Critical Infrastructure Protection: Additional Actions Needed to Identify Framework Adoption and Resulting Improvements
Released: 2020-02-25T00:00:00

Letter

Background

Our nation’s critical infrastructure refers to the systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of them would have a debilitating impact on our security, economic stability, public health or safety, or any combination of these factors. Critical infrastructure includes, among other things, banking and financial institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned and operated by the private sector.

Threats to the systems supporting our nation’s critical infrastructures are evolving and growing. These systems are susceptible to unintentional and intentional threats, both cyber and physical. Unintentional, or nonadversarial, threat sources include equipment failures, software coding errors, or the accidental actions of employees. They also include natural disasters and the failure of other critical infrastructures, since the sectors are often interdependent.

Intentional or adversarial threats can involve targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, and disgruntled employees. Adversaries can leverage common computer software programs to deliver a threat by embedding exploits within software files that can be activated when a user opens a file within its corresponding program.

Due to the cyber-based threats to federal systems and critical infrastructure, the persistent nature of information security vulnerabilities, and the associated risks, GAO first designated federal information security as a government-wide high-risk area in our biennial report to Congress in 1997. In 2003, we expanded this high-risk area to include the protection of critical cyber infrastructure and, in 2015, we further expanded this area to include protecting the privacy of personally identifiable information. We continue to identify the protection of critical cyber infrastructure as a high-risk area, as shown in our March 2019 high- risk update.

Federal Law and Policy Assign Responsibilities for the Protection of Critical Infrastructure Sectors

Because the private sector owns the majority of the nation’s critical infrastructure, it is vital that the public and private sectors work together to protect these assets and systems. Toward this end, federal law and policy assign roles and responsibilities for agencies to assist the private sector in protecting critical infrastructure, including enhancing cybersecurity.

Presidential Policy Directive 21 establishes the SSAs in the public sector as the federal entities responsible for providing institutional knowledge and specialized expertise. The SSAs lead, facilitate, and support the security and resilience programs and associated activities of their designated critical infrastructure sectors.

The directive identified 16 critical infrastructure sectors and designated the nine associated SSAs, as shown in figure 1.

In addition, the directive required DHS to update the National Infrastructure Protection Plan to address the implementation of the directive. The directive called for the plan to include, among other things, the identification of a risk management framework to be used to strengthen the security and resilience of critical infrastructure and a metrics and analysis process to be used to measure the nation’s ability to manage and reduce risks to critical infrastructure. DHS, in response, updated the National Infrastructure Protection Plan in December 2013 in collaboration with public- and private-sector owners and operators and federal and nonfederal government representatives, including SSAs, from the critical infrastructure community. According to the 2013 plan, SSAs are to work with their private-sector counterparts to understand cyber risk and they are to develop and use metrics to evaluate the effectiveness of risk management efforts.

To work with the government, the SCCs were formed as self-organized, self-governing councils that enable critical infrastructure owners and operators, their trade associations, and other industry representatives to interact on a wide range of sector-specific strategies, policies, and activities. The SSAs and the SCCs coordinate and collaborate in a voluntary fashion on issues pertaining to their respective critical infrastructure sector.

In addition to the directive, federal laws and policies have also established roles and responsibilities for federal agencies to work with industry to enhance the cybersecurity of the nation’s critical infrastructures. These include the Cybersecurity Enhancement Act of 2014 and Executive Order 13636.

In February 2013, Executive Order 13636 outlined an action plan for improving critical infrastructure cybersecurity. Among other things, the executive order directed NIST to lead the development of a flexible performance-based cybersecurity framework that was to include a set of standards, procedures, and processes. The executive order also directed SSAs, in consultation with DHS and other interested agencies, to coordinate with the SCCs to review the cybersecurity framework and, if necessary, develop implementation guidance or supplemental materials to address sector-specific risks and operating environments.

