Cybersecurity: Selected Federal Agencies Need to Coordinate on Requirements and Assessments of States
Released: 2020-05-27T00:00:00

Letter

Background

Federal agencies are dependent on information systems and electronic data to process, maintain, and report essential information. Virtually all federal operations are supported by computer systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets.

Federal agencies exchange personally identifiable and other sensitive information with state agencies in the implementation of key federal and state programs. The security of systems and data involved in this exchange of information is vital to public confidence and the nation’s safety, prosperity, and well-being.

Since federal agencies face computerized (cyber) threats that continue to grow in number and sophistication, it is imperative that such information is protected. In recognition of this growing threat, we designated information security as a government-wide high-risk area in 1997. We further expanded this area in 2015 to include protecting the privacy of personally identifiable information.

Federal Law and Policy Set Roles and Responsibilities for Protecting Federal Systems and Managing Cybersecurity Risk

Several federal laws and policies establish requirements for protecting federal systems and managing cybersecurity risks. Specifically, FISMA is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets, as well as the effective oversight of information security risks. The act requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency, including those provided or managed by another entity.

FISMA also assigns government-wide responsibilities to key agencies. For example, OMB is responsible for developing and overseeing implementation of policies, principles, standards, and guidelines on information security in federal agencies, except with regard to national security systems. NIST is also responsible for developing standards for categorizing information and information systems, security requirements for information and systems, and guidelines for detection and handling of security incidents. For example, NIST Special Publication 800-53 provides guidance to agencies on the selection and implementation of information security and privacy controls for systems.

Further, OMB Circular A-130, Managing Information as a Strategic Resource, establishes minimum requirements for federal information security programs and assigns federal agency responsibilities for the security of information and information systems. It requires agencies to implement a risk management framework to guide and inform the categorization of federal information and information systems; the selection, implementation, and assessment of security and privacy controls; the authorization of information systems and common controls; and the continuous monitoring of information systems.

Circular A-130 also requires federal agencies to provide oversight of nonfederal entities—such as state agencies—that use or operate federal information systems, as well as nonfederal entities’ information systems that collect or maintain federal information. In doing so, federal agencies are to ensure that security and privacy controls for such information systems are effectively implemented and comply with NIST standards and guidelines and agency requirements.

Federal agencies may share data with one or more individual component agencies within a state, such as agencies that execute a state’s tax administration, law enforcement, or human services functions. The state’s responsibility for protecting data shared by federal agencies may reside within an individual state agency or it may be a shared responsibility with the state’s chief information officer and CISO. For example, a state CISO may help to manage the protections over centralized information technology (IT) resources that store, process, and transmit federal data for multiple component agencies within the state.

To protect federal data that are shared with state agencies in the implementation of key federal and state programs, federal agencies have developed cybersecurity requirements for state agencies to follow when accessing, storing, and transmitting federal data. Federal agencies are to obtain assurance that state agencies’ security and privacy controls are effectively implemented through independent evaluations. These evaluations include tests and assessments of the effectiveness of state agencies’ information security policies, procedures, and practices. Such assessments are important inputs to decisions by federal officials to authorize or reauthorize a state agency’s use of information systems that create, collect, use, process, store, maintain, disseminate, disclose, and dispose of federal information.

Selected Federal Agencies Have Established Policies and Compliance Assessment Programs to Protect Data Shared with State Agencies

To protect federal data that are shared with state agencies, each of the federal agencies in our review have established their own policies that articulate cybersecurity requirements, as well as related compliance assessment programs, based in part on guidance from NIST.

Table 1 identifies the types of data that the four selected federal agencies share with state agencies and the cybersecurity policies that they have established to protect that data.

Selected Federal Agencies Had a Significant Number of Variances in Cybersecurity Requirements for State Agencies

The selected federal agencies’ had a significant number of variances in the cybersecurity requirements that they had established for protecting data exchanged with state agencies. Specifically, our review identified hundreds of instances in which the four agencies either had (1) included a requirement in its cybersecurity policy that was not a requirement of the other three agencies (unique requirement); (2) established a requirement with specific, organization-defined technical thresholds that differed from at least one of the other three agencies for a related control (conflicting parameters); or (3) did not fully address in its requirements the guidelines from NIST for associated controls and control enhancements (did not fully address NIST guidelines).

Table 2 summarizes the total number of requirements that each agency had included in its security policy and the extent to which the four agencies’ requirements varied from each other and from the NIST guidance.

Selected Federal Agencies Had Unique Cybersecurity Requirements for State Agencies

Collectively, the four selected federal agencies’ policies included 86 unique cybersecurity requirements for state agencies with which they exchange data. Specifically, CMS’s policy included 54 requirements that the other three agencies did not include. FBI’s CJIS’s policy included 24 unique requirements, IRS’s policy included five unique requirements, and SSA’s policy included three unique requirements. For example, CMS’s security policy included a requirement that state agencies review their organization-wide information security program plan annually; however, the other three agencies did not have such a requirement in their security policies. As another example, IRS had a requirement for state agencies to employ automated mechanisms to alert security personnel of inappropriate activities, while the other agencies did not have this requirement.

Because each agency is addressing different legal requirements and risk management approaches for protecting information shared with states, certain requirements that are unique to an agency may be necessary. Nevertheless, agencies need to ensure that such requirements are necessary by documenting their decisions during the control selection process.

Table 3 provides examples of the unique requirements that each agency included in its cybersecurity policies.

Selected Federal Agencies Had Conflicting Parameters in Their Cybersecurity Requirements for State Agencies

In total, the four federal agencies had identified 390 requirements for state agencies in their policies, where the parameters conflicted with at least one of the other federal agencies. Across the four agencies, CMS had the largest number of requirements that had conflicting parameters, with 139 such requirements. This was followed by IRS with 131, FBI’s CJIS with 72 requirements, and SSA with 48 requirements with conflicting parameters.

