Information Security: Significant Progress Made, but CDC Needs to Take Further Action to Resolve Control Deficiencies and Improve Its Program
Released: 2018-12-20T00:00:00

Letter

Background

CDC—an operating division of the Department of Health and Human Services (HHS)—serves as the national focal point for disease prevention and control, environmental health, and promotion and education activities designed to improve the health of Americans. The agency is also responsible for leading national efforts to detect, respond to, and prevent illnesses and injuries that result from natural causes or the release of biological, chemical, or radiological agents.

To achieve its mission and goals, the agency relies on an array of partners, including public health associations and state and local public health agencies. It collaborates with these partners on initiatives such as monitoring the public’s health, investigating disease outbreaks, and implementing prevention strategies. The agency also uses its staff located in foreign countries to aid in international efforts, such as guarding against global diseases. Table 1 describes the organization of CDC.

CDC is staffed by approximately 20,000 employees across the United States and around the world. For fiscal year 2017, according to agency officials, the agency’s total appropriation was approximately $12 billion, of which it reported spending approximately $424 million on information technology. In addition, the officials stated that approximately $31 million (or about 7.3 percent of the amount spent on information technology) was for information security across all CDC information technology investments.

CDC Relies on Information Systems to Help Achieve Its Mission

CDC relies extensively on information technology to fulfill its mission and support related administrative needs. Among the approximately 750 systems reported in its inventory, the agency has systems dedicated to supporting public health science, practice, and administration. All of these systems rely on an information technology infrastructure that includes network components, critical servers, and data centers.

CDC Has Defined Organizational Security Roles and Responsibilities

At CDC, the chief information officer (CIO) is responsible for establishing and enforcing policies and procedures protecting information resources. The CIO is to lead the efforts to protect the confidentiality, integrity, and availability of the information and systems that support the agency and its operations, and is to report quarterly to the HHS CIO on the overall effectiveness of CDC’s information security and privacy program, including the progress of remedial actions.

The CIO designated a chief information security officer (CISO), who is to oversee compliance with applicable information security and privacy requirements of the agency. The CISO, among other things, is responsible for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, and disruption of information and information systems that support the operations and assets of the agency.

To further ensure information security compliance, information systems security officers (ISSO) are responsible for managing the information security program within their respective organizations and report on security program matters to the CISO, including computer security-related incidents. ISSO responsibilities include ensuring that vendor-issued security patches are expeditiously installed and that system owners establish processes for timely removal of access privileges when a user’s system access is no longer necessary. In addition, security stewards are to perform operational security analyses supporting the efforts of the ISSO. Further, business stewards serve as program managers, accepting full accountability for the operations of the systems and ensuring that security is planned, documented, and properly resourced for each aspect of the information security program.

Federal Laws and Guidance Establish Security Requirements to Protect Federal Information and Systems

The Federal Information Security Modernization Act (FISMA) of 2014 provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. FISMA assigns responsibility to the head of each agency for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. The law also delegates to the agency CIO (or comparable official) the authority to ensure compliance with FISMA requirements. The CIO is responsible for designating a senior agency information security officer whose primary duty is information security.

The law also requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency. In addition, FISMA requires agencies to comply with National Institute of Standards and Technology (NIST) standards, and the Office of Management and Budget (OMB) requires agencies to comply with NIST guidelines.

NIST Federal Information Processing Standards (FIPS) Publication 199 requires agencies to categorize systems based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation. NIST FIPS 200 requires agencies to meet minimum security requirements by selecting the appropriate security controls, as described in NIST Special Publication (SP) 800-53. This NIST publication provides a catalog of security and privacy controls for federal information systems and a process for selecting controls to protect organizational operations and assets. The publication provides baseline security controls for low-, moderate-, and high-impact systems, and agencies have the ability to tailor or supplement their security requirements and policies based on agency mission, business requirements, and operating environment.

Further, in May 2017, the President issued an executive order requiring agencies to immediately begin using NIST’s Cybersecurity Framework for managing their cybersecurity risks. The framework, which provides guidance for cybersecurity activities, is based on five core security functions: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.

Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.

According to NIST, these 5 functions occur concurrently and continuously, and provide a strategic view of the life cycle of an organization’s management of cybersecurity risk. Within the 5 functions are 23 categories and 108 subcategories that include controls for achieving the intent of each function. Appendix II provides a description of the framework categories and subcategories of controls.

Security Control Deficiencies Placed Selected CDC Systems at Risk

We reported in June 2018 that CDC had implemented numerous controls over the 24 systems we reviewed, but had not always effectively implemented controls to protect the confidentiality, integrity, and availability of these systems and the information maintained on them. Deficiencies existed in the technical controls and agency-wide information security program that were intended to (1) identify risk, (2) protect systems from threats and vulnerabilities, (3) detect cybersecurity events, (4) respond to these events, and (5) recover system operations.

These deficiencies increased the risk that sensitive personally identifiable and health-related information, including information regarding the transfer of biological agents and toxins dangerous to public health, could be disclosed or modified without authorization. As shown in table 2, deficiencies existed in all 5 core security function areas for the selected systems we reviewed.

CDC Had Identified Risk and Developed Policies and Plans, but Shortcomings Existed

Controls associated with the identify core security function are intended to help an agency develop an understanding of its resources and related cybersecurity risks to its systems, assets, data, and capabilities. These controls include identifying and assessing cybersecurity risk and establishing information security policies, procedures, and plans. We reported in June 2018 that, although CDC had taken steps to implement these controls, it had not (1) categorized the risk-related impact of a key system, identified threats, or reassessed risk for systems or facilities when needed; (2) sufficiently documented technical requirements in policies, procedures, and standards; and (3) described intended controls in facility security plans.