Further, in December 2014, the Cybersecurity Enhancement Act of 2014 established requirements that are consistent with the executive order regarding NIST’s development of a cybersecurity framework. According to this law, NIST’s responsibilities in supporting the ongoing development of the cybersecurity framework included, among other things, identifying an approach that is flexible, repeatable, performance-based, and cost- effective. Additionally, the Cybersecurity Act requires NIST to coordinate with federal and nonfederal entities (e.g., SSAs, SCCs, and ISACs) to identify a prioritized, performance-based approach to include information security measures to help entities assess risk.

In May 2017, Executive Order 13800 directed federal agency heads to use the framework to manage cybersecurity risks. The executive order also required them to provide a risk management report to DHS and the Office of Management and Budget within 90 days of the date of the executive order. The risk management report calls for agencies to document the risk mitigation and acceptance choices including, for example, describing the agency’s action plan to implement the framework.

NIST Established a Framework for Improving Critical Infrastructure Cybersecurity

In response to Executive Order 13636, NIST published, in February 2014, the Framework for Improving Critical Infrastructure Cybersecurity, a voluntary framework of cybersecurity standards and procedures for industry to adopt. According to NIST, as of February 2019, the framework had been downloaded more than a half million times since its initial publication in 2014. Additionally, it has been translated into Arabic, Japanese, Portuguese, and Spanish, and has been adopted by many foreign governments. The framework is composed of three main components: the framework core, the implementation tiers, and the profiles.

The framework core provides a set of activities to achieve specific cybersecurity outcomes and references examples of guidance to achieve those outcomes. Through the use of the profile, the framework is intended to help organizations align their cybersecurity activities with business requirements, risk tolerances, and resources.

The framework core is divided into four elements: functions, categories, subcategories, and informative references. Functions consist of five elements—(1) identify, (2) protect, (3) detect, (4) respond, and (5) recover. When considered together, these functions provide a strategic view of the life cycle of an organization’s management of cybersecurity risk. Categories are the subdivisions of a function into groups of cybersecurity outcomes tied to programmatic needs and particular activities (i.e. asset management). Subcategories further divide a category into specific outcomes of technical and/or management activities (i.e. notifications from detection systems are investigated). Lastly, informative references are specific sections of standards, guidelines, and practices that illustrate a method to achieve the outcomes described and support one or more informative references (i.e. NIST Special Publication (SP) 800-53A).

Implementation tiers characterize an organization’s approach to managing cybersecurity risks over a range of four tiers. The four tiers are partial, risk informed, repeatable, and adaptive. They reflect a progression from informal, reactive responses to approaches that are flexible and risk- informed.

Profiles enable organizations to establish a road map for reducing cybersecurity risks that is well aligned with organizational and sector goals, consider legal/regulatory requirements and industry best practices, and reflect risk management priorities. Organizations can use the framework profiles to describe the current state (the cybersecurity outcomes that are currently being achieved) or the desired target state (the outcomes needed to achieve the desired cybersecurity risk management goals) of specific cybersecurity activities.

GAO Has Previously Reported on the Development, Promotion, and Adoption of the Cybersecurity Framework

In December 2015, we issued our first report on the development and promotion of the framework in response to the 2014 Cybersecurity Act. We reported that the framework met the requirements established in federal law that it be flexible, repeatable, performance-based, and cost- effective. We also reported that SSAs and NIST had promoted and supported adoption of the cybersecurity framework in the critical infrastructure sectors. For example, we reported that DHS had established the Critical Infrastructure Cyber Community Voluntary Program to encourage adoption of the framework and had undertaken multiple efforts as part of this program. These efforts included developing guidance and tools intended to help sector entities that use the framework. However, we noted that DHS had not developed metrics to measure the success of its activities and programs. Accordingly, we concluded that DHS could not determine if its efforts were effective in encouraging adoption of the framework. We recommended that the department develop metrics to assess the effectiveness of its framework promotion efforts. DHS agreed with the recommendation and subsequently took actions to implement it.

We also reported in December 2015 that SSAs had promoted the framework in their sectors by, for example, presenting the framework at meetings of sector stakeholders and holding other promotional events. In addition, all of the SSAs, except for DHS and the General Services Administration (GSA), as co-SSAs for the government facilities sector, made decisions, as required by Executive Order 13636, on whether to develop tailored framework implementation guidance for their sectors.

