the road map was limited to commercial nuclear power plants.

Water sector: Cybersecurity guidance for the water sector covers a number of topics, including risk analysis and management and industrial control systems. However, information compiled from the SCC membership and provided by the Secretariat of the Water SCC showed that several documents cited as relevant to cybersecurity were not widely used by entities within the sector for various reasons, including the lack of resources and funding to implement a cybersecurity program. The representatives further stated that while the larger utilities have the staffing levels and budgets that enable them to more fully implement cybersecurity for their control systems, many medium-size or small utilities struggle to maintain the staff needed just to keep their systems properly running.

Furthermore, Water SCC representatives familiar with cybersecurity guidance associated with the sector said that while they have not specified any specific cybersecurity guidance that water utilities are to use, some utilities are using and implementing cybersecurity guidance that has been used in other sectors. Also, the Cybersecurity Working Group of the Water SCC prepared with DHS a road map to define gaps and a strategy for addressing outstanding needs in securing process control systems. It states that planned cybersecurity activities include (1) isolating control systems from public switched networks and (2) adopting recommended practices for control systems in the water sector.

Cross-sector guidance: In addition to sector-specific guidance, cybersecurity guidance from national and international organizations can be and is utilized by sector entities and was frequently mentioned as important in developing sector-specific guidance. These include NIST’s risk management framework and security controls for information systems and industrial control systems; DHS’s recommended security controls for control systems; ISO guidance on establishing an information system security control program, including security control guidance; and the International Society of Automation’s security guidance for industrial control systems.

Implementation of Cybersecurity Can Be Enforced through a Variety of Mechanisms, but More Could Be Done to Disseminate and Promote Guidance

Implementation of cybersecurity guidance can occur through a variety of mechanisms, including enforcement of regulations and voluntarily in response to business incentives; however, responsible federal entities could take additional steps to promote the most applicable and effective guidance throughout the sectors. Entities operating under a federal regulatory environment are required to adhere to cybersecurity standards to meet their regulatory requirements or face enforcement mechanisms. Entities not subject to regulation do not face such enforcement mechanisms, but may voluntarily implement cybersecurity guidance in response to business incentives, such as mitigating risk, ensuring interoperability among systems, or protecting intellectual property. With respect to promoting cybersecurity guidance, sector-specific agencies, and, in particular, DHS, have specific roles to play in coordinating cybersecurity efforts, which include the promotion and dissemination of guidance and practices. While DHS and other agencies have taken a number of steps in this area, more could be done to identify guidance and standards applicable to entities within the sectors and to promote their implementation.

Regulated Entities Are Required to Comply with Federal Cybersecurity Regulations or Face Enforcement Actions

Critical infrastructure entities covered under regulation, such as depository institutions in the banking and finance sector; the bulk power system in the electricity subsector of the energy sector; health care and public health sector; and the nuclear reactors, materials, and waste sector, are regulated by the federal government and thus are required to meet mandatory cybersecurity standards established by regulation under federal law. When an entity is determined to be not compliant with these requirements, various types of enforcement mechanisms can be employed. These mechanisms include administrative actions such as a supervisory directive or memorandum of understanding. More severe enforcement actions include cease and desist orders, remedial directives, revocations of license or certification, and civil monetary penalties.

Depository Institutions (Banking and Finance Sector)

Cybersecurity oversight functions are conducted by FFIEC member agencies through examinations. Subcommittee Chairperson, for most larger financial institutions, examiners have a continuous, on-site presence and are constantly evaluating their assigned financial institutions’ programs, in particular in regard to cybersecurity, which is considered high risk, to ensure that the institutions operate safely and soundly. For smaller financial institutions, examinations for cybersecurity risks occur every 12 to 18 months or after the issuance of significant regulatory guidance.

For example, the Federal Deposit Insurance Corporation can initiate enforcement actions and orders against state nonmember banks, and insured foreign banks. The National Credit Union Administration can initiate enforcement actions and orders against federally insured credit unions and credit union–affiliated parties. The Office of the Comptroller of the Currency can initiate enforcement actions and orders against national banks and federal savings associations, federally chartered branches, and agencies of foreign banks. The Federal Reserve System can initiate enforcement actions and orders against state member banks; financial, bank, and thrift holding companies; and U.S. operations of foreign banking organizations. weaknesses identified by the examiners. Informal enforcement actions can consist of the following: a memorandum of understanding or document of resolution, a supervisory directive, a notice of deficiency and request for a safety and soundness individual minimum capital requirement directives.

Formal actions are authorized by statute and mandated in some cases, are generally more severe, and are disclosed to the public. Depending on whether the institution is a credit union or a bank, formal enforcement actions for any violations of laws and regulations, including various cybersecurity provisions, can take the following forms: cease and desist orders, termination of insurance, and liquidation.