CDC Did Not Appropriately Categorize at Least One Key System, but Assessed Risk to Some Extent at System and Entity-wide Levels

CDC Categorized Systems Based on Potential Impact of Compromise, but Did Not Appropriately Categorize a Key General Support System As discussed earlier, FIPS Publication 199 requires agencies to categorize systems based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation. For networks and other general support systems, NIST SP 800-60 notes that the categorization should be based on the high water mark of supported information systems, and on the information types processed, transmitted across the network, or stored on the network or support system. Further, CDC’s architecture design principles state that high- impact systems are to be maintained on dedicated machinery and be physically and logically secured from lower-risk systems.

CDC had categorized the 24 systems we reviewed, but the assigned impact level was not always appropriate. In this regard, the agency did not ensure that high-impact systems were logically secured from a lower- risk system. Specifically, seven selected high-impact systems relied on a general support system that the agency had categorized as a moderate- impact system (i.e., a lower-risk system). As a result, the high-impact systems were relying on controls in a less secure environment. Officials from the Office of the Chief Information Officer (OCIO) explained that the categorization of the supporting system was outdated based on changes to the agency’s operating environment and that they planned to re- evaluate the assigned impact level.

CDC Assessed Risk at the System Level, but Did Not Assess Threats, Document Risk-based Decisions, or Reassess Risk When Needed According to NIST SP 800-30, risk is determined by identifying potential threats to an organization and vulnerabilities in its systems, determining the likelihood that a particular threat may exploit vulnerabilities, and assessing the resulting impact on the organization’s mission, including the effect on sensitive and critical systems and data. NIST also states that assessments should be monitored on an ongoing basis to keep current on risk-impacting changes to the operating environment.

CDC had developed system-level risk assessments for the 8 selected mission-essential systems, and had summarized its risks in a risk assessment report. However, only two of the eight risk assessments had identified potential threats, and only one of these assessments determined the likelihood and impact of threats to that system.

Further, CDC had not always documented risks associated with less secure configuration settings or monitored its assessments to address changes to the operating environment. For example, among the 94 technical control deficiencies that we identified for the 24 systems we reviewed, OCIO officials stated that the agency had not implemented controls for 20 deficiencies due to technical constraints. However, CDC did not address risks associated with decisions not to implement controls for these reasons in the system risk assessments.

OCIO officials also partially attributed 5 of the 94 technical control deficiencies to new cybersecurity threats and to threat vectors that turned initially sound architecture decisions into vulnerabilities. However, CDC had not addressed such changes in the risk assessments for the affected systems. By not assessing threats or the likelihood of their occurrence and impact and by not documenting the risks, CDC cannot have assurance that appropriate controls are in place commensurate with the level of risk.

CDC Had a Process in Place to Assess Risk to Systems from an Entity-wide Perspective Beyond the system level, newly discovered threats or vulnerabilities may require an agency to make risk decisions from an entity-wide perspective. An entity-wide perspective is needed because the threats and vulnerabilities may affect more than specific systems.

CDC had a process in place to assess risk from an entity-wide perspective. This process included regular meetings among OCIO and program office staff to discuss policy, threats, and incidents. Specifically, ISSOs held monthly meetings as a continuous monitoring working group to discuss policy updates. In addition, an OCIO official held quarterly briefings that included presentations on incident response tools, incident statistics, and potential threats. OCIO officials also held ad hoc meetings, as necessary, regarding vulnerability and threat concerns when the agency received email alerts from the Federal Bureau of Investigation, the Department of Homeland Security (DHS), or HHS.

CDC Had Not Updated Facility Risk Assessments In addition to assessing risks for systems, agencies are to assess the risk to their facilities. The Interagency Security Committee (ISC) requires agencies to determine the security level for federal facilities, and to conduct risk assessments at least once every 5 years for Level I and Level II facilities and at least once every 3 years for Level III, Level IV, and Level V facilities.

However, the two facility risk assessments that we reviewed had not been updated in a timely manner. Specifically, the risk assessments, covering Level III and Level IV facilities that house the 24 reviewed systems, had been last updated in January 2009 and March 2014—8 years earlier and just over 3 years earlier, at the time of our review in July 2017.

According to a CDC physical security official, the agency had previously relied on a third-party assessor to perform the assessments. The official also said that the agency planned to conduct its own facility risk assessments and had recently developed procedures for conducting these assessments. Until it performs these assessments, CDC may not be aware of new risks to its facilities or the controls needed to mitigate the risks.

CDC Had Documented Controls in Policies, Procedures, and Standards, but Had Not Included Certain Technical Requirements

FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes policies and procedures that (1) are based on a risk assessment, (2) cost- effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements. According to NIST SP 800-53, an agency should develop policies and procedures for each of the 18 NIST families of security controls to facilitate the implementation of the controls.

CDC had documented numerous policies, procedures, and standards that addressed each of the 18 control families identified in NIST SP 800-53. For example, the agency had developed policies and procedures governing physical access to CDC facilities, role-based training of personnel with significant security responsibilities, security assessment and authorization of systems, and continuity of operations, in addition to standard operating procedures that covered numerous other controls.

The agency had also developed the CDC IT Security Program Implementation Standards, which describes the agency’s security program requirements and minimum mandatory standards for the implementation of information security and privacy controls. In addition, the agency had documented configuration standards, which specified minimum configuration settings, for devices such as firewalls, routers, switches, as well as Unix and Windows servers.

However, these policies and standards sometimes lacked the technical specificity needed to ensure controls were in place. To illustrate, the agency had not sufficiently documented detailed guidance or instructions to address numerous technical control deficiencies we identified, such as insecure network devices, insecure database configurations, not blocking certain email attachments, and not deploying a data loss prevention capability.

According to OCIO officials, the agency’s periodic reviews and updates to existing cybersecurity policies and standards did not reveal and address these issues. Nevertheless, without clear and specific guidance or instructions for implementing technical controls, the agency had less assurance that controls were in place and operating as intended.

CDC Had Identified and Updated Controls in System Security Plans Annually, but Had Not Developed Facility Security Plans

FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes subordinate plans for providing adequate information security for networks, facilities, and systems or a group of information systems, as appropriate. NIST states that plans should be reviewed and updated to ensure that they continue to reflect the correct information about the systems, such as changes in system owners, interconnections, and authorization status, among other things.