However, we noted that DHS and GSA had not set a time frame to determine, as required by Executive Order 13636, whether sector-specific implementation guidance was needed for the government facilities sector. We concluded that, by not doing so, DHS and GSA could be hindering the adoption of the framework in this sector. As a result, we recommended that DHS and GSA set a time frame to determine whether implementation guidance was needed for the government facilities sector. Both DHS and GSA agreed with our recommendations and subsequently took actions to implement them.

More recently, in February 2018, we issued our second report on the adoption of the framework. We reported that most of the 16 critical infrastructure sectors had taken action to facilitate adoption of the framework by entities within their sectors. We also reported that 12 of the 16 critical infrastructure sectors had taken actions to review the framework and, if necessary, develop implementation guidance or supplemental materials that addressed how entities within their respective sectors can adopt the framework.

We also reported that none of the SSAs had measured the cybersecurity framework’s implementation by entities within their 16 respective sectors. We noted that the nation’s plan for national critical infrastructure protection efforts stated that federal and nonfederal sector partners (including SSAs) were to measure the effectiveness of risk management goals by identifying high-level outcomes and progress made toward national goals and priorities, including securing critical infrastructure against cyber threats. However, we reported that none of the 16 coordinating councils reported having qualitative or quantitative measures of framework adoption because they generally did not collect specific information from entities about critical infrastructure protection activities.

Most SSAs Have Not Developed Methods to Determine Framework Adoption

As of November 2019, most of the SSAs had not developed methods to determine their level and type of cybersecurity framework adoption, as we previously recommended. The SSAs and SCCs identified a number of impediments to developing a comprehensive understanding of the use of the framework, including the voluntary nature of the framework. However, most SSAs have taken steps to encourage and facilitate use of the framework. Further, the 12 selected organizations we interviewed reported either fully or partially using the cybersecurity framework.

Most Sector-Specific Agencies Had Not Determined the Level and Type of Framework Adoption

Best practices identified in the National Infrastructure Protection Plan recommend that entities, such as SSAs and SCCs, take steps to evaluate progress toward achieving their goals—in this case, to implement or adopt the cybersecurity framework. As we previously reported, until the SSAs had a more comprehensive understanding of the use of the cybersecurity framework by entities within the critical infrastructure sectors, they would be limited in their ability to understand the success of protection efforts or to determine where to focus limited resources for cyber risk mitigation. As a result, we recommended that the SSAs take steps to consult with respective sector partner(s), such as the SCCs, DHS, and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by the entities across their respective sectors.

However, as of November 2019, most of the SSAs had not developed methods to determine the level and type of framework adoption. Specifically, only two of the nine SSAs—the Department of Defense (DOD) in collaboration with the defense industrial base sector and GSA in conjunction with DHS’s Federal Protective Service—had methods to determine the level and type of framework adoption across their respective sectors.

DOD, in coordination with the defense industrial base sector, had developed a process to monitor the level or extent to which all contracts (not including commercial off-the-shelf contracts) were or were not adhering to the cybersecurity requirements in DOD acquisition regulations. The regulations called for organizations to implement the security requirements in NIST SP 800-171, which is mapped to the functional areas of the cybersecurity framework. By doing so, DOD is able to determine the level at which the sector organizations are implementing the framework and the type of framework adoption through mapping to the functional areas.

Additionally, the federal departments and agencies that form the government facilities sector had submitted their risk management reports to DHS and OMB that described agencies’ action plans to implement the framework, as required under Executive Order 13800. The risk management assessments are included as part of OMB’s FISMA Annual Report to Congress. As a result, the reports could be used as a resource to inform the level and type of framework adoption.