For example, each of the selected agencies identified a different time frame for the retention of audit logs related to audited events. As another example, CMS required state agencies to annually review and update their access control policies, whereas IRS required this review every 3 years. FBI’s CJIS and SSA did not have this requirement in their policies.

Table 4 provides additional examples of cybersecurity requirements for state agencies that the four federal agencies identified in their policies, where the parameters conflicted with those of at least one other of the federal agencies.

Selected Federal Agencies Did Not Always Fully Address NIST Guidelines in Their Cybersecurity Requirements for State Agencies

The four selected federal agencies did not always fully address guidelines in NIST Special Publication 800-53 (Revision 4) when establishing cybersecurity requirements for related controls, leading to additional differences among the four agencies’ cybersecurity policies. In total, the four agencies did not fully address guidelines from NIST in 141 instances. FBI’s CJIS had the most variances, with 63 requirements that did not fully address NIST guidelines, followed by SSA with 30 variances, CMS with 26 variances, and IRS with 22 variances.

For example, FBI’s CJIS’s requirement did not identify the time period to retain individual training records, as called for by NIST guidance. In addition, SSA did not define the frequency of how often agencies should assess the security controls in the information system and its environment of operation.

Table 5 provides examples of the cybersecurity requirements for state agencies in which selected federal agencies did not fully address NIST guidelines.

Majority of State CISOs Reported Moderate to Very Great Variation in Selected Federal Agencies’ Cybersecurity Requirements and Increased Impacts from the Variances

The perspectives of state CISOs who responded to our survey reflected the variation we found among the selected federal agencies’ cybersecurity requirements. The majority (at least 29 out of 50) of the state CISOs that responded to our survey question regarding the ways in which federal cybersecurity requirements vary and the extent of the variation reported moderate to very great variation in the selected federal agencies’ cybersecurity requirements. Specifically, of the 50 state CISOs that responded to this question,

34 reported that the federal agencies had moderate to very great variation with respect to unique requirements,

38 reported that the federal agencies had moderate to very great variation due to conflicting parameters that were established, and

29 reported that the federal agencies had moderate to very great variation with respect to addressing NIST guidelines for security controls and control enhancements.

Figure 1 represents state CISOs’ perspectives on the extent of variation among selected federal cybersecurity requirements.

State agency officials that must comply with multiple federal agencies’ cybersecurity requirements (and related compliance assessments) viewed variances as problematic and burdensome. For example, in responding to a survey question about challenges or impacts that state officials experienced regarding federal requirements and assessment processes, an official from one state agency explained that addressing variances in cybersecurity requirements reduced the ability of state officials to focus on their primary mission of securing data across their state enterprise. In response to the same survey question, another state official said that addressing the variances in federal agencies’ cybersecurity requirements increased the complexity of automating the state’s monitoring and reporting processes. In addition, the same state official commented that staff were burdened by reports and reviews to ensure that the full range of federal agencies’ requirements were met.

In responding to our survey, 46 state CISOs reported the extent to which they had experienced a very great, great, moderate, slight, or no increase in calendar time; staff hours; and costs of acquiring additional materials, software, and equipment to address variances in selected federal agencies’ cybersecurity requirements. The majority (at least 34 out of 46) of the state CISOs that responded to this question in our survey reported moderate to very great increases in these types of impacts.

Figure 2 represents the extent of impacts that state CISOs reported as a result of variances in selected federal cybersecurity requirements.

Selected Federal Agencies’ Insufficient Coordination Contributed to Variances in Cybersecurity Requirements for State Agencies

OMB Circular A-130 requires federal agencies to coordinate with nonfederal entities, such as state agencies, as well as other federal agencies as appropriate, to ensure that security and privacy requirements pertaining to these nonfederal entities are consistent to the greatest extent possible. In addition, GAO and NIST have identified practices that can help federal agencies limit potential variation in security control selection and requirements, such as coordinating to develop compatible policies, procedures, and other means to operate across agency boundaries. For example, according to NIST, agencies can establish a tailored set of baseline requirements to satisfy common security objectives. In addition, by applying practices recommended by GAO for enhancing and sustaining coordination and collaboration, federal agencies could work towards establishing shared requirements with consistent terminology and parameters.

However, the four selected federal agencies have not ensured that their cybersecurity requirements for state agencies are consistent to the maximum extent possible through coordination with each other. Officials from IRS, FBI, and SSA acknowledged that they had not coordinated with other federal agencies in establishing their current cybersecurity requirements for state agencies. The agencies had not coordinated, in part, because they have prioritized addressing agency-specific responsibilities from relevant laws and agency policies as well as the needs of relevant communities of interest.

CMS officials stated that the agency coordinated with other federal agencies in 2015 when CMS originally established requirements for its security policy, the Minimum Acceptable Risk Standards for Exchanges Document Suite 2.0, Volume III: Minimum Acceptable Risk Standards for Exchanges. CMS officials noted that the agency added controls that IRS and SSA deemed essential to protecting data for which these agencies were responsible. Nevertheless, we found variances between CMS’s requirements and those established by IRS and SSA. Further, CMS last updated its security policy in September 2015 and IRS, SSA, and FBI’s CJIS have each since updated their policies.

In addition to the insufficient coordination, the selected federal agencies identified two additional explanations for variances in their cybersecurity requirements for state agencies: (1) agencies’ determination that selected requirements were necessary and therefore, that resulting variances are warranted and (2) agencies’ requirements review processes that resulted in deviations from NIST guidance.

Each of the selected agencies noted that they determined the unique controls and competing parameters in their requirements were necessary and warranted. For example, SSA noted that it has been conducting data exchanges with states since the late 1970s, predating NIST Special Publication 800-53. According to SSA officials, the agency’s security requirements retained certain legacy language that state agencies were already familiar with to reduce disruption to them. IRS officials also noted that their security controls incorporate disclosure restrictions from the Internal Revenue Code and internal IRS directives.