For example, an agency can assess civil monetary penalties of $7,500 per day for any violation of law or regulation, or assess a fine up to $37,000 per day for a violation that is, for instance, likely to cause more than a minimal loss to the financial institution, or assess a penalty of up to $1,375,000 million per day for knowingly engaging, for instance, in any unsafe or unsound practice when the offender knowingly or recklessly caused a substantial loss to the financial institution or received a substantial pecuniary gain or other benefit. However, according to the FFIEC IT Subcommittee Chairperson, while depository institutions have been cited for operating in an unsafe and unsound manner as it relates to cybersecurity, none of these cases have reached the level of formal actions with civil monetary penalties.

Bulk Power System (Electricity Subsector of the Energy Sector)

NERC, as the Electric Reliability Organization, has the authority to enforce compliance with mandatory cybersecurity standards through its Compliance Monitoring and Enforcement Program, subject to FERC review. While FERC has authorized NERC to enforce mandatory reliability standards in the United States, the commission retains its own authority to enforce the same standards and assess penalties for violations. The commission also has the ability to review each penalty NERC proposes for noncompliance with a reliability standard in the United States, either by its own action or upon an appeal by a penalized entity.

Monitoring functions are carried out by NERC inspectors through a number of actions:

Performing compliance audits for bulk power system owners, operators, and users on a schedule established by NERC.

Periodically conducting a self-certification to attest to compliance or noncompliance with reliability standards.

Initiating spot checks or performing compliance violation investigations in response to an event or complaint.

Encouraging self-reporting versus formal NERC reporting when a user, owner, or operator of the bulk power system becomes aware of a violation of a reliability standard or of a change in the violation severity level of a previously reported violation.

Requiring periodic data submissions. Under this circumstance, a team of industry experts is established to review the data and provide a report to NERC.

Requiring technical feasibility exception reporting for the reliability standards that allow such exceptions. Those reliability standards require reporting of exceptions to compliance with the reliability standard and approval by NERC of the exceptions as a form of compliance monitoring.

Reviewing complaints received alleging violations of a reliability standard to determine if a compliance violation investigation is required.

Enforcement mechanisms include monetary penalties, nonmonetary sanctions, and remedial actions, according to NERC sanction guidelines. NERC can levy monetary penalties for the violation of requirements of the reliability standards. For example, NERC or regional entities, upon delegation of NERC’s authority, can impose a monetary penalty or fine of up to $1 million per day per violation, depending on the risk factors and level of violation severity involved. NERC must file all penalties it or a regional entity proposes to impose with FERC. If FERC takes no action after 31 days, the penalties go into effect, or FERC can either reject or take up the proposed penalty for further action. Entities can appeal the penalties with FERC.

For the month of July 2011, a Notice of Penalty was issued for violations of NERC Cyber Security Standards, one of which included a high violation risk factor that had a monetary penalty of $75,000 imposed, according to NERC’s publicly available enforcement information on penalties. In addition, there were 65 cybersecurity violations with a medium violation risk factor reported that had total monetary penalties of approximately $496,000 imposed and 24 cybersecurity violations with a low violation risk factor that had total monetary penalties of approximately $375,000 imposed.

NERC, the regional entities, and FERC can also levy nonmonetary sanctions against a violator that include limitations or restrictions that may result in economic or other impacts. In addition to monetary and nonmonetary sanctions, NERC, the regional entities, and FERC can direct bulk power system entities to take remedial action to correct conditions, practices, or any other relevant action or activity underlying the noncompliance involved, including cybersecurity-related issues. For example, remedial actions may include the following: specifying operating or planning criteria, limits, or limitations; requiring specific system studies; defining operating practices or guidelines; requiring confirmation of data, practices, or procedures through inspection testing or other methods; requiring specific training for personnel; and requiring development of specific operating plans.

HHS’s Office for Civil Rights (OCR) is responsible under HIPAA for oversight and enforcement of the protection of electronic protected health information held by covered entities within the health care and public health sector. Cybersecurity requirements are also applicable to this sector’s reimbursement and supply chain functions.

Oversight of HIPAA’s Security Rule is carried out through compliance reviews and complaints that can be received through one of HHS’s 10 regional offices. According to an OCR official familiar with health information privacy issues, HHS has undertaken oversight of Security Rule compliance. For example, during calendar year 2010, HHS reported opening 243 complaints and compliance reviews involving Security Rule issues, which represents a 95 percent increase in the number of Security Rule cases opened over the average caseload of the previous 4 years. In addition, OCR reported resolving a total of 128 complaints, which is an increase of 16 percent over the average number of resolved complaints in the previous 4 years. More importantly, 55 percent of the resolved complaints required the regulated entity to take corrective action to achieve compliance with the Security Rule, whereas on average only 18 percent of the resolved complaints in prior years required such action.