In addition, two other SSAs had begun taking steps to develop methods to determine the level and type of framework adoption in their sectors. Specifically, in October 2019, DHS, in coordination with its information technology (IT) sector partner, administered a survey to all small and midsized IT sector organizations to gather information on, among other things, framework use and plans to report on the results in 2020. Further, officials in the Department of Transportation’s (DOT) Office of Intelligence, Security, and Emergency Response, in coordination with its co-SSA (DHS), told us that they planned to develop and distribute a survey to the transportation systems sector to determine the level and type of framework adoption. DOT officials stated that the draft survey was undergoing DHS legal review and that the completion of the review and subsequent OMB review would determine when the survey is approved for distribution.

The remaining five SSAs did not have efforts underway to determine the level and type of framework adoption: Department of Agriculture, Department of Energy, Department of Health and Human Services (HHS), Environmental Protection Agency (EPA), and Department of the Treasury. These SSAs identified impediments to determining framework adoption but also noted steps taken to encourage use of the framework within their respective sector.

Department of Agriculture’s Office of Homeland Security officials stated that their sector is diverse and includes over 500 sector members that can range from small farms that are family operated to large corporations that deal with selling food wholesale. The officials noted that the diversity makes it difficult to develop a method for determining the level and type of framework adoption across the sector that would apply to all their members.

The framework, however, is adaptive to provide a flexible and risk- based implementation. Accordingly, the framework can be used with a broad array of cybersecurity risk management processes. Agriculture officials added that the SCC frequently invites DHS to semi-annual meetings to present on both the threat to cybersecurity and resources available to support the needs of the sector.

Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response officials stated that the voluntary nature of the framework made it difficult to determine the level and type of framework adoption.

However, the department published the Cybersecurity Capability Maturity Model in May 2012, with the most recent update (version 1.1) published in February 2014. The model focused on the implementation and management of cybersecurity practices, and was intended to be descriptive, rather than prescriptive, guidance that could be used by organizations of various types and sizes to strengthen their cybersecurity capabilities. The model was designed for organizations to use with a self-evaluation methodology and toolkit to measure and improve their cybersecurity programs and serve as an example for how to implement the framework. In February 2020, officials stated that they were in the process of updating the model and will update the framework implementation guidance once the model has been updated.

HHS’s Assistant Secretary for Preparedness and Response (ASPR) officials stated that, since the use of the framework by the private sector is voluntary, organizations were free to choose any cybersecurity framework(s) that they believed to be most effective for their particular environment.

However, HHS, in collaboration with NIST, DHS, and the Joint Healthcare and Public Health Cybersecurity Working Group, released a cybersecurity publication (Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients) that contained 10 best practices in December 2018 for the healthcare and public health services sector based on the framework. This publication allowed stakeholders to identify how to use the framework with existing sector resources by raising awareness and providing vetted cybersecurity practices to enable the organizations to mitigate cybersecurity threats to the sector. In addition, officials from HHS’s ASPR stated that the working group discussed the challenges associated with measuring the use and impact of the NIST framework, and approved the establishment of a task group in 2020 to further investigate the issue. ASPR officials added that some of the ideas discussed included the use of surveys and identification of a set of voluntary reporting indicators.

EPA officials told us that the agency will coordinate with its SCC to identify appropriate means to collect and report information, such as a survey, to determine the level and type of framework adoption. They explained that, in the past, the water sector had expressed concerns with sharing sensitive cybersecurity information and in developing metrics to evaluate cybersecurity practices.

However, EPA officials stated that they have conducted training, webcasts, and outreach related to cybersecurity, including using the framework and tailoring its efforts to sector needs. According to EPA officials, the agency’s goal in doing so was to ensure that sector organizations understood the importance of the framework.

Department of the Treasury officials noted the size of the financial services sector as an impediment to determine framework adoption. Specifically, officials stated that, because of the large number of members, it is difficult to survey all 800,000 organizations to determine framework adoption.

However, officials stated that the department, in coordination with the Financial and Banking Information Infrastructure Committee, and in consultation with NIST, developed the Cybersecurity Lexicon in March 2018. The lexicon addressed, among other things, common terminology for cyber terms used in the framework. Additionally, the financial services sector, in consultation with NIST, created the Financial Services Sector Cybersecurity Profile (profile) in October 2018, which mapped the framework core to existing regulations and guidance, such as the Commodity Futures Trading Commission System Safeguards Testing Requirements. Officials stated that these efforts will facilitate the use of the framework.