Agency processes for reviewing their cybersecurity requirements have resulted in deviations from NIST guidance. For example, FBI’s CJIS officials stated that they started with NIST terminology when developing their policy. However, CJIS’s Advisory Policy Board— which recommends the final CJIS policy to the FBI Director— suggested modifications to the wording of requirements during subsequent reviews. As another example, CMS noted that during the review process for its requirements, in certain instances it deviated from NIST guidance to use terminology that would be more familiar to state agency users.

Federal agencies may have legitimate reasons for having variances in their cybersecurity requirements. For instance, agencies may need to apply different information security controls, a greater number of controls, or more stringent technical parameters to protect data for which they are responsible in a manner consistent with various security requirements originating in federal laws, executive orders, directives, policies, regulations, standards, or guidelines as well as the agency’s risk assessments. However, according to NIST, organizations should document the relevant decisions taken during the control selection process, and provide a sound rationale for those decisions that is based on agency mission and business needs.

Both FBI’s CJIS and IRS had documented the agency’s rationale for unique requirements. SSA stated that their controls were developed before NIST standards were created and they have mapped their current controls to NIST. However, SSA was unable to produce this documentation. CMS officials noted that the rationale for the requirements identified in the agency’s Minimum Acceptable Risk Standards for Exchanges security policy was documented in CMS’s Acceptable Risk Standards. However, the Acceptable Risk Standards did not include all requirements that were included in CMS’s security policy. For example, CMS’s requirements for organizations to review and re-evaluate privileges at least quarterly and for the information system to allocate resources by priority and/or quota were included in the security policy without a defined rationale and were also not included in CMS’s Acceptable Risk Standards.

While agencies have identified various reasons for not coordinating on their cybersecurity requirements for state agencies, OMB has not taken steps to evaluate whether agencies are coordinating. OMB officials acknowledged that they could encourage additional coordination among the selected agencies, but said that it is ultimately up to the agencies to set their requirements and determine how best to assess states’ compliance with those requirements. However, without OMB’s involvement and encouragement that federal agencies collaborate to make their cybersecurity requirements for state agencies consistent to the greatest extent possible, federal agencies are less likely to prioritize such efforts.

The selected federal agencies will soon have an opportunity to harmonize to the extent possible their requirements as they revisit and potentially update their existing security policies based on anticipated changes in NIST guidance. Until these agencies coordinate, where feasible, to address the variances in their cybersecurity requirements, officials from state agencies may continue to experience cost, time, and other burdens resulting from these variances. Further, without documentation of the rationale for having requirements that are unique or parameters that conflict in comparison to other agencies, it will be more difficult for these agencies to achieve consistent requirements.

Selected Federal Agencies’ Policies Addressed a Majority of Activities for Coordinating with State Agencies When Assessing Cybersecurity, but Did Not Address Coordinating with Each Other

As previously discussed, OMB Circular A-130 requires federal agencies to assess whether state agencies have implemented effective security and privacy controls on information systems that create, collect, use, process, store, maintain, disseminate, disclose, or dispose of federal information. The circular also encourages federal agencies to coordinate on their approaches to authorizing the use of such systems whenever practicable.

For example, the circular notes that multiple agencies are encouraged to jointly plan and execute tasks in NIST’s Risk Management Framework, which includes conducting security assessments. According to the circular, agencies can also leverage information generated by another agency based on the need to use the same information resources (e.g., information system or services provided by the system) by choosing to accept some or all of the information in an existing authorization package, including completed security assessments.

As previously stated, NIST and GAO have recommended practices that federal agencies can implement to help with their coordination on cybersecurity assessments, such as assessments of state agencies’ compliance with federal cybersecurity requirements. Those practices fall in two broad areas: (1) coordination with state agencies when assessing states’ cybersecurity and (2) coordination with other federal agencies on the assessment of state agencies’ cybersecurity.

In addition, based on the guidance from NIST that pertained to coordination on assessments of cybersecurity and practices recommended by GAO for enhancing coordination among federal agencies, four supporting activities are common to each of these two areas of federal agencies’ coordination on cybersecurity assessments: assessment schedules and time frames; meeting and document requests; security test plans—including testing techniques, location, and tools; and the use of findings from prior assessments.

With regard to coordinating with state agencies when assessing their cybersecurity, two of the selected federal agencies—CMS and IRS—had policies that addressed all four of the activities supporting this area of coordination. The two other agencies—FBI’s CJIS and SSA—had policies that addressed some, but not all, of the supporting activities for such coordination. With regard to coordinating with other federal agencies on the assessment of state agencies’ cybersecurity, none of the four federal agencies had policies that addressed the activities supporting this area of coordination.

Table 6 summarizes the extent to which selected agencies established policies for coordinating with state agencies and other federal agencies when assessing cybersecurity. See appendix II for details on the extent to which selected agencies addressed individual activities supporting the two areas of coordination.

Federal Agencies’ Policies Addressed a Majority of Activities for Coordinating with State Agencies When Assessing Cybersecurity

Each of the selected federal agencies addressed at least three of the four activities for coordinating with state agencies when assessing cybersecurity. CMS and IRS fully established policies for coordinating with state agencies by addressing all of the activities supporting such coordination. However, FBI’s CJIS and SSA partially established policies for coordinating with state agencies by addressing some—but not all—of the supporting activities. Specifically, FBI’s CJIS and SSA fully addressed three of the activities: coordinating (1) assessment schedules and time frames, (2) meeting and document requests, and (3) security test plans. For example,

FBI’s CJIS policy included instructions for providing the date and time of assessment along with a schedule for the assessment process.