Additionally, HIPAA-covered entities and their business associates are to provide notification following a breach of unsecured protected health information. Clinical Health Act’s Breach Notification Interim Final Rule, OCR processes and initiates investigations of reports involving 500 or more individuals. According to the OCR health information privacy official, since the inception of the breach notification requirement, over 70 percent of the 280 major breaches reported (as of May 30, 2011) involved electronic protected health information, and thus required investigation for Security Rule compliance. Of these cases, the official stated that 6 percent of breach reports involving more than 500 individuals have been due to hacking or cybersecurity incidents, compared with 67 percent of these breaches being due to the physical loss or theft of protected health information.

Under the Health Information Technology for Economic and Enforcement mechanisms include the imposition of civil money penalties for violations. HHS can levy fines or penalties for failure to comply with the cybersecurity standards or specifications of the Security Rule, Privacy Rule, and Breach Notification Interim Final Rule.

Breach notification was implemented under the Health Information Technology for Economic and Clinical Health (HITECH) Act.

When considering civil monetary penalties, there are four categories of violations that reflect increasing levels of culpability. The categories and minimum penalties are as follows: For each violation, the maximum penalty amount in every category is $50,000. For multiple violations in a calendar year, the maximum penalty amount in each category is $1.5 million. HHS determines the penalty amounts based on the nature and extent of the violation, resulting harm, and other factors.

The OCR health information privacy official also indicated that the office has executed resolution agreements and corrective action plans in several cases where investigation has found systemic failures to comply with the Security Rule for protecting electronic health information. For example, the official stated that OCR executed a resolution agreement with a major university in the amount of $865,000, which also included a 3-year corrective action plan to implement stronger safeguards for electronic protected health information as well as comprehensive employee training on the appropriate use of patient information. In another case, OCR executed a resolution agreement with a major hospital in the amount of $1 million that included a 3-year corrective action plan to address stronger safeguards for the removal of protected health information from the hospital by employees for work-related purposes, including the removal of electronic protected health information.

Nuclear Reactors (Nuclear Reactors, Materials, and Waste Sector)

NRC is responsible for both physical security and cybersecurity oversight. To enhance its current cybersecurity program, NRC has issued a cybersecurity-focused regulation and a cybersecurity regulatory guide.

Current cybersecurity oversight functions are carried out through inspections of licensed facilities to ensure that they are in compliance with NRC regulations and the terms of their licenses. Although NRC has not imposed a civil penalty for cybersecurity violations at its facilities under its current enforcement policy, failure to comply with NRC’s regulations may result in the imposition of enforcement sanctions such as notices of violation, civil penalties, and the issuance of orders.

Prior to implementing its new cybersecurity program, NRC must review and approve the cybersecurity plans for all operational nuclear power plants. Once a cybersecurity plan is approved for a particular nuclear power plant, implementing the program defined within that plan becomes both a condition of that plant’s operating license and an inspection requirement.

In addition to approving cybersecurity plans, NRC is also developing a cybersecurity inspection program that is scheduled for implementation during 2012 and is in the early stages of revising its cybersecurity enforcement policy to account for the new cybersecurity inspection program. The cybersecurity inspection program will be implemented in three stages. In the first stage, NRC intends to develop its initial inspection guidance. In the second stage, NRC intends to commence specialized inspector cybersecurity training and education in preparation for on-site cybersecurity inspections at licensed facilities. In the final stage, NRC will leverage the results of and the insights gained from its initial inspections to develop program guidance and procedures for future periodic inspections.

Finally, NRC is in the early stages of revising its cybersecurity enforcement policy to account for the new cybersecurity inspection program.

Although No Enforcement Mechanisms Exist, Nonregulated Entities Have Business Reasons to Implement Cybersecurity Based on Available Guidance

According to officials familiar with cybersecurity issues in their respective SCCs, the information technology, communications, and water critical infrastructure sectors and oil and natural gas subsector of the energy sector are not subject to direct federal cybersecurity-related regulation.

Although the use of cybersecurity guidance is not mandatory, entities may voluntarily implement such guidance in response to business incentives, including to mitigate risks, protect intellectual property, ensure interoperability among systems, and encourage the use of leading practices. For example, officials familiar with cybersecurity issues from both the communications sector and information technology sector stated that the competitive market place, desire to maintain profits, and customer expectation of information security—rather than federal regulation—drive the adoption of best practices. Oil and gas SCC officials said that their member companies are not required to follow industry guidelines, but legal repercussions regarding standard of care may motivate the incorporation of such cybersecurity standards into their operations.