HHS and CDC policies require that such plans be reviewed annually. In addition, the ISC requires that agencies develop and implement an operable and effective facility security plan. CDC standards require the organization to prepare a facility security plan (or similar document).

CDC had developed security plans for the 8 selected mission-essential systems. With a few exceptions, the plans addressed the applicable security controls for those systems. The agency also had reviewed and updated the plans annually.

However, CDC had not developed security plans for the facilities housing resources for the selected systems. Physical security officials stated that they had not developed security plans because they did not have a sufficient number of staff to develop them. Without comprehensive security plans for the facilities, CDC’s information and systems would be at an increased risk that controls to address emergency situations would not be in place and personnel at the facilities would not be aware of their roles and responsibilities for implementing sound security practices to protect systems housed at these CDC locations.

CDC Had Implemented Controls Intended to Protect Its Systems, but Deficiencies Existed

The protect core security function is intended to help agencies develop and implement the appropriate safeguards for their systems to ensure achieving the agency’s mission and to support the ability to limit or contain the impact of a potential cybersecurity event. Controls associated with this function include implementing controls to limit access to authorized users, processes or devices; encrypting data to protect its confidentiality and integrity; configuring devices securely and updating software to protect systems from known vulnerabilities; and providing training for cybersecurity awareness and performing security-related duties. Although CDC had implemented controls that were intended to protect its operating environment, we reported in June 2018 that the agency did not consistently (1) implement access controls effectively, (2) encrypt sensitive data, (3) configure devices securely or apply patches in a timely manner, or (4) ensure staff with significant security responsibilities received role-based training.

CDC Did Not Consistently Implement Effective Access Controls

A basic management objective for any agency is to protect the resources that support its critical operations from unauthorized access. Agencies accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Access controls include those related to identifying and authenticating users, authorizing access needed to perform job duties, protecting system boundaries, and physically protecting information system assets. However, CDC had not consistently implemented these controls.

CDC Implemented Enterprise-wide Identification and Authentication Controls, but Did Not Consistently and Securely Configure Password Controls for Certain Accounts on Devices and Systems NIST SP 800-53 states that agencies should implement multi-factor authentication for their users of information systems. Multi-factor authentication involves using two or more factors to achieve authentication. A factor is something you know (password or personal identification number), something you have (token and personal identity verification (PIV) card), or something you are (biometric). Also, NIST and CDC policy state that information systems shall have password management controls established to include minimum password complexity requirements, password lifetime restrictions, prohibitions on password reuse, and user accounts temporarily locked out after a certain number of failed login attempts during a specified period of time.

CDC had applied enterprise-wide solutions to ensure appropriate identification and multi-factor authentication of its general user community through, for example, the use of PIV cards. However, instances of weak password management controls existed for certain accounts on network devices, servers, and database systems. According to OCIO officials, password control deficiencies existed primarily due to technical constraints, administrators not being aware of technical requirements, or administrators not adequately monitoring configuration settings. Without more secure password settings, CDC’s information and systems are at an increased risk that unauthorized individuals could have guessed passwords and used them to obtain unauthorized access to agency systems and databases.

CDC Authorized Users More Access than Needed to Perform Their Jobs NIST SP 800-53 states that agencies should employ the principle of least privilege, allowing only authorized access for users (or processes acting on behalf of users) that are necessary to accomplish assigned tasks. It also states that privileged accounts—those with elevated access permissions—should be strictly controlled and used only for their intended administrative purposes.

CDC had implemented controls intended to ensure that users were granted the minimum level of access permissions necessary to perform their legitimate job-related functions. However, the agency had granted certain users more access than needed for their job functions, including excessive access permissions on a key server.

According to OCIO officials, CDC systems had deficiencies related to restricting access primarily due to technical constraints or administrators not adequately monitoring configuration settings. By not appropriately restricting access, CDC’s information and systems are at an increased risk that individuals could deliberately or inadvertently compromise database systems or gain inappropriate access to information resources.

CDC Did Not Effectively Implement Boundary Controls to Ensure Network Integrity NIST SP 800-53 states that agencies should control communications at information systems’ external boundaries. It states that, to manage risks, agencies should use boundary protection mechanisms to separate or partition computing systems and network infrastructures containing higher-risk systems from lower-risk systems.

Although CDC had implemented multiple controls that were designed to protect system boundaries, the agency had not sufficiently separated higher-risk systems from lower-risk systems. According to OCIO officials, deficiencies in boundary protection controls existed due to new cybersecurity threats turning initially sound architecture decisions into vulnerabilities, technical constraints, and administrators not being aware of technical requirements or adequately monitoring configuration settings. Without stronger boundary controls, CDC’s information and systems are at an increased risk that an attacker could have exploited these boundary deficiencies and leveraged them to compromise CDC’s internal network.

CDC Physically Protected Information System Assets, but Did Not Consistently Ensure Access Remained Appropriate NIST SP 800-53 states that agencies should implement physical access controls to protect employees and visitors, information systems, and the facilities in which they are located. In addition, NIST states that agencies should review access lists detailing authorized facility access by individuals at the agency-defined frequency. In its standards, CDC requires implementation of the NIST special publication and requires that access lists detailing authorized facility access by individuals be reviewed at least every 365 days.

CDC had implemented physical security controls. The agency had implemented physical security measures to control access to certain areas and to ensure the safety and security of its employees, contractors, and visitors to CDC facilities. For example, CDC had issued PIV cards and Cardkey Proximity Cards to its employees and contractors, and had limited physical access to restricted areas based on the permissions it granted via these cards.

However, the agency had not consistently reviewed authorized access lists. In this regard, CDC did not have a process in place for periodically reviewing the lists of individuals with access to rooms containing sensitive resources to ensure that such access remained appropriate. Without reviewing authorized access lists, CDC has reduced assurance that individual access to its computing resources and sensitive information is appropriate.