Further, the policy stated that assessors should lay out the meetings that need to occur and documentation that state agencies need to provide CJIS, including specifics about the state’s network.

SSA’s policy laid out each step of the assessment process, including the anticipated time frames. Further, SSA’s policy identified certain meetings that should be held during the process and documentation to be provided before the assessment.

However, FBI’s CJIS and SSA did not fully establish policies for coordinating with state agencies because they did not address the activity associated with coordinating the use of findings from prior assessments. Specifically, while these two agencies’ policies addressed using findings from prior assessments conducted by their individual agency, their policies did not address whether or how assessors should use findings from other security assessments conducted within the state.

Officials from FBI stated that in practice they consider findings from independent security assessments conducted within a state, but had not documented this practice in their assessment policies due to the limited instances in which this information is available. Officials from SSA believed that their policy addressed how its assessors were to consider findings from other security assessments that are conducted within a state. However, based on our review of SSA’s policy, this information was not yet addressed.

Federal Agencies’ Policies Did Not Address Activities for Coordinating with Other Federal Agencies When Assessing State Agencies’ Cybersecurity

None of the four agencies established policies for coordinating with other federal agencies when assessing state agencies’ cybersecurity. Officials from the four selected agencies reported that this is because their priority is to assess compliance with their own security requirements and they are not comfortable relying solely on other federal agencies’ assessments.

Officials from each of the selected agencies provided additional perspectives on coordination with other federal agencies. Specifically:

CMS officials stated that while they do not coordinate with other federal agencies in conducting compliance assessments, they did coordinate with other federal agencies when establishing their cybersecurity requirements. In addition, CMS officials stated that they do not conduct assessments of compliance with their security policy and that states engage contractors to perform the assessments. Therefore, CMS officials believed that the agency does not have a need to coordinate with other federal agencies. However, CMS did not include, where feasible, additional and detailed guidance to the state that it could use to inform its assessment contractors about coordination with other federal agencies. CMS guidance to the states could encourage additional coordination with other federal agencies such as planning the assessment, leveraging related efforts by other federal agencies, and sharing the state’s documentation and findings with other federal agencies, as appropriate. By not doing so, CMS is not maximizing coordination with other federal agencies to the greatest extent practicable.

FBI’s CJIS officials stated that they schedule their security assessments 6 months ahead of time, but would be willing to reschedule the assessment if the state was unavailable due to another assessment being conducted. In addition, CJIS officials noted that while they test for security controls that other federal agencies are testing, they are not assessing the same information as other agencies because the FBI specifically requires criminal justice data to be logically separated from other data. Further, CJIS officials stated their assessment results and audit findings cannot be shared and that other federal agencies would need to refer to a state’s criminal justice agency for such information.

IRS officials stated that they previously attempted to review assessment findings from other agencies, but since IRS was not looking at the same systems, the findings were not helpful. IRS officials stated that they would be willing to review recent assessments conducted by other federal agencies to see if information can be leveraged.

SSA officials noted that it is their practice to reschedule an assessment if another federal agency has an assessment scheduled around the same time, but acknowledged that this was not in their policies. Further, according to SSA officials, they do not currently examine or consider findings from independent security assessments conducted within a state.

While agencies cited various reasons for not coordinating when assessing state agencies’ cybersecurity, taking steps to coordinate, such as leveraging other agencies’ assessments or conducting joint assessments whenever practicable, would be consistent with practices encouraged by OMB. However, OMB has not taken steps to ensure that they do so. OMB officials noted that they believed several of the agencies had begun to coordinate on their own and acknowledged that they could take additional steps to encourage and promote coordination among the agencies. OMB officials further noted that it is ultimately the responsibility of the agencies to determine how they conduct their assessments.

Nevertheless, federal agencies may be placing unnecessary burdens on state officials’ time and resources in responding to similar requests and inquiries. Several state CISOs told us that they have identified various instances in which multiple federal agencies’ lack of coordination resulted in requests for similar documentation and interviews with IT officials. For example, according to three state CISOs, the selected federal agencies have asked them to address similar questions regarding physical security controls, network configurations, and password policies in separate interviews. Three state CISOs also noted that they have provided to multiple federal agencies documentation—such as network diagrams and incident response policies—related to the same IT environment and have facilitated multiple federal assessments of the same physical environment.

State CISOs Identified Opportunities for Federal Agencies to Further Coordinate and Impacts Related to Federal Cybersecurity Assessments

State CISOs identified additional opportunities for further coordination among federal agencies and impacts in dealing with federal cybersecurity assessments. For instance, in response to our survey, 16 states’ officials commented that the four federal agencies in our review could leverage additional opportunities to coordinate on their assessments within their states, particularly where the states had a consolidated data center or other centrally managed IT infrastructure. Further, four state CISOs noted that federal agencies could potentially leverage security compliance assessments and internal audits performed at the state or local level because they included reviews of controls from NIST Special Publication 800-53.

In addition, 11 states mentioned “duplication” in their response to a survey question about challenges or impacts related to federal cybersecurity requirements and assessment processes, while two states mentioned “overlap,” and one state mentioned “fragmentation.” For example:

One state identified that assessors from different federal agencies generally ask for the same items from the state, requiring state agency officials to reproduce the same response.

Another state identified that multiple federal agencies have been assessing the same state agencies with different scope, tools, and documentation requests.

In another example, a state concluded that federal assessors’ interpretation of many technical controls was inconsistent and varied from one federal agency to another and across audit cycles. The state noted that there were opportunities for the federal government to streamline how each agency applied different interpretations.

State CISOs also identified impacts on their time and costs from responding to federal agencies’ assessments. Seventeen respondents reported impacts to their time and six reported cost impacts.