While the five SSAs have ongoing initiatives, implementing our recommendations to gain a more comprehensive understanding of the framework’s use by critical infrastructure sectors is essential to the success of protection efforts.

Most SSAs Have Taken Steps to Facilitate Use of the Framework

Executive Order 13636 directs SSAs, in consultation with DHS and other agencies, to review the cybersecurity framework and, if necessary, develop implementation guidance or supplemental materials to address sector-specific risks and facilitate framework use. Most of the SSAs developed guidance to encourage and facilitate use of the framework. Specifically, SSAs for 13 of the 16 sectors had developed implementation guidance that included mapping the existing sector cybersecurity tools, standards, and approaches to the framework. For example, the implementation guidance for the healthcare and public health sector provides instruction on how to align a host of existing voluntary or required standards (such as those promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996), guidelines, and practices to the framework core functions.

Table 1 describes the 13 sectors and the associated cybersecurity framework implementation guidance.

The Cybersecurity Capability Maturity Model helps organizations evaluate and potentially improve their cybersecurity practices. Appendix A of the Energy Sector Cybersecurity Framework Implementation Guidance provides a mapping of the model to the framework.

The Financial Services Sector Cybersecurity Profile was created for financial institutions of all sizes to use for cyber risk management assessment and a mechanism to comply with various regulatory frameworks and the NIST Cybersecurity Framework.

The remaining three sectors (government facilities, food and agriculture, and IT) had not developed implementation guidance. In this regard, DHS’s Federal Protective Service officials stated that, in 2015, the co- SSAs of the government facilities sector (DHS and GSA) decided that implementation guidance was not needed based on a consensus within the government facilities sector. DHS’s Federal Protective Service officials added that this decision was reevaluated in 2017 and they determined that the guide was still not needed.

Department of Agriculture officials from the Office of Homeland Security stated that the co-SSAs (Agriculture and HHS) and the SCC for the sector collectively decided that a single implementation guidance document was not sufficient for addressing the needs of the diverse membership of the food and agriculture sector and that the creation of such a document was a low priority for the sector. These officials added that, due to the complexity of operations and large number of entities within the sector, the coordinating councils determined that it was more appropriate to refer sector members to DHS's Critical Infrastructure Cyber Community Voluntary Program.

DHS officials representing the SSA for the IT sector stated that the SSA and SCC jointly determined that creating formal implementation guidance within the sector was not necessary. They added that the IT sector continued to play an active role by participating in framework development and promotion across the sectors, to include the development of a small and midsize business cybersecurity survey that was issued in 2019.

In addition to the above efforts, NIST officials stated that they took steps to encourage framework adoption through three main mechanisms for federal and nonfederal entities and organizations that were interested in the framework: (1) conferences and speaking engagements, (2) requests for information to solicit ways in which organizations are using the framework to improve cybersecurity risk management and how best practices are being shared, and (3) industry and agency events, such as webcasts.

Selected Organizations Described Varying Levels of Use of the Framework

The 12 selected organizations reported either fully or partially using the cybersecurity framework. Specifically, six organizations reported fully using the framework, whereas six others reported partially using the framework. For example, one organization that reported fully using the framework stated that the framework core, profiles, and tiers were implemented across all the components or business units in the organization. In contrast, one organization that reported partially using the framework stated that it used the framework profiles, but did not fully use the framework core and tiers. Two other of the organizations that reported partially using the framework stated that they considered themselves to be using the framework since they use International Organization for Standardization (ISO) 27001, an international standard that has elements that overlap with those in the framework.

Selected Organizations Reported Improvements but SSAs Have Not Collected and Reported Sector- Wide Improvements Resulting from Framework Use

The 12 selected organizations using the framework reported varying levels of improvements. Such improvements included identifying risks and implementing common standards and guidelines. However, the SSAs have not collected and reported sector-wide improvements as a result of framework use. The SSAs, SCCs, ISACs, and the selected organizations identified impediments to collecting and reporting such improvements, including developing precise measurements of improvement, the voluntary nature of the framework, and lack of a centralized information sharing mechanism. NIST and DHS have identified initiatives to help address these impediments.