DHS and Sector-Specific Agencies Have Taken Steps to Disseminate and Promote Guidance, but More Could Be Done

As recognized in federal policy, the dissemination and promotion of cybersecurity standards and guidance is a goal in enhancing the security of our nation’s cyber-reliant critical infrastructure. The NIPP states that, in accordance with HSPD-7, DHS is a principal focal point for the security of cyberspace and is responsible for coordinating efforts to protect the cyber infrastructure to ensure its confidentiality, integrity, and availability. These responsibilities, among other things, include providing guidance on effective cyber-protective measures, assisting the sector-specific agencies in understanding and mitigating cyber risk, and assisting in developing effective and appropriate protective measures. To accomplish these responsibilities, DHS is to help in the development of comprehensive cybersecurity guidance that homeland security partners may adopt to meet accepted industry-based standards that measurably reduce the risk of cyber disruption or exploitation.

In this regard, DHS and the other sector-specific agencies for the sectors selected for review have disseminated and promoted cybersecurity guidance among and within sectors. For example, officials from DHS’s National Cybersecurity Division (NCSD) stated that they work within the public-private partnership model to identify and prioritize cybersecurity risks within sectors, then coordinate with the sectors to encourage entities to adopt cybersecurity guidance to mitigate identified vulnerabilities. NCSD also engages with standards-developing organizations to provide input, resources, and support. For example, NCSD has provided resources, including time and expertise, supporting the development of security standards with NIST, ANSI, ISO, and the International Telecommunication Union. In addition, NCSD leverages a variety of resources to promote specific cybersecurity standards and practices. For example, through its Control Systems Security Program, NCSD has taken several actions, such as developing a catalog of recommended security practices for control systems, developing a cybersecurity evaluation tool that allows asset owners to assess their control systems and overall security posture, and collaborating with the Industrial Control Systems Joint Working Group to promote control standards and system security.

In addition, officials from the Department of Energy’s Office of Electricity Delivery and Energy Reliability stated that the department, as the energy- sector-specific agency, is involved in many ongoing efforts to assist the sector in the development, assessment, and sharing of cybersecurity standards. For example, the department is working with NIST to enable state power producers to use current cybersecurity guidance. The department is also the Vice Chair of the Cyber Security Working Group and provides funds that will enable private sector power producers to share practices. In addition, according to Department of Energy officials, the department is currently leading an initiative to develop a risk management guideline for the electric grid to ensure that cybersecurity risks are addressed at the organization, mission or business process, and information system levels. This is modeled after NIST Special Publication 800-39 and tailored to the needs of the energy sector. Further, Department of Health and Human Services officials responsible for the agency’s sector-specific efforts also stated that they encourage the sharing of existing standards. For example, a public-private cybersecurity workgroup was formed that developed a cybersecurity primer to educate members of the sector.

While these are significant steps, DHS and the other sector-specific agencies have not identified the key cybersecurity guidance applicable to or widely used in each of their respective critical infrastructure sectors. In addition, DHS guidance for preparing the sector-specific critical infrastructure protection plans calls for, among other things, outlining the sector’s cyber protection and resilience strategies; however, these plans largely do not identify key guidance and standards for cybersecurity. Specifically, only one of the seven sectors reviewed (banking and finance) listed cybersecurity guidance in its current sector-specific plan. The other six sectors mentioned certain guidance in these plans, but did not list applicable guidance.

Sectors reported that they did not identify this guidance in their plans in part because DHS did not specifically address listing cybersecurity guidance in its guidance for the revision of the sector-specific plans. In addition, officials from DHS’s NCSD noted that their engagement in the area of standards focuses on promoting standards and practices from a cross-sector perspective, rather than focusing on individual sectors. However, given the plethora of guidance available, individual entities within the sectors may be challenged in identifying the guidance that is most applicable and effective in improving their security posture. Improved knowledge of the guidance that is available could help both federal and private sector decision makers better coordinate their efforts to protect critical cyber-reliant assets.

Cybersecurity Guidance For Three Subsectors Is Substantially Similar to Federal Guidance

Sector cybersecurity guidance related to three subsectors (electricity, depository institutions, and nuclear reactors) is substantially similar to guidance applicable to federal agencies. Specifically, sector cybersecurity guidance and supplementary documents that we analyzed addressed most of NIST’s risk management framework steps and most of the 198 recommended security controls in NIST SP 800-53 (listed in table 3) that are specified for federal information systems. In cases where differences existed in terms of security controls, sector representatives provided supplementary documents with controls that resolved the difference, or explained that some federally recommended security controls were not applicable for sector-specific reasons.