Further, in responding to questions in our survey and an in-depth interview, state CISOs provided additional insights regarding impacts. For example:

One state mentioned that, due to the varying requirements from the selected federal agencies, the state is required to stand up multiple virtual and physical environments. In doing so, the state is required to purchase additional software and hardware to maintain such environments.

Another state explained that staff manage various state agencies’ data in one central location and spend a considerable amount of time responding to each of the four selected federal agencies’ assessments.

Twenty-four states estimated that the four selected federal agencies conducted at least 188 assessments between calendar years 2016 and 2018 and that the states’ best estimates of the total expenditures associated with those assessments ranged from $43.8 million to $67 million.

Of 164 instances where states reported an average time spent on assessments by one of the four selected agencies between calendar years 2016 and 2018, in 97 instances the average time expenditure per assessment was reported to be 301 staff hours or more, and in 67 instances it was less than 301 staff hours. Additionally, there were 34 instances in which the state did not know what its average staff hour expenditure was for a particular agency’s assessment or said that it was not applicable to the state.

Figure 3 represents the responses from 50 state CISOs on the average state staff hours expended per assessment from across the four selected federal agencies as reported by state CISOs.

While state agencies could benefit from additional coordination among federal agencies in conducting their security assessments, increasing coordination may also save the federal government money. For instance, federal agencies may be able to reduce the number of assessments or the scope of the assessment conducted by each agency, the amount of time multiple federal agencies must spend reviewing state systems, and contractor services acquired to assist in performing assessments. The selected federal agencies reported spending close to $45 million in fiscal years 2016 through 2018 on assessments of state agencies’ cybersecurity. Figure 4, an interactive figure, provides the selected federal agencies’ reported spending for fiscal years 2016 through 2018 for assessing state compliance with cybersecurity requirements. (See appendix III for the cost breakdown of selected federal agencies’ reported spending).

Until FBI’s CJIS and SSA fully develop policies for coordinating with state agencies and all of the selected agencies develop policies for coordinating with other federal agencies when assessing state agencies’ cybersecurity, as appropriate, they run the risk of spending more than necessary to assess the security of state systems and networks. Further, federal agencies may be placing unnecessary burdens on state officials’ time and resources in responding to overlapping or duplicative requests and inquiries, retesting controls that have already been evaluated, or reporting similar findings multiple times throughout a state. In addition, until OMB takes steps to ensure agencies coordinate on assessments of state agencies’ cybersecurity, it will not have reasonable assurance federal agencies are leveraging compatible assessments where practicable.

Conclusions

Given that the federal government exchanges personally identifiable and other sensitive information with state agencies, it is critical to have effective coordination across the federal and state agencies to protect this information. While the selected federal agencies have taken steps to secure information exchanged between federal and state agencies, they have not coordinated with each other in establishing cybersecurity requirements for state agencies. The selected agencies’ insufficient coordination has contributed to variances in the agencies’ control selection, terminology, and technical parameters across hundreds of cybersecurity requirements imposed on states. Further, OMB requires agencies to coordinate to ensure consistency among cybersecurity requirements for state entities, but it has not ensured that agencies have done so.

While federal agencies may have legitimate reasons for having variances in their cybersecurity requirements, states’ compliance with multiple federal agencies’ cybersecurity requirements has resulted in increased costs. Coordinating to address variances in federal agencies’ cybersecurity requirements could help to significantly reduce these costs. The selected agencies will soon have an opportunity to coordinate on any planned updates of their security policies that affect state agencies when reviewing their security policies against expected revisions in NIST guidance. Accordingly, it is important that OMB ensures that selected federal agencies coordinate with state agencies and each other to establish cybersecurity requirements that are consistent to the greatest extent possible.

Selected federal agencies had partially established policies to coordinate with state agencies when assessing their cybersecurity, but did not have policies for coordinating with other federal agencies. Federal agencies have not been coordinating with each other on assessments of state agencies’ cybersecurity, in part, because this has not been a priority for them. Further, federal agencies have been less likely to coordinate in their assessments of state agencies’ cybersecurity without additional involvement from OMB. The lack of coordination among federal agencies has been a concern among state CISOs who described instances of duplication and overlap in their cybersecurity assessments. As with the cybersecurity requirements, coordinating with both state and federal agencies when assessing state agencies’ cybersecurity may help to minimize additional cost and time impacts on state agencies, and reduce federal resources associated with implementing state-based cybersecurity assessments. Until OMB takes steps to ensure federal agencies coordinate on assessments of state agencies’ cybersecurity, it will not have reasonable assurance federal agencies are leveraging compatible assessments to the greatest extent possible.

Recommendations for Executive Action

We are making a total of 12 recommendations, including two to OMB, two to CMS, three to FBI, two to IRS, and three to SSA.

The Director of OMB should ensure that CMS, FBI, IRS, and SSA are collaborating on their cybersecurity requirements pertaining to state agencies to the greatest extent possible and direct further coordination where needed. (Recommendation 1)

The Director of OMB should take steps to ensure that CMS, FBI, IRS, and SSA coordinate, where feasible, on assessments of state agencies’ cybersecurity, which may include steps such as leveraging other agencies’ security assessments or conducting assessments jointly. (Recommendation 2)

The Administrator of CMS should, in collaboration with OMB, solicit input from FBI, IRS, SSA, and state agency stakeholders on revisions to its security policy to ensure that cybersecurity requirements for state agencies are consistent with other federal agencies and NIST guidance to the greatest extent possible and document CMS’s rationale for maintaining any requirements variances. (Recommendation 3)

The Administrator of CMS should revise its assessment policies to maximize coordination with other federal agencies to the greatest extent practicable. (Recommendation 4)

The FBI Director should, in collaboration with OMB, solicit input from CMS, IRS, SSA, and state agency stakeholders on revisions to its security policy to ensure that cybersecurity requirements for state agencies are consistent with other federal agencies and NIST guidance to the greatest extent possible. (Recommendation 5)