Selected Organizations Described Varying Levels of Improvements from Using the Framework

The 12 selected organizations reported varying levels of improvements as a result of using the framework. Specifically, four of the 12 reported great improvement, six reported some improvement, and two reported little improvement. Examples of each category are described below:

Great improvement: One organization stated that the framework allowed it to determine the current state (the cybersecurity outcomes that are currently being achieved) and the desired target state (the outcomes needed to achieve the desired cybersecurity risk management goals). The organization stated that identifying the current and target states enabled the organization to identify risks and implement common policies, standards, and guidelines across their organization. Officials of the organization also stated that the common language provided by the framework made it easier to communicate within the organization when discussing budgets for cybersecurity that resulted in budget increases.

Some improvement: One organization explained that the framework is accepted across organizations and that modeling its capabilities against the framework provided assurance that it covered the critical aspects of security. However, the organization noted that, if the framework did not exist, it would have used another framework to protect its critical infrastructure and facilitate decision making.

Little improvement: One organization noted that it already had a very robust risk management process through the use of international standards before using the framework. As a result, the organization stated that use of the framework resulted in little improvements. Another organization that reported little improvements stated that use of the framework helped the organization, but there were no specific improvements that it could identify in protecting its critical infrastructure as a result of using the framework.

Initiatives Available to Help Address Impediments to Collecting and Reporting on Sector-Wide Improvements

NIST Special Publication 800-55 guidance on performance measurement states that agency heads are responsible for actively demonstrating support for developing information security measures and facilitating performance improvements in their information security programs, which is to include a periodic analysis of data to determine lessons learned. Additionally, the National Infrastructure Protection Plan directed SSAs and their federal and nonfederal sector partners (including SCCs) to measure the effectiveness of risk management goals by identifying high- level outcomes to facilitate the evaluation of progress toward national goals and priorities, including securing critical infrastructure from cybersecurity threats.

The SSAs are not collecting and reporting on improvements in the protection of critical infrastructure as a result of using the framework across the sectors. The SSAs, SCCs, ISACs, and organizations reported a number of impediments to identifying sector-wide improvements, including developing precise measurements of improvement, the voluntary nature of the framework, difficulty in measuring the direct impact of using the framework, lack of use cases, and lack of a centralized information sharing mechanism. Figure 2 depicts the number of entities and organizations that identified these five impediments, and is followed by a discussion of each challenge.

Two SCCs, two ISACs, and two organizations identified the difficulty of having precise measurements of improvements as a result of using the framework. SCC officials from the communications and healthcare and public health sectors stated that authoritative and precise measurements of improvements are difficult to determine in a consistent and non-subjective manner. For example, the SCC officials for the healthcare and public health sector stated that they were not aware of a direct or precise form of sector-wide measurements to define success in mitigating cybersecurity risk using the framework within the sector. These officials added that future efforts could include methodologies to track sector-wide improvements based on the framework structure or other cybersecurity guidance.

However, officials from NIST’s Information Technology Laboratory stated that they were in the early stages of initiating an information security measurement program to facilitate identifying improvements sector-wide. Officials stated that the program aims to provide foundation tools and guidance to support the development of information security measures that are aligned with an individual organization’s objectives. The officials stated that they had not established a time frame for the completion of the measurement program. They added that, once the program is developed, the SSAs are expected to be able to customize the program and work with their respective sector organizations to determine sector-wide improvements based on their unique objectives.

Eight SSAs, two SCCs, and four organizations stated that the voluntary nature of using the framework made it difficult to identify sector-wide improvements. Officials stated that private sector framework adoption was voluntary and, therefore, there were no specific reporting requirements to provide information on improvements. For example, DOT officials from the Office of Intelligence, Security, and Emergency Response stated that, while the department and its co-SSA (DHS) intended to develop a survey to determine sector-wide improvements, consolidating voluntarily shared information will not reflect the depth and breadth of sector stakeholders, as organizations that share information will not collectively represent a sector.