CDC Had Not Consistently Encrypted Sensitive Authentication Data

NIST SP 800-53 states that agencies should encrypt passwords both while stored and transmitted, and configure information systems to establish a trusted communication path between the user and the system. Additionally, NIST requires that, when agencies use encryption, they use an encryption algorithm that complies with FIPS 140-2.

CDC had used FIPS-compliant encryption for its PIV card implementation, but had not effectively implemented encryption controls in other areas. According to OCIO officials, encryption control deficiencies existed primarily due to technical constraints, administrators not being aware of a technical solution, or configuration settings not being adequately monitored. By not using encryption effectively, CDC limits its ability to protect the confidentiality of sensitive information, such as passwords.

CDC Had Not Consistently Configured Servers Securely or Applied Patches in a Timely Manner

NIST SP 800-53 states that agencies should disable certain services with known security vulnerabilities. This includes configuring security control settings on operating systems in accordance with publicly available security checklists (or benchmarks) promulgated by NIST’s National Checklist Program repository. This repository contains, for example, the security configuration benchmarks established by the Center for Internet Security (CIS) for Windows servers.

NIST also states that agencies should test and install newly-released security patches, service packs, and hot fixes in a timely manner. In addition, CDC policy required that software patches for remediating vulnerabilities designated as critical or high risk be applied to servers within 45 days of being notified that a patch is available or within 7 days of when an exploit is known to exist. Further, agency policy specified that administrators configure Windows servers in accordance with the CDC- approved security benchmarks.

CDC had documented security configuration baselines, but had not always securely configured its systems or applied patches. In addition, the agency had not consistently configured security settings in accordance with prescribed security benchmarks or applied patches in a timely manner. For example:

CDC had configured Windows servers to run unnecessary services.

CDC had configured only about 62 percent of the security settings in accordance with prescribed benchmark criteria on the Windows and infrastructure servers supporting five systems that we reviewed.

During our site visit in April 2017, CDC had not installed 21 updates on about 20 percent of the network devices, including 17 updates that the vendor considered to be critical or high-risk. The oldest of the missing updates dated back to January 2015.

CDC had not updated database software supporting two selected systems to a more recent version that addressed vulnerabilities with a medium severity rating.

According to OCIO officials, CDC had deficiencies in configuration and patching primarily due to administrators not being aware that there was a technical solution or did not adequately monitor configuration settings. By not securely configuring devices and installing updates and patches in a timely manner, the agency is at increased risk that individuals could have exploited known vulnerabilities to gain unauthorized access to agency computing resources.

Staff Received Security Awareness Training, but At Least 15 Percent of Those with Significant Security Responsibilities Did Not Receive Role-Based Training

According to NIST SP 800-53, agencies should provide adequate security training to individuals in a role such as system/network administrator and to personnel conducting configuration management and auditing activities, tailoring the training to their specific roles. In addition, one of the cybersecurity cross-agency priority goals requires that agencies implement training that reduces the risk that individuals will introduce malware through email and malicious or compromised web sites.

Consistent with NIST SP 800-53, CDC policy required network users to receive annual security awareness training. Accordingly, for fiscal year 2017, all CDC staff completed the required annual security awareness training.

CDC policy also required that those staff identified as having significant security responsibilities receive role-based training every 3 years. However, not all staff with significant security responsibilities received role-based training within the defined time frames. The agency used a tracking system to monitor the status of role-based training for 377 individuals who had been identified as having significant security responsibilities. As of May 2017, 56 (about 15 percent) of the 377 individuals had not completed the training within the last 3 years, and 246 (about 65 percent) of them had not taken training within the last year.

In addition, CDC had not identified at least 30 other staff with significant security responsibilities who required role-based training. Specifically, none of the 18 security and database administrators for four selected systems were included among the individuals being tracked, although these administrators had significant security responsibilities. Further, the agency provided us with a list of 42 individuals whose job series indicated that they required role-based training. However, 12 of the 42 were not included among the tracked individuals. Furthermore, given the number of deficiencies identified and the rapidly evolving nature of cyber threats, CDC’s requirement that staff take role-based training only once every 3 years is not sufficient for individuals with significant cybersecurity responsibilities.

According to OCIO officials, managers are responsible for identifying those individuals with significant security responsibilities. The process used to track training was manual and required an individual’s manager to specify training requirements. The officials noted that the agency plans to implement a new HHS annual role-based training requirement in fiscal year 2018 and that they intend to work to enhance oversight as the new requirement is implemented.

The officials also stated that at least 10 of the 94 technical control-related deficiencies identified in our June 2018 report had resulted, at least in part, from staff not being aware of control requirements or solutions to address the deficiencies. As a result, CDC’s information and systems are at increased risk that staff may not have the knowledge or skills needed to appropriately protect them.

CDC Had Not Effectively Implemented Controls Intended to Detect Incidents or Deficiencies

The detect core security function is intended to allow for the timely discovery of cybersecurity events. Controls associated with this function include logging and monitoring system activities and configurations, assessing security controls in place, and implementing continuous monitoring. In June 2018, we reported that, although CDC had implemented controls intended to detect the occurrence of a cybersecurity event, it had not sufficiently implemented logging and monitoring capabilities or effectively assessed security controls.

CDC Had Implemented Limited Logging and Monitoring Capabilities

NIST SP 800-53 states that agencies should enable system logging features and retain sufficient audit logs to support the investigations of security incidents and the monitoring of select activities for significant security-related events. In addition, National Archives and Records Administration records retention guidance states that system files containing information requiring special accountability that may be needed for audit or investigative purposes should be retained for 6 years after user accounts have been terminated or passwords altered, or when an account is no longer needed for investigative or security purposes, whichever is later. NIST also states that agencies should monitor physical access to facilities where their information systems reside to detect physical security incidents. Further, NIST SP 800-53 states that agencies should monitor and control changes to configuration settings.