The FBI Director should fully develop policies for coordinating with state agencies on the use of prior findings from relevant cybersecurity assessments conducted by other organizations. (Recommendation 6)

The FBI Director should revise its assessment policies to maximize coordination with other federal agencies to the greatest extent practicable. (Recommendation 7)

The IRS Commissioner should, in collaboration with OMB, solicit input from CMS, FBI, SSA, and state agency stakeholders on revisions to its security policy to ensure that cybersecurity requirements for state agencies are consistent with other federal agencies and NIST guidance to the greatest extent possible. (Recommendation 8)

The IRS Commissioner should revise its assessment policies to maximize coordination with other federal agencies to the greatest extent practicable. (Recommendation 9)

The Commissioner of SSA should, in collaboration with OMB, solicit input from CMS, FBI, IRS, and state agency stakeholders on revisions to its security policy to ensure that cybersecurity requirements for state agencies are consistent with other federal agencies and NIST guidance to the greatest extent possible and document the SSA’s rationale for maintaining any requirements variances. (Recommendation 10)

The Commissioner of SSA should fully develop policies for coordinating with state agencies on the use of prior findings from relevant cybersecurity assessments conducted by other organizations. (Recommendation 11)

The Commissioner of SSA should revise its assessment policies to maximize coordination with other federal agencies to the greatest extent practicable. (Recommendation 12)

Agency Comments and Our Evaluation

We provided a draft of this report to OMB and the four other selected federal agencies for their review and comment. In response, three of the agencies (Department of Health and Human Services, FBI, and SSA) stated that they agreed with the recommendations; and one agency (IRS) stated that it partially agreed with one recommendation and disagreed with one recommendation. OMB did not provide comments on our report.

The following three agencies agreed with the recommendations.

The Department of Health and Human Services provided written comments, in which it agreed with our recommendations and identified steps it said CMS had taken or intends to take to address them. For example, the department stated that CMS intends to solicit input from the other federal agencies identified in this report and from state agency stakeholders when making updates to its MARS-E security policy and when updating its assessment guidance to states on how to maximize coordination with other federal entities.

The department noted that CMS had developed and implemented its suite of guidance and requirements, known as MARS-E, based on the Patient Protection and Affordable Care Act, FISMA, and NIST. According to the department, variances in security requirements are to be expected because of the flexibility that NIST allows in its guidance. The department added that CMS tailored some of the controls to allow flexibilities for states while keeping the overall intent of the NIST guidance.

The department stated that it collaborated with federal agencies, including FBI's CJIS, in developing MARS-E and during subsequent updates of that security policy. However, CMS did not provide us with documentation as evidence of its collaboration with FBI's CJIS on the development of MARS-E. In addition, as noted in this report, CMS had not collaborated with the other agencies included in our review after the development of the most recent version of MARS-E. It is important that federal agencies collaborate to address variances in their cybersecurity requirements; doing so could help to significantly reduce state agencies’ costs in complying with multiple federal agencies’ requirements.

The department's comments are reprinted in appendix IV. The department also provided technical comments, which we incorporated as appropriate.

In written comments, FBI's CJIS agreed with our three recommendations to the agency. Among other things, the agency stated that it would, to the greatest extent possible, collaborate with OMB and solicit input from the other federal agencies identified in this report, as well as from state agency stakeholders, on revisions to its security policy.

With regard to our recommendation that FBI’s CJIS develop policies for coordinating with state agencies on the use of prior findings, the agency stated that it had implemented this recommendation and updated its security policy to include coordinating with state agencies on the use of prior findings from relevant cybersecurity assessments conducted by other organizations. However, the agency did not provide documentation showing that it had updated the security policy. As a result, we did not change our assessment of this practice. We will continue to monitor the agency’s progress in implementing the recommendation.

The agency's comments are reprinted in appendix V. The agency also provided technical comments, which we incorporated as appropriate.

In its written comments, SSA stated that it agreed with our recommendations. SSA's comments are reprinted in appendix VI. The agency also provided technical comments, which we incorporated as appropriate.

One agency partially agreed with one recommendation and disagreed with one recommendation. Specifically, IRS partially agreed with our recommendation to, in collaboration with OMB, solicit input from the four federal agencies identified in this report and state agency stakeholders on revisions to its security policy. Specifically, the agency agreed to participate in collaborative working sessions with OMB and interested stakeholders to discuss the impact of inconsistent standards and the extent to which the standards might be harmonized. However, IRS stated that it must follow Treasury Directives and internal standards for systems that process tax data and, as a result, its ability to harmonize requirements may be limited.

As noted in this report, federal agencies may have legitimate reasons for variances in their cybersecurity requirements, such as applying different information security controls and more stringent technical parameters to protect data for which the agencies are responsible in a manner consistent with various security requirements originating in federal laws, directives, and regulations. Nevertheless, we continue to believe that it is important for all of the agencies in our review to identify opportunities where requirements can be streamlined or made more consistent while still achieving each agency's desired security outcomes because doing so may reduce potential burdens on state agencies, as discussed in this report. Thus, we maintain that our recommendation is still warranted.

IRS disagreed with our recommendation to revise its assessment policies to maximize coordination with other federal agencies to the greatest extent possible. Specifically, IRS stated that it has sole statutory oversight authority and enforces requirements for agencies subject to Internal Revenue Code § 6103. As such, IRS cannot solely rely on an assessment conducted by another agency. However, as noted in this report, OMB encourages federal agencies to coordinate on their assessments whenever practicable. Doing so would not necessarily require IRS to solely rely on another agency’s assessment nor conflict with its authority to conduct statutory oversight because IRS could leverage and share relevant information and artifacts with other federal agencies while continuing to conduct its own required assessments and oversight.