Bulk Power System (Electricity Subsector of the Energy Sector)

NERC Cyber Security Standards 002 through 009, Version 3, and supplementary documents are substantially similar to guidance applicable to federal agencies. As discussed previously, the NIST risk management framework describes the activities important to an effective information security program (e.g., categorize information systems, select security controls). Similarly, the NERC Cyber Security Standards provide a cybersecurity framework for the identification and protection of entity- identified critical cyber assets to support reliable operation of the bulk power system.Security Management Controls and Systems Security Management), which contain mandatory and enforceable minimum security requirements (e.g., critical cyber asset identification and cyber vulnerability assessment).

The standards also cover eight cybersecurity areas (e.g., As discussed previously, NIST SP 800-53, Revision 3, addresses one of the steps in the NIST risk management framework, which is to select a baseline of security controls and tailor and supplement the baseline based on an organizational risk assessment. SP 800-53 contains 18 control families (e.g., Access Control and Risk Assessment), which in total, contain 198 recommended security controls (e.g., Account Management and Malicious Code Protection) for federal information systems and organizations.

We determined that the eight NERC Cyber Security Standards and supplementary documents addressed 151 of the 198 SP 800-53 controls, and NERC officials responsible for the Cyber Security Standards deemed 46 of the remaining controls to be not applicable, and stated that 1 control—transmission integrity—was not considered when revising the latest NERC Cyber Security Standards. The NERC officials provided specific reasons as to why the 46 controls were not applicable to the bulk power system, as illustrated by the following examples:

A control had the potential to increase risk to operations of bulk power system entities.

A control was inappropriate and not feasible in a real-time control system environment.

A control did not have universal applicability.

A control based on FISMA compliance did not apply to the bulk power system environment.

Additionally, the NERC officials expressed their concerns about comparing NERC Cyber Security Standards with those of SP 800-53. They said that the authority and scope of their standards derived from Section 215 of the Federal Power Act, as amended, while SP 800-53 derived from FISMA; therefore, the intended purpose of their standards is different from that of the guidance for federal agencies. The officials also said that the NERC Cyber Security Standards are mandatory and enforceable, whereas SP 800-53 provides a menu of possibilities to choose from depending on the specific situation and relies on the concepts of compensating controls and risk management to make trade- offs.

Table 4 provides a summary of the comparison between the electricity subsector guidance and federal guidance, including the controls deemed not applicable by sector officials.

Examples of commonalities between the electricity subsector cybersecurity guidance and federal guidance, as well as the controls deemed not applicable, are described below.

Commonality: SP 800-53 recommends that personnel report suspected security incidents to the organizational incident response capability and report security incident information to designated authorities. The NERC Cyber Security Standard on Incident Reporting and Response Planning contains a similar control by requiring that the responsible entity report cybersecurity incidents to the Electricity Sector Information Sharing and Analysis Center.

Commonality: SP 800-53 recommends protecting the confidentiality of transmitted information. NERC Security Guidelines for the Electricity Sector, Protecting Potentially Sensitive Information, Version 1.0, contain a similar control by specifying that, among other things, critical infrastructure owners and operators should have an information security or confidentiality policy in place as an integral part of their business-level policies and that the policy should address the production, storage, transmission, and disposal of both physical and electronic information.

Commonality: SP 800-53 recommends maintaining and monitoring temperature and humidity levels within the facility where the information system resides to prevent fluctuations potentially harmful to the information system. The NERC officials stated that the physical infrastructure requirements in the Emergency Preparedness and Operations Reliability Standards require backup control center functionality in the event of any kind of failure of the primary control center.

Not applicable: SP 800-53 recommends implementing a session lock control after a period of inactivity or upon receiving a request from a user. According to the NERC officials, this control is not applicable and not feasible in a real-time control system environment because session lock on an operational console could result in a loss of system operations and system monitoring, leading to a loss of present situational awareness. The NERC officials also stated that a lack of situational awareness was a key factor leading to the August 14, 2003, blackout.

Not applicable: SP 800-53 recommends employing virtualization techniques to present information system components as other types of components, or components with differing configurations. According to the NERC officials, given the variety of technology and scale implemented by their members, this control would not have universal applicability.

Not applicable: SP 800-53 recommends separating duties of individuals as necessary to prevent malevolent activity without collusion. According to the NERC officials, the control is not applicable because it would have the potential to increase risk to operations of bulk power system entities. The NERC officials also stated that the electricity industry typically maintains a practice of separation of duties between IT system developers and support, but placing further separation of duties requirements on operations personnel would result in decreased operational responsiveness and reliability.

Depository Institutions (Banking and Finance Sector)

The FFIEC IT Examination Handbook (IT Handbook), which is composed of 11 booklets, is substantially similar to guidance applicable to federal agencies. Similar to the NIST risk management framework, the IT Handbook addresses various information technology topics (e.g., information security, operations, and management). Specifically, the Information Security Booklet is intended to provide guidance to examiners and organizations for assessing the level of security risks to the organization and evaluating the adequacy of the organization’s risk management. In addition, this booklet states that financial institutions protect their information by instituting a security process that identifies risks, forms a strategy to manage the risks, implements the strategy, tests the implementation, and monitors the environment to control the risks.