Although CDC had implemented centralized logging and network traffic monitoring capabilities, the capabilities were limited. For example, the agency’s centralized logging system used for security monitoring had a limited storage capacity and did not meet the National Archives and Records Administration requirements. In addition, CDC had not centrally collected and monitored security event data for many key assets connected to the network. As a result, increased risk existed that CDC would not have been able to detect anomalous activities that may have occurred from malware attacks over time. OCIO officials stated that, as a compensating measure, the agency prevents direct communications between workstations. However, such a measure does not allow the agency to detect potentially inconsistent activities that may have occurred from malware attacks within the same data center.

CDC also had not consistently reviewed physical access logs to detect suspicious physical access activities, such as access outside of normal work hours and repeated access to areas not normally accessed. Program offices responsible for 7 of the 8 selected mission-essential systems did not conduct such a review. According to OCIO officials, the offices were not aware of the need for a review. However, without reviewing physical access logs, CDC has reduced assurance that the agency would detect suspicious physical access activities.

Further, CDC had not routinely monitored the configuration settings of its systems to ensure that the configurations were securely set. For example, for at least 41 of 94 technical control deficiencies we identified, OCIO officials cited quality control gaps where the change management process or system administrators had not discovered deficiencies resulting from insecure configuration settings. Without an effective monitoring process in place for system configurations, the agency was not aware of insecure system configurations.

CDC Did Not Effectively Test or Assess Controls to Detect Deficiencies

FISMA requires each agency to periodically test and evaluate the effectiveness of its information security policies, procedures, and practices. The law also requires agencies to test the management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems at a frequency depending on risk, but no less than annually. In addition, NIST SP 800- 53A identifies three assessment methods—interview, examine, and test— and describes the potential depth and coverage for each. Assessing a control’s effectiveness based on an interview is likely less rigorous than examining a control; similarly, examining a control is likely less rigorous than testing the control’s functionality.

CDC had not sufficiently tested or assessed the effectiveness of the security controls for the 8 mission-essential systems that we reviewed. Although CDC annually assessed security controls of selected systems, the agency had only examined control descriptions in security plans to ensure accuracy. At least once every 3 years, the agency selected controls for a more in-depth assessment of the 8 mission-essential systems we reviewed. However, CDC had assessed only 191 (about 7 percent) of 2,818 controls described in the security plans for the selected systems. In addition, the agency used methods for assessing controls that were often not rigorous enough to identify the control deficiencies that we identified. For example, as depicted in figure 1, CDC relied exclusively on interviews—a less rigorous method—to assess 20 percent of the 191 controls it assessed for the selected systems.

The security control tests and assessments were insufficient in part because CDC had not developed comprehensive security assessment plans or had not consistently implemented the plans for the 8 selected mission-essential systems we reviewed. For example, one system’s assessment plan indicated that five controls should be assessed using a testing methodology; instead, however, the assessor conducted interviews to determine whether controls were effective or not.

OCIO officials stated that the security control test and assessment process is manual and staffing is limited. They stated that the agency intends to rely increasingly on automated tools—such as the tools implemented by the Continuous Diagnostics and Mitigation program—for performing the assessments. Nevertheless, by not assessing controls in an in-depth and comprehensive manner, CDC has limited assurance that the security controls are in place and operating as intended. Further, without developing and implementing comprehensive assessment plans, assessments may not be performed with sufficient rigor to identify control deficiencies.

CDC Had Implemented Processes for Responding to Incidents or Identified Deficiencies, but Did Not Always Take Timely Corrective Actions

The respond core security function is intended to support the ability to contain the impact of a potential cybersecurity event. Controls associated with this function include implementing an incident response capability and remediating newly-identified deficiencies. Although CDC had implemented controls for incident response to detect cybersecurity events, we reported in June 2018 that the agency had not maintained adequate information to support its incident response capability or taken timely corrective actions to remediate identified control deficiencies.

CDC Had Implemented Incident Response Capabilities, but Did Not Maintain Adequate Information

NIST SP 800-53 and SP 800-61 state that agencies should develop and document an incident response policy with corresponding implementation procedures and an incident response plan, and keep them updated according to agency requirements. NIST also states that agencies should implement an incident handling capability, including an incident response team that consists of forensic/malicious code analysts. In addition, agencies are to provide incident response training for the team and test the incident response capability to determine the effectiveness of the response.

Further, NIST states that agencies are to monitor incidents by tracking and documenting them and maintain records about each incident, including forensic analysis. Finally, National Archives and Records Administration guidance states that records and data relevant to security incident investigations should be retained for 3 years.

CDC had implemented an incident response capability. The agency had developed policy, procedures, and a plan that addressed incident response, and updated them annually. CDC had an incident response team that managed all of the incident handling and response efforts for the agency, and conducted forensic analyses for reported security incidents. Team members had undergone training, such as an advanced network forensic and analysis course offered by a private firm. In addition, the agency had periodically tested its incident handling capability by conducting penetration testing exercises. These exercises allowed the team to test its real-time response capabilities.

CDC’s incident response procedures state that incident tickets should include a description of actions taken, response time, and whether actions have been completed or not. The agency’s procedures also require that computers affected by an incident be removed from the network immediately.

Nevertheless, CDC had shortcomings in implementing its incident response capability and monitoring procedures. For the 11 security incidents CDC considered most significant over a 19-month period ending in March 2017, the agency had not consistently described the actions taken, the response times, or whether remedial actions had been completed. The agency also had not maintained audit log records for its security incidents. For example, the agency described recommended actions for 10 of the 11 incidents, but did not describe the actions that had been taken.

In addition, although incident response team officials told us that all incident ticket records had been saved, CDC had not retained system log data that supported incident resolution for at least five of the incidents. The agency’s policy did not address record retention in accordance with National Archives and Records Administration guidance. Further, for two of the security incidents, the security incident tickets did not clearly indicate when two compromised workstations had been removed from the network. According to OCIO officials, shortcomings in fully documenting incidents resulted from the organization being understaffed, primarily due to budget limitations and the inability to hire qualified personnel. Without effectively tracking and documenting information system security incidents, CDC’s systems are at increased risk that the impact of security incidents would not be fully addressed.