Further, as discussed in this report, state chief information officers identified a number of areas where federal agencies requested similar information through documentation requests and interviews, such as network configurations, password policies, and incident response policies. Leveraging and sharing relevant information that is collected by federal agencies could help those agencies, including IRS, reduce some of their data collection needs while also helping to minimize burdens on state officials’ time and resources. We acknowledge that complete alignment of assessment policies may not be feasible in light of unique statutory responsibilities and requirements; however, agency coordination and simplification of certain assessment logistics may be possible and could result in gained efficiencies from the perspective of the federal government. Thus, we maintain that our recommendation is still warranted.

IRS's comments are reprinted in appendix VII.

We are sending copies of this report to the appropriate congressional requesters, the Director of OMB, the Administrator of CMS, the Assistant Attorney General for Administration for the Department of Justice, the FBI Director, the IRS Commissioner, and the Commissioner of SSA. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-6240 or at dsouzav@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VIlI.

Appendix I: Methodology and Results of GAO’s Survey of State Officials’ Views

We administered a survey to the offices of the Chief Information Officer and Chief Information Security Officer (CISO) in the 50 states, District of Columbia, American Samoa, Guam, Puerto Rico, and the U.S. Virgin Islands. To administer the survey, we emailed each state a fillable PDF questionnaire. We fielded the survey from February 19, 2019, through April 24, 2019. We received usable survey responses from 50 of the 55 states and territories, for a response rate of 91 percent.

In developing, administering, and analyzing the survey, we took steps to minimize the five types of errors that may affect survey results— population coverage, sampling, measurement, nonresponse, and data processing. Our results are not subject to either of the first two types of errors—population coverage (under- or over-coverage) error of the study population or sampling error—because we defined all states and five territories as our study population, and sent each a questionnaire.

To minimize the third type of error (measurement error), we pretested the questionnaire with CISOs (or their delegates) in four states that varied over two characteristics related to our questions: whether or not the state took a “federated” or “consolidated” management approach to data center and other information technology (IT) infrastructure, and the relative size of the state’s IT budget. Using cognitive interviewing techniques, such as nondirective probing of answers and asking respondents to think aloud when formulating answers, we determined whether (1) the questions were clear and unambiguous, (2) terminology was used correctly, (3) the questionnaire did not place an undue burden on state officials, (4) the information could feasibly be obtained, and (5) the survey was comprehensive and unbiased. Based on the pretests and interviews with external subject matter experts on questionnaire subjects, we modified the questionnaire. During the survey, we also followed up by email or phone with some respondents to clarify unclear answers and edit them if necessary. Additionally, after the survey, our in-depth interviews with four responding states confirmed their answers to selected questions, or resulted in edits to those answers.

To minimize the potential for the fourth type of error (nonresponse error), we emailed or called states that did not respond to the initial notice multiple times to encourage survey participation or provide technical assistance, as appropriate. Also, the follow up contacts made to clarify answers resulted in obtaining some answers to questions that had been left blank in returned questionnaires. While the four states and one territory not returning questionnaires may have differed to an unknown extent in what their answers would have been, compared to the aggregate answers of those who did respond, the overall impact on our results from only five missing members of the population is unlikely to be material. To minimize the possibility for the fifth type of error (data processing error), all data entry, edits, and analysis were verified by a second, independent analyst on the engagement team.

To further understand the states’ experiences with and views of selected federal agencies’ cybersecurity assessments, we conducted in-depth interviews with four states. In selecting the four states for in-depth interviews, we considered responses from 44 states that had submitted surveys prior to April 11, 2019. From these states, we analyzed responses to survey questions 4, 7, 9, 10, 11, 12, 13, 14, 15, 16, and 17, and identified whether states’ responses reflected a generally favorable opinion or a generally unfavorable opinion of federal cybersecurity requirements and assessments. Based on this information, we selected two states to interview that had a generally favorable opinion and two states that had a generally unfavorable opinion toward federal cybersecurity assessments and requirements. In selecting states to interview from states that had favorable and unfavorable opinions, we chose to interview states that provided different responses about increases in costs and/or coordination with federal and nonfederal agencies.

We sent an email to each of the four states to ask for their participation and conducted follow up interviews with officials from the offices of the state CIO and state CISO, state audit entities, and mission agencies from four states. Our interview questions concerned topics such as challenges states may have faced in complying with federal cybersecurity requirements, the impacts federal requirements and assessments may have had on states, the efficiency and effectiveness of assessments performed by each federal agency, and the nature and extent of any duplication in federal agencies’ cybersecurity requirements. Although the results of these in-depth interviews are not generalizable to all of the states and territories that responded to our survey, they provide richer insight into some of the information we collected through our survey, such as the reasons for certain questionnaire responses or the sources of variation in states’ perspectives.

The following identifies the survey questionnaire that we administered and the aggregated results from the responses are below under each question. Not all state CISOs who completed the survey responded to all questions, and some questions were not discussed in the body of our report.

Federal Requirements

These questions ask about the federal agency cybersecurity requirements that set standards in any of the related general security control categories, and your experiences with those applicable to your state. 1. For how long has the current CISO of your state been in that role? (check one box)

2. Please provide some background on your state’s governance model for cybersecurity. Specifically, how is the responsibility for managing the following aspects of cybersecurity primarily assigned within your state? (check the one box in each row which best represents your answer)

3. Is your state currently required to meet any security requirements by any of the following federal agencies in order to obtain and use federal data?

Federal Bureau of Investigation (FBI) (Criminal Justice Information Services (CJIS) Security Policy CJISD-ITS-DOC-08140-5.7, Version 5.7)

Centers for Medicare & Medicaid Services (CMS) (Minimum Acceptable Risk Standards for Exchanges, Version 2.0)

Internal Revenue Service (IRS) (IRS Publication 1075, Tax Information Security Guidelines For Federal, State, and Local Agencies, September 2016)

Social Security Administration (SSA) (Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information, Version 8.0)

4. Federal security requirements applicable to states may vary in a number of ways. Considering as a whole all of the federal agencies’ requirements that your state is currently required to meet, how much do you think they vary from each other in each of the following ways?