We determined that the IT Handbook addressed 196 of 198 SP 800-53 controls; the FFIEC officials deemed the remaining 2 controls to be not applicable. Additionally, FFIEC officials responsible for cybersecurity- related issues and guidance expressed concerns about comparing NIST guidelines with those of the IT Handbook. According to the FFIEC officials, although the general purpose for both information resources is to protect information security assets, the process by which they communicate their intended purpose is different. Specifically, according to these officials, while many NIST controls directly compare with those of the IT Handbook, the target audiences are vastly different. The IT Handbook provides a higher-level overview (i.e., risk-based principles) detailing the controls and standards, while NIST describes specific controls for a standard. Therefore, comparisons between the two sets of guidance can best be accomplished by comparing information security concepts and principles.

Table 5 provides a summary of the comparison between the banking and finance sector cybersecurity guidance and federal guidance, including the controls deemed not applicable by sector officials.

Examples of commonalities between the banking and finance sector cybersecurity guidance and federal guidance, as well as the controls deemed not applicable, are described below.

Commonality: SP 800-53 recommends implementing a session lock control after a period of inactivity or upon receiving a request from a user. The IT Handbook contains a similar control by specifying that controls include automatically logging the workstation out after a period of inactivity and heuristic intrusion detection.

Commonality: SP 800-53 recommends usage restrictions and implementation guidance for wireless access. The IT Handbook contains a similar control by specifying that financial institutions determine whether appropriate device and session authentication takes place, particularly for remote and wireless machines.

Not applicable: SP 800-53 recommends identifying specific user actions that can be performed on the information system without identification or authentication. According to the FFIEC officials, this control is not applicable because it would be excessive and burdensome to identify user actions within systems that do not require controls to protect sensitive, classified, or nonpublic information. In addition, the Information Security Booklet provides guidance as to how access should be given (i.e., sufficient access required to perform the work to be done).

Not applicable: SP 800-53 recommends employing diverse information technologies in the implementation of the information system to reduce the impact of the exploitation of a specific technology. According to the FFIEC officials, this control is not applicable because it could add complexity and management overhead that could lead to mistakes and misconfigurations that could increase overall risk.

Nuclear Reactors (Nuclear Reactors, Materials, and Waste Sector)

NRC Regulatory Guide 5.71, Cyber Security Programs for Nuclear Facilities (RG 5.71) and supplementary documents are substantially similar to guidance applicable to federal agencies. According to NRC representatives responsible for NRC’s cybersecurity-related efforts, RG 5.71 sets forth methods that NRC has found acceptable for licensees to use in complying with the requirements of 10 CFR §73.54. Similar to the NIST risk management framework, these methods describe the activities important to an effective cybersecurity program for nuclear power plants. For example, RG 5.71 provides a method to aid in the categorization and identification of digital assets that must be protected from cyber attacks. It also provides a method to address and manage the potential cybersecurity risks of digital assets by applying a defensive architecture and a collection of security controls. Moreover, according to RG 5.71, it is based on standards provided in NIST SP 800-53 and NIST SP 800-82, among others.

Further, we determined that RG 5.71 and supplementary documents addressed 178 of 198 SP 800-53 controls, and the NRC representatives deemed the remaining 20 controls to be not applicable to their sector. Although not exactly a one-to-one match, the security controls in RG 5.71 often closely resembled the language and terminology of security controls found in SP 800-53. However, according to NRC, where applicable, the security controls in RG 5.71 have been tailored for nuclear power plants by leveraging NIST guidance in appendix I of SP 800-53 on tailoring security controls for industrial control systems. The NRC representatives provided specific reasons why the 20 controls were not applicable, as illustrated by the following examples:

A control is not allowed because it would have a direct impact on the operational integrity of safety functions at a nuclear power plant.

A control is not within the scope of NRC’s regulatory authority.

A control was not selected because it is not included in the NIST security control baseline for industrial control systems in NIST SP 800-53, Revision 3, Appendix I.

Table 6 provides a summary of the comparison between the nuclear sector cybersecurity guidance and federal guidance, including the controls deemed not applicable by sector representatives.

Examples of commonalities between the nuclear sector cybersecurity guidance and federal guidance, as well as the controls deemed not applicable, are described below.

Commonality: SP 800-53 recommends basic security awareness training to all information system users. RG 5.71 contains a similar control by specifying that, among other things, the licensee or applicant establish, implement, and document training requirements for training programs to provide basic cybersecurity training for facility personnel.