CDC Had Remedial Action Plans to Address Identified Deficiencies for Selected Systems, but Did Not Always Take Timely Corrective Actions or Have Plans for Other Needed Corrective Actions

FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in information security policies, procedures, or practices. NIST SP 800-53 states that agencies are to develop a plan of action and milestones (POA&M) for an information system to document the agency’s planned remedial actions to correct identified deficiencies. CDC policy was consistent with the NIST guidelines.

CDC had developed POA&Ms for deficiencies identified by its security control assessments, but had not remediated the deficiencies in a timely manner. For each of the 8 selected mission-essential systems, the agency had created plans for correcting control deficiencies. However, the agency did not implement several remedial actions by their due date. For example, expected completion dates had passed for correcting deficiencies associated with 4 of the 8 selected mission-essential systems. For these 4 systems, the completion dates were 1 to 8 months beyond the due dates at the time of our review in September 2017.

According to Office of the Chief Information Security Officer officials, program offices that own the systems did not always communicate updates on the status of remedial actions for their respective systems, noting that deficiencies may have been corrected. Without effective communication to update its POA&Ms, CDC was not in a position to effectively manage its remedial actions and correct known deficiencies in a timely manner.

CDC Had Developed and Tested Plans for System Recovery, but Had Not Assessed the Risk Associated with the Close Proximity of an Alternate Processing Site

The recover core security function is intended to support timely recovery of normal operations to reduce the impact from a cybersecurity event. Controls associated with this function include developing and testing contingency plans to ensure that, when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected. Losing the capability to process, retrieve, and protect electronically maintained information can significantly affect an agency’s ability to accomplish its mission. If contingency planning is inadequate, even relatively minor interruptions can result in lost or incorrectly processed data, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete information.

NIST SP 800-53 states that agency systems should have a contingency plan that includes the identification of key personnel and the systems’ essential mission functions and addresses full information system restoration. For high-impact systems, NIST specifies that agencies test contingency plans at an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats. In addition, NIST states that organizations should initiate corrective actions based on testing if they are needed.

As we reported in June 2018, CDC had developed and fully tested contingency plans for each of the 8 selected mission-essential systems that we reviewed. Each plan identified key personnel and their contact information, essential mission functions of the systems, and instructions on how to fully restore the systems in the event of a disruption. Additionally, between January 2015 and May 2017, CDC had tested whether the 8 systems could be recovered at their respective alternate sites, and had initiated corrective actions based on the results of the tests.

However, the alternate site for 6 of the 8 selected mission-essential systems was located in relatively close proximity to the main processing site. Although 2 systems had alternate sites located in another state, the alternate site for the other 6 systems was within the same metropolitan area. As a result, an event such as a natural disaster or substantial power outage could affect both the main and alternate sites for these systems, potentially rendering CDC unable to complete functions associated with its mission. Prompt restoration of service is necessary because the required recovery time for these systems ranged from 4 to 24 hours.

Security plans for 3 of the systems recognized the hazards of having the sites within the same geographical region, but stated that CDC had accepted this risk. According to OCIO officials, having a site further away was cost prohibitive; however, the officials had not documented this analysis or the associated risk of having the agency’s processing sites located within the same geographical area. Without documenting the analysis and associated risk, CDC had less assurance that senior leadership was aware of the risk of agency systems being unavailable. As a consequence, senior leadership may not agree whether acceptance of the risk was warranted.

CDC Had Not Consistently or Effectively Implemented Elements of Its Information Security Program

An underlying reason for the information security deficiencies in selected systems was that, although the agency had developed and documented an agency-wide information security program, it had not consistently or effectively implemented elements of the program. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for information systems.

As discussed previously in this report, CDC had implemented aspects of each of these elements. For example, the agency had conducted risk assessments, developed security plans, assessed security controls, developed remedial action plans, and developed and tested contingency plans for each of the 8 selected mission-essential systems. In addition, the agency had documented numerous policies and procedures and ensured that staff had completed annual security awareness training.

However, CDC’s program had shortcomings. For example, as discussed earlier in this report, CDC had not consistently or effectively: addressed threats, technical constraints, and the changing threat environment in its system risk assessments, or assessed the risk of having alternate processing sites within close proximity to each other; documented detailed technical requirements in policies and procedures, or facility controls in facility security plans; tracked and trained staff with significant security responsibilities; monitored configuration settings and comprehensively assessed remediated deficiencies in a timely manner; or documented its cost analysis and associated risk of having an alternate processing site within the same geographical region as its primary processing site.

Until CDC addresses these shortcomings and consistently and effectively implements all elements of its information security program, the agency will lack reasonable assurance that its computing resources are protected from inadvertent or deliberate misuse.

CDC Has Implemented Many of the Recommendations in Our June 2018 Report and Plans to Implement the Rest

In our June 2018 report, we made 195 recommendations to CDC to strengthen its technical security controls and bolster its agency-wide information security program. Specifically, we recommended that the agency take 184 actions to resolve technical control deficiencies by implementing stronger access controls, encrypting sensitive data, configuring devices securely, applying patches in a timely manner, strengthening firewall rules, and implementing logging and monitoring controls more effectively, among other actions. We also made 11 recommendations for CDC to improve its information security program by, among other things, assessing risks as needed, documenting more detailed technical requirements, monitoring and assessing controls more comprehensively, and remediating deficiencies in a timely manner.

Since the issuance of our June 2018 report, CDC has made significant progress in implementing the recommendations we made to resolve the technical security control deficiencies in the information systems we reviewed and to improve its information security program. In this regard, the agency has implemented many of the recommendations for improving technical security controls for the systems we reviewed and has developed plans to implement recommendations for enhancing its information security program.