5. Consider again all the applicable federal cybersecurity requirements required of your state. Do one or more federal agencies have any requirements that most vary from other agencies?

Within each of the following families of security controls, check all boxes that apply to tell us in what ways requirements vary, and which agency(s) vary the most from others. (If “Other(s)” varying agencies selected, list in Question 6.)

NIST Control Family Access Control (AC)

Awareness and Training (AT)

Audit and Accountability (AU)

Security Assessment and Authorization (CA)

Configuration and Management (CM)

Contingency Planning (CP)

Identification and Authentication (IA)

Incident Response (IR)

Media Protection (MP)

Physical and Environmental Protection (PE)

Planning (PL)

Personnel Security (PS)

Risk Assessment (RA)

System and Services Acquisition (SA)

System and Communications Protection (SC)

System and Information Integrity (SI)

Program management (PM)

6. If you indicated above that any other federal agencies have requirements that most vary from others, what are those other agencies and the control categories and way(s) they vary? (Narrative answers not displayed) 7. If you identified any variation in the requirements of multiple Federal agencies in question 5 above, what is your overall estimation of the degree of that variation in each of the following families of controls?

Families of controls (Based on NIST 800-53) Access control (AC)

Awareness and training (AT)

Audit and accountability (AU) Security assessment and authorization (CA)

Configuration management (CM)

Contingency planning (CP) Identification and authentication (IA)

Incident response (IR)

Maintenance (MA) Media protection (MP)

Physical and environmental protection (PE)

Planning (PL) Personnel security (PS)

Risk assessment (RA)

System and services acquisition (SA) System and communications protection (SC)

System and information integrity (SI)

8. Do you have any comments on or explanations of your answers to the question above that would help us appropriately interpret those answers? (itemize your comments by the row letters above, to the extent possible, in the box below) (Narrative answers not displayed) 9. Has your state taken any of the following actions specifically to address variation(s) across agency requirements?

Increased coordination with NASCIO and other non-federal agencies outside your state Increased coordination with other agencies within your state Any other action(s)

10. Have the variations increased any of the following types of costs and/or challenges?

The following questions ask about assessments performed by federal agencies on your state on its compliance with the federal cybersecurity requirements covered above.

For the purposes of this survey, an “assessment” includes only the activities in the period between the date the state is notified of the assessment and the date the federal agency or entity carrying out the assessment (e.g., contractor) completes its on-site work. 11. Approximately how many assessments did each of the following federal agencies perform on your state’s efforts to comply with its requirements in calendar years 2016-2018? (When counting assessments performed by one federal agency on more than one state mission agency or operational entity at the same time, please count each assessment individually.)

Any other federal agency(s)

12. Considering up to the last 3 assessments a federal agency performed in 2016-2018, approximately how long in calendar time was taken per assessment, on average, to perform?

Any other federal agency(s)

13. Considering up to the last 3 assessments a federal agency performed in 2016-2018, approximately how many of your state’s staff hours were expended per assessment, on average, to comply?

Any other federal agency(s)

14. And considering up to the last 3 assessments a federal agency performed in 2016-2018, what is your best estimate of the range of cost in dollars (including staff hour labor, travel, materials, and contract costs) your state expended per assessment, on average, to comply?

Estimated lower end of dollar cost (mean value) $77,103 (17 responses)

Estimated upper end of dollar cost (mean value)

Don’t know 28 (17 responses) $623,650 19 responses) $840,472 (19 responses) $211,574 (21 responses) $418,238 (21 responses) $33,822 (16 responses) $61,719 (16 responses)

15. Considering all the federal assessments performed on your state’s implementation of requirements in 2016-2018, how would you rate those assessments, overall, on the following factors?

16. In summary, how would you rate the efficiency of assessments performed by each federal agency on your state’s implementation of requirements?

Any other agency(s)

17. In summary, how would you rate the effectiveness of assessments performed by federal agencies on your state’s implementation of requirements?

Any other agency(s)

18. Considering the issues covered in this questionnaire, what challenges or impacts, if any, has your state experienced regarding the federal requirements and assessment processes? (list and describe up to 5) (Narrative answers not displayed) 19. Do you have any additional explanations of your answers or comments on any of the issues in this questionnaire? (Narrative answers not displayed) 20. Who is the person primarily responsible for completing this questionnaire whom we can contact in case we need to clarify a response? If the state CISO did not complete this questionnaire, we recommend that the CISO review these answers.

Appendix II: Detailed Assessment of Selected Federal Agencies’ Policies

The tables below identify the extent to which each of the four selected federal agencies established policies that addressed individual activities supporting two areas of coordination: (1) coordination with state agencies when assessing states’ cybersecurity and (2) coordination with other federal agencies on the assessment of state agencies’ cybersecurity.

Appendix III: Breakdown of Selected Federal Agencies’ Reported Spending for Fiscal Years 2016 through 2018

The following table provides the breakdown of selected agencies’ reported spending during fiscal years 2016 through 2018 associated with assessing states’ compliance with cybersecurity requirements.

Appendix V: Comments from the Federal Bureau of Investigation

Appendix VI: Comments from the Social Security Administration

Appendix VII: Comments from the Internal Revenue Service

Appendix VIII: GAO Contact and Staff Acknowledgements

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Josh Leiling (assistant director), Lori Martinez (analyst in charge), Gerard Aflague, Joseph Andrews, David Blanding, Chris Businsky, Rebecca Eyler, Torrey Hardee, Andrea Harvey, Keith Kim, Monica Perez-Nelson, and Carl Ramirez made significant contributions to this report.