Commonality: SP 800-53 recommends protection against supply chain threats by employing defense-in-breadth strategy. RG 5.71 contains a similar control by specifying that the licensee or applicant protect against supply chain threats and vulnerabilities by employing the following measures: establishing trusted distribution paths, validating vendors, and requiring tamper-proof products or tamper-evident seals on acquired products.

Commonality: SP 800-53 recommends enforcing a limit of consecutive invalid access attempts by a user. RG 5.71 contains a similar control by specifying that the licensee or applicant ensure that security controls are implemented to limit the number of invalid access attempts by a user.

Not applicable: SP 800-53 recommends limiting the number of concurrent sessions for each system account. According to the NRC representatives, the concurrent session control is not applicable because it was determined that implementation of this control presents a safety risk to digital safety systems, or that systems under the scope of NRC regulations cannot support concurrent session control.

Not applicable: SP 800-53 recommends protecting information systems from damage resulting from water leakage by providing master shutoff valves that are accessible to key personnel. According to the NRC representatives, as a result of their tailoring process, the control was not selected as part of the final security control baseline in RG 5.71 because systems used at nuclear power plants are designed and built to maintain the safe operation of the plant in the event of flooding. Additionally, plant operators who are licensed by NRC are authorized to manipulate components in the facilities to control their plants.

Not applicable: SP 800-53 recommends all capital planning and investment requests include the resources needed to implement the information security program and document all exceptions to this requirement. According to the NRC representatives, this security control is not necessary as licensees, by definition, must have the resources to implement their cybersecurity programs.

Conclusions

A wide variety of cybersecurity guidance is available to owners and operators of our nation’s cyber-reliant critical infrastructure. Both required and voluntary guidance has been developed and issued by industry regulators, associations, and other groups that is tailored to the business needs of entities or provides methods to address unique risks or operations. While entities operating in a federal regulatory environment face enforcement mechanisms for not adhering to standards in regulatory requirements, entities not subject to regulation do not face such enforcement mechanisms, but implement such guidance to, among other things, mitigate risks, maintain profits, and meet customer expectations. In carrying out their responsibilities for coordinating efforts to protect the cyber-critical infrastructure, DHS and the other sector-specific agencies have taken steps to disseminate and promote cybersecurity guidance. However, these agencies have not identified the guidance applicable to or widely used in each of their respective critical infrastructure sectors. In addition, most sectors reviewed had not specified available guidance in their respective planning documents, in part because DHS’s planning guidance did not suggest the inclusion of cybersecurity guidance. Given the plethora of guidance available, individual entities within the sectors may be challenged in identifying the guidance that is most applicable and effective in improving their security posture. Greater knowledge of the guidance that is available could help both federal and private sector decision makers better coordinate their efforts to protect critical cyber- reliant assets. Finally, the sector-specific cybersecurity guidance that we compared was substantially similar to guidance applicable to federal agencies.

Recommendation for Executive Action

We recommend that the Secretary of Homeland Security, in collaboration with the sector-specific agencies, sector coordinating councils, and the owners and operators of cyber-reliant critical infrastructure for the associated seven critical infrastructure sectors, determine whether it is appropriate to have key cybersecurity guidance listed in sector plans or annual plans and adjust planning guidance accordingly to suggest the inclusion of such guidance in future plans.

Agency Comments and Our Evaluation

DHS provided written comments on a draft of our report (see app. III), signed by DHS’s Director of Departmental GAO/OIG Liaison Office. In its comments, DHS concurred with our recommendation and stated that the department will initiate steps to implement it. In particular, DHS stated that it will work with its public and private sector partners to determine whether it is appropriate to have cybersecurity guidance drafted for each sector. DHS also indicated that the National Cyber Security Division will explore these issues with the cross-sector community.

NRC also provided written comments on a draft of our report (see app. IV), signed by the Executive Director for Operations. NRC generally agreed with the draft report.

DHS, NRC, the Department of Commerce, the Department of the Treasury, EPA, FERC, FFIEC, and HHS, also provided technical comments, which we incorporated, where appropriate. In addition, we provided relevant sections of the draft report to private sector participants. We received technical comments via e-mail from some, but not all, of these parties and incorporated their comments, where appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees; the Secretaries of Commerce, Energy, Health and Human Services, Homeland Security, and the Treasury; Administrator, Environmental Protection Agency; Executive Director, Federal Energy Regulatory Commission; Executive Secretary, Federal Financial Institutions Council; Executive Director for Operations, Nuclear Regulatory Commission; Director, Office of Management and Budget; and other interested congressional and private sector parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact Gregory Wilshusen at (202) 512-6244, or by e-mail at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify (1) cybersecurity guidance for entities within selected critical infrastructure sectors, (2) the extent to which implementation of cybersecurity guidance is enforced and promoted within selected sectors, and (3) areas of commonalities and differences that exist between sectors’ cybersecurity guidance and guidance applicable to federal agencies.