Specifically, as of August 3, 2018, CDC had fully implemented 102 (55 percent) of the 184 recommendations we made to fortify the technical security controls over the systems we reviewed. In addition, the agency had partially implemented 20 (11 percent) of the 184 recommendations. In these instances, CDC had made progress toward implementing the recommendations, but had not completed all of the necessary corrective actions for us to close the recommendations. Therefore, these recommendations remain open. Further, CDC did not provide any evidence that it had implemented the remaining 62 technical control- related recommendations.

Table 3 summarizes the status of CDC’s efforts to implement the 184 recommendations that we made to resolve the technical control deficiencies, as of August 3, 2018.

By implementing 102 recommendations, CDC (as of August 3, 2018) reduced some of the risks associated with certain key activities. Specifically, these efforts included protecting network boundaries and logging and monitoring security events for indications of inappropriate or unusual activity on systems—that we highlighted in our June 2018 report as being particularly vulnerable and requiring the agency’s greater priority and attention. In addition, the agency had implemented several of our recommendations to rectify a number of the security control deficiencies. These efforts included strengthening firewall rules, implementing stronger access controls, configuring devices securely, and expanding its audit monitoring capabilities.

In addition, CDC had developed a plan of action and milestones (POA&M) for each of the identified technical control deficiencies and related recommendations that remained open as of August 3, 2018. The POA&Ms assigned organization responsibilities, identified estimated costs, identified points of contact, and established time frames for resolving the deficiencies and closing the related recommendations. The agency’s plans called for it to implement the majority of the remaining open technical control-related recommendations by September 2019, and all recommendations by September 2020, as shown in figure 2.

Our June 2018 report also included 11 recommendations to CDC to improve its information security program. In particular, we recommended that the agency, among other things, evaluate system impact level categorizations to ensure they reflect the current operating environment; update risk assessments to identify threats and the likelihood of impact of the threat on the environment; and update the facility risk assessments. In addition, we recommended that the agency take the necessary steps to make sure staff with significant security roles and responsibilities are appropriately identified and receive role-based training; monitor the configuration settings of agency systems to ensure the settings are set as intended; update security control assessments to include an assessment of controls using an appropriate level of rigor; and remediate POA&Ms in a timely manner. Further, we recommended that the agency document the cost-benefit analysis with associated risk of having an alternate site within the same geographical region as the main site.

As of August 3, 2018, the agency had partially implemented 1 of the 11 information security program-related recommendations, but had not provided any evidence that it had implemented the remaining 10 recommendations. Regarding the partially implemented recommendation, CDC had provided role-based training to all personnel performing significant security responsibilities. However, the agency still needed to establish and automate the identification process and the tracking of training records for individuals needing specialized security role-based training. CDC had developed plans to fully implement this recommendation and each of the remaining 10 information security program-related recommendations by July 2019. Fully implementing the open recommendations is essential to ensuring that the agency’s systems and sensitive information are not at increased and unnecessary risk of unauthorized use, disclosure, modification, or disruption.

Agency Comments

We received written comments on a draft of this report from CDC. In its comments, which are reprinted in appendix III, the agency stated that it recognizes the risks associated with operating a large, global information technology enterprise and has implemented processes, procedures, and tools to better ensure the prevention, detection, and correction of potential incidents. CDC also said cybersecurity remains a high priority and that it takes the responsibilities for protecting public health information and data entrusted to it seriously. To strengthen its cybersecurity program, the agency stated that it is restructuring and streamlining the cyber program and IT infrastructure of its Office of the Chief Information Officer.

Further, CDC stated that it has leveraged GAO’s limited official use only report, issued in June 2018, to accelerate its implementation, infrastructure, and software deployments to complete phrases one and two of DHS’s Continuous Diagnostics and Mitigation program. The agency also said it concurred with, and highlighted a number of actions that it had planned or begun taking to remediate, the 11 security program recommendations that we made to CDC in our June 2018 report.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and the department’s Office of the Inspector General, the Director of CDC, and interested congressional parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or Dr. Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objective was to assess the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems. In June 2018, we issued a report which detailed the findings from our work in response to this objective. In the report, we made 184 recommendations to CDC to resolve the technical security control deficiencies in the information systems we reviewed and 11 additional recommendations to improve its information security program. We designated that report as “limited official use only” (LOUO) and did not release it to the general public because of the sensitive information it contained.

This report publishes the findings discussed in our June 2018 report, but we have removed all references to the sensitive information. Specifically, we deleted the names of the information systems and computer networks that we examined, disassociated identified control deficiencies from named systems, deleted certain details about information security controls and control deficiencies, and omitted an appendix that was contained in the LOUO report. The appendix contained sensitive details about the technical security control deficiencies in the CDC’s information systems and computer networks that we reviewed, and the 184 recommendations we made to mitigate those deficiencies. We also provided a draft of this report to CDC officials to review and comment on the sensitivity of the information contained herein and to affirm that the report can be made available to the public without jeopardizing the security of CDC’s information systems and networks.

In addition, this report addresses a second objective that was not included in the June 2018 report. Specifically, this objective was to determine the extent to which CDC had taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement that we identified in the earlier report.

As noted in our June 2018 report, we determined the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems. To do this, we initially gained an understanding of the overall network environment, identified interconnectivity and control points, and examined controls for the agency’s networks and facilities. We conducted site visits at two CDC facilities in Atlanta, Georgia.

To evaluate CDC’s controls over its information systems, we used our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information. We based our assessment of controls on requirements identified by the Federal Information Security Modernization Act of 2014 (FISMA), which establishes key elements for an effective agency-wide information security program; NIST guidelines and standards; Department of Health and Human Services and CDC policies, procedures, and standards; and standards and guidelines from relevant security organizations, such as the National Security Agency, the Center for Internet Security, and the Interagency Security Committee.

We had reviewed a non-generalizable sample of the agency’s information systems, focusing on those systems that (1) collect, process, and maintain private or potentially-sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; and (3) were assigned a Federal Information Processing Standard rating of moderate or high impact. Based on these criteria, we had selected eight mission-essential systems for our review.