In April 2019, NIST issued the NIST Roadmap for Improving Critical Infrastructure Cybersecurity, version 1.1, which included a self- assessment tool that provided a mechanism for individual organizations to self-assess how effectively they manage cybersecurity risks in the context of broader enterprise risk management activities and identify improvement opportunities. In addition to the road map, NIST’s framework included a section that encouraged organizations to incorporate measurements of their risks, which can be used to identify sector-wide improvements related to using the framework.

In addition, as previously mentioned, DHS, in partnership with its IT sector partners, administered a survey to the small and mid-sized IT sector organizations to gather information on, among other things, framework adoption, challenges, and related improvements. While DHS did not plan to report on the results until 2020, the survey was intended to help the department in identifying improvements across the small and mid-sized IT sector organizations. The survey was administered to the small and mid-sized organizations within the IT sector. DHS officials stated that any small or mid-sized business across all critical infrastructure sectors could complete the survey and that the department had promoted the survey to all sectors.

Moreover, among all 16 sectors, only DOT and its co-SSA (DHS) had considered the applicability of a similar approach for their sector organizations. Specifically, DOT, in conjunction with DHS, plans to distribute a survey intended to cover framework adoption, challenges, and related improvements across the sector. DOT officials stated that the survey completion is contingent upon DHS’s Transportation Security Administration’s coordination of the review and approval process to meet Paperwork Reduction Act compliance requirements.

Three SSAs, four SCCs, one ISAC, and seven organizations stated that identifying sector-wide improvements as a result of using the framework was difficult due to organizations struggling with determining the direct impact from framework use. For example, the Department of Energy officials from the Office of Cybersecurity, Energy Security, and Emergency Response stated that the sector cannot relate improvements to any one framework or model because the sector organizations are engaged in numerous concurrent public and private cybersecurity initiatives, each of which could impact cybersecurity to varying degrees. In addition, EPA officials from the Office of Groundwater and Drinking Water stated that most organizations will not be able to link improvements directly to the framework because EPA does not exclusively incorporate the framework into the agency’s sector guidance. The officials added that existing industry standards and best practices are also recognized in the development of EPA cybersecurity guidance. Therefore, although an organization might experience improvements from using elements of the framework, it might not be readily apparent that those improvements came directly from the framework.

To provide the sector organizations with access to various framework resources, NIST updated its website to include sector-specific implementation guidance and case studies, as well as insights from organizations using the framework.

Five organizations identified the lack of use cases as an impediment to determining improvements. For example, one organization stated that small and medium organizations struggled with identifying improvements from using the framework because of the lack of use cases (examples for how to determine or measure improvements as a result of using the framework). To address the challenge, the organization stated that it would be helpful if NIST, in collaboration with federal and nonfederal entities, would share and provide use cases or direction on common scenarios small and medium organizations faced and how these could be addressed through the framework.

NIST officials stated that they were in the early stages of developing a cybersecurity framework starter profile for small organizations. NIST officials stated that they did not have a time frame for completing the profile. However, they added that the profile will aim to identify common solutions to a specific challenge, such as threat surface or cybersecurity challenges in cloud computing, using a customized adaptation of the framework.

In addition, DHS created a small and midsize business road map for all critical infrastructure sectors in 2018. The road map provided a guide for small and mid-sized businesses to use in enhancing their cybersecurity posture. The road map also included DHS’s cybersecurity information sharing and collaboration program and secure information sharing portal. The purpose of the information sharing and collaboration program was to enable actionable, relevant, and timely unclassified information exchange through trusted public- private partnerships across all critical infrastructure sectors. In addition, the secure information sharing portal served as a forum to share cybersecurity strategies and insights with the critical infrastructure sectors.

Five organizations identified the lack of a centralized information sharing mechanism as an impediment. For example, one organization stated that there is a challenge in sharing information among all critical infrastructure sectors in a more open and non-judgmental way. To address this challenge, the organization stated that it would be helpful to establish a centralized information sharing mechanism to share and exchange information in an anonymous manner. Another organization added that the challenge with determining improvements is that there is no centralized information sharing mechanism to obtain information. The organization added that it would be helpful to see how organizations compare with one another in terms of goals through this type of mechanism.