We focused our efforts on seven sectors: banking and finance; communications; energy (electricity and oil and natural gas); health care and public health; information technology; nuclear reactors, materials, and waste; and water. We selected these seven sectors because they are cyber-reliant or have a pervasive impact on the public’s health and welfare. This determination was based on our analysis of the critical infrastructure sectors and interviews with agency officials and representatives from the sector coordinating councils. Our findings and conclusions are based on information gathered from the seven critical infrastructure sectors and are not generalizable to a larger population.

To identify cybersecurity guidance for entities within the critical infrastructure sectors, we identified and analyzed cybersecurity standards and guidance developed by federal and international standards development communities; cybersecurity policies and requirements developed by regulators for their industry; and specific industry standards, guidance, and practices developed by industry associations or groups. We interviewed sector coordinating council representatives for the seven critical infrastructure sectors to determine the cybersecurity standards used in their specific areas. On the basis of the information gathered, we developed lists of cybersecurity guidance for each sector. We provided those lists to representatives from the respective sector coordinating councils to confirm and update and to verify the applicability of the identified guidance to entities within their respective sectors.

To identify the extent to which cybersecurity guidance is enforced within the selected sectors, we gathered and analyzed related GAO reports, federal laws, regulations, and regulatory guidance to determine the various types of enforcement mechanisms that can be employed to ensure compliance. In addition, we interviewed representatives from regulatory entities: the Federal Energy Regulatory Commission, the Federal Financial Institutions Examination Council, the Nuclear Regulatory Commission, the North American Electric Reliability Corporation, and the Department of Health and Human Service’s Office for Civil Rights. We also interviewed representatives from the sector coordinating councils to identify which critical infrastructure sectors have mandatory and enforceable cybersecurity guidance. To determine efforts to identify and promote cybersecurity guidance, we collected and analyzed related federal law and policy to determine the responsibilities of the Department of Homeland Security (DHS) and the other sector-specific agencies for the seven selected sectors. In addition, we collected and analyzed the most current approved sector-specific plans, annual reports, and other related documents for the seven sectors reviewed to determine the extent of cybersecurity guidance included in the plans. Further, to determine DHS and sector-specific agency efforts related to cybersecurity standards, we interviewed sector-specific agency representatives for the seven critical infrastructure sectors to understand their programs and efforts in promoting the use of cybersecurity standards, and then collected and analyzed related supporting evidence.

To identify areas of commonalities and differences that exist between sectors’ cybersecurity guidance and guidance applicable to federal agencies, we selected, analyzed, and used National Institute of Standards and Technology (NIST) Special Publication 800-37, Revision 1: Guide for Applying the Risk Management Framework to Federal Information Systems, A Security Life Cycle Approach (February 2010), and NIST Special Publication 800-53, Revision 3: Recommended Security Controls for Federal Information Systems and Organizations (May 2010). On the basis of our analysis of these NIST documents, we identified key elements of managing cyber risk and 198 recommended security controls. To select the sector guidance to compare with guidance applicable to federal agencies, we judgmentally selected three subsectors from three different regulated sectors: the banking and finance (financial depositories); nuclear reactors, materials, and waste (reactors); and energy (bulk power) sectors. For each subsector, sector representatives identified the respective set of guidance as being widely used by entities in the sectors to meet cybersecurity-related regulatory requirements. We compared the sector cybersecurity guidance with NIST’s risk management elements and recommended security controls. After our initial comparison, we interviewed relevant representatives from the regulatory entities and gathered and analyzed supplemental documentation.

We conducted this performance audit from October 2010 to December 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Cybersecurity Guidance Applicable within Critical Infrastructure Sectors

This appendix contains tables listing cybersecurity guidance identified as applicable to entities within the seven critical infrastructure sectors: banking and finance; communications; energy (electricity and oil and natural gas); health care and public health; information technology; nuclear reactors, materials, and waste; and water. These lists should not be considered to include all cybersecurity guidance that may be available or used within the sector and include cybersecurity guidance that has been withdrawn by the publisher. Sector coordinating council representatives for each of the seven critical infrastructure sectors confirmed and provided additional examples, when appropriate, of the See cybersecurity guidance applicable to entities within their sectors.tables 7 through 13 for the specified guidance.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: Comments from the Nuclear Regulatory Commission

Appendix V: GAO Contacts and Staff Acknowledgments

GAO Contacts

Gregory C. Wilshusen, (202) 512-6244 or wilshuseng@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Michael W. Gilmore (Assistant Director), Lon C. Chin, Wilfred B. Holloway, Franklin D. Jackson, Barbarol J. James, Lee McCracken, Krzysztof Pasternak, and John A. Spence made key contributions to this report.