Of these systems, the agency had categorized 7 as high-impact systems and 1 as a moderate-impact system. For these 8 selected mission- essential systems, we had reviewed information security program-related controls associated with risk assessments, security plans, security control assessments, remedial action plans, and contingency plans.

To assess the safeguards CDC implemented for its systems, we had examined technical security controls for 24 CDC systems, including systems the agency designated as high-value assets. These included 10 key systems, 8 of which were high- and moderate-impact mission- essential systems just described, 1 additional high-impact system, 1 additional moderate-impact system, and 14 general support systems. We selected the additional high-impact system because the agency re- categorized it as a high-impact system during our review. We selected the additional moderate-impact system because the agency used it to control physical access to highly sensitive CDC biologic lab facilities, including facilities that handle dangerous and exotic substances that cause incurable and deadly diseases.

We selected 10 key systems, 8 of which were mission-essential systems, for review that (1) collect, process, and maintain private or potentially sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; (3) could have a catastrophic or severe impact on operations if compromised; or (4) could be of particular interest to potential adversaries. We also selected 14 general support systems that were part of the agency’s network infrastructure supporting the 10 key systems.

To review controls over the 10 key systems and 14 general support systems, we had examined the agency’s network infrastructure and assessed the controls associated with system access, encryption, configuration management, and logging and monitoring. For reporting purposes, we had categorized the security controls that we assessed into the five core security functions described in the National Institute of Standards and Technology’s (NIST) cybersecurity framework. The five core security functions are: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.

Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.

These core security functions are described in more detail in appendix II.

For the identify core security function, we had examined CDC’s reporting for its hardware and software assets; analyzed risk assessments for the eight selected mission-essential systems to determine whether threats and vulnerabilities were being identified; reviewed risk assessments for two facilities; analyzed CDC policies, procedures, and practices to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; and analyzed security plans for the eight selected systems to determine if those plans had been documented and updated according to federal guidance. We also evaluated the risk assessments for two facilities that housed the 8 mission-essential selected systems.

For the protect core security function, we had examined access controls for the 24 systems. These controls included the complexity and expiration of password settings to determine if password management was being enforced; administrative users’ system access permissions to determine whether their authorizations exceeded the access necessary to perform their assigned duties; firewall configurations, among other things, to determine whether system boundaries had been adequately protected; and physical security controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft.

We also had examined configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted. In addition, we had examined configuration settings for routers, network management servers, switches, firewalls, and workstations to determine if settings adhered to configuration standards, and inspected key servers and workstations to determine if critical patches had been installed and/or were up-to-date. Further, we had examined training records to determine if employees and contractors had received security awareness training according to federal requirements, and whether personnel who have significant security responsibilities had received training commensurate with those responsibilities.

For the detect core security function, we had analyzed centralized logging and network traffic monitoring capabilities for key assets connected to the network; analyzed CDC’s procedures and results for assessing security controls to determine whether controls for the eight selected mission- essential systems had been sufficiently tested at least annually and based on risk. We also had reviewed the agency’s implementation of continuous monitoring practices to determine whether the agency had developed and implemented a continuous monitoring strategy to manage its information technology assets and monitor the security configurations and vulnerabilities for those assets.

For the respond core security function, we had reviewed CDC’s implementation of incident response practices, including an examination of incident tickets for 11 incidents; and had examined the agency’s process for correcting identified deficiencies for the eight selected mission-essential systems.

For the recover core security function, we had examined contingency plans for eight selected mission-essential systems to determine whether those plans had been developed and tested. In assessing CDC’s controls associated with this function, as well as the other four core functions, we had interviewed Office of the Chief Information Officer officials, as needed.

Within the core security functions, as appropriate, we had evaluated the elements of CDC’s information security program based on elements required by FISMA. For example, we analyzed risk assessments, security plans, security control assessments, and remedial action plans for each of the 8 selected mission-essential systems. In addition, we had assessed whether the agency had ensured staff had completed security awareness training and whether those with significant security responsibilities received commensurate training. We also had evaluated CDC’s security policies and procedures.

To determine the reliability of CDC’s computer-processed data for training and incident response records, we had evaluated the materiality of the data to our audit objective and assessed the data by various means, including reviewing related documents, interviewing knowledgeable agency officials, and reviewing internal controls. Through a combination of methods, we concluded that the data were sufficiently reliable for the purposes of our work.

To accomplish our second objective—on CDC’s actions to address the previously identified security program and technical control deficiencies and related recommendations—we requested that the agency provide a status report of its actions to implement each of the recommendations. For each recommendation that CDC indicated it had implemented as of August 3, 2018, we examined supporting documents, observed or tested the associated security control or procedure, and/or interviewed the responsible agency officials to assess the effectiveness of the actions taken to implement the recommendation or otherwise resolve the underlying control deficiency. Based on this assessment and CDC status reports, we defined the status of each recommendation into the following 3 categories: closed-implemented—CDC had implemented the recommendation; open-partially implemented—CDC had made progress toward, but had not completed, implementing the recommendation; and open-not implemented—CDC had not provided evidence that it had acted to implement the recommendation.

We conducted this performance audit from December 2016 to December 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: The National Institute of Standards and Technology Cybersecurity Framework

The National Institute of Standards and Technology’s cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover. Within the five functions are 23 categories and 108 subcategories, as described in the table.

Appendix III: Comments from Department of Health and Human Services

Appendix IV: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individuals named above, Gary Austin, Jennifer R. Franks, Jeffrey Knott, and Chris Warweg (assistant directors); Chibuikem Ajulu-Okeke, Angela Bell, Sa’ar Dagani, Nancy Glover, Chaz Hubbard, George Kovachick, Sean Mays, Kevin Metcalf, Brandon Sanders, Michael Stevens, Daniel Swartz, and Angela Watson made key contributions to this report. Edward Alexander, Jr. and Duc Ngo (assistant directors); David Blanding, and Christopher Businsky also provided assistance.