DHS, however, identified its homeland security information network as a tool that was intended to be the primary system used by entities to collaborate to protect critical infrastructure. Officials in DHS’s Stakeholder Engagement and Cyber Infrastructure Resilience division stated that the information in its homeland security information network could be used by all sectors to report on best practices, including sector-wide improvements and lessons learned from using the framework.

Although NIST and DHS have identified initiatives to help address the impediments, the SSAs have not reported on sector-wide improvements. Until they do so, the extent to which the 16 critical infrastructure sectors are better protecting their critical infrastructures from threats will be largely unknown.

Conclusions

Most of the SSAs have not determined the level and type of framework adoption, as we previously recommended. Most of the sectors, however, had efforts underway to encourage and facilitate use of the framework. Even with this progress, implementation of our recommendations is essential to the success of protection efforts.

While selected organizations reported varying levels of improvements, the SSAs have not collected and reported sector-wide improvements as a result of framework use. The SSAs and organizations identified impediments to collecting and reporting sector-wide improvements, including the lack of precise measurements of improvement, voluntary nature of the framework, and lack of a centralized information sharing mechanism. However, NIST and DHS have initiatives to help address these impediments. These included an information security measurement program, cybersecurity framework starter profile, information sharing programs, self-assessment tools, and surveys to support SSAs in measuring and quantifying improvements in the protection of critical infrastructure as a result of using the framework. However, NIST has yet to establish time frames for completing the information security measurement program and starter profile. Moreover, the SSAs have yet to report on sector-wide improvements using the initiatives. Until they do so, the critical infrastructure sectors may not fully understand the value of the framework to better protect their critical infrastructures from cyber threats.

Recommendations

We are making the following 10 recommendations to NIST and the nine sector-specific agencies.

The Director of NIST should establish time frames for completing NIST’s initiatives, to include the information security measurement program and the cybersecurity framework starter profile, to enable the identification of sector-wide improvements from using the framework in the protection of critical infrastructure from cyber threats. (Recommendation 1)

The Secretary of Agriculture, in coordination with the Secretary of Health and Human Services, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 2)

The Secretary of Defense should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 3)

The Secretary of Energy should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 4)

The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 5)

The Administrator of the General Services Administration, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s), such as the Coordinating Council and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 6)

The Secretary of Health and Human Services, in coordination with the Secretary of Agriculture, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 7)

The Secretary of Homeland Security should take steps to consult with respective sector partner(s), such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sectors using existing initiatives. (Recommendation 8)

The Secretary of Transportation, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s) such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 9)

The Secretary of the Treasury should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 10)

Agency Comments and Our Evaluation

We received comments on a draft of this report from the ten agencies to which we made recommendations—the Departments of Agriculture, Commerce, Defense, Energy, Health and Human Services, Homeland Security, Transportation, and the Treasury; and the Environmental Protection Agency and the General Services Administration. Among these agencies, eight agreed with the recommendations, one neither agreed nor disagreed with the recommendation, and one partially agreed with the recommendation.

In written comments, the Department of Agriculture generally concurred with the recommendation in our report. The department’s comments are reprinted in appendix II.

In written comments, the Department of Commerce concurred with the recommendation in our report. The department stated that the National Institute of Standards and Technology expects to document its cybersecurity measurement program scope, objectives, and approach by about June 2020 and publish two cybersecurity starter profiles by about September 2020. The department’s comments are reprinted in appendix III.

In written comments, the Department of Defense concurred with the recommendation in our report and described ongoing steps to evaluate defense organizations’ cybersecurity maturity levels. The department’s comments are reprinted in appendix IV.

In written comments, the Department of Energy partially concurred with the recommendation in our report. The department stated that it will coordinate with the energy sector to develop an understanding of sector- wide improvements from use of the framework.

The department, however, stated that implementing our recommendation as written prescribes the SCC as a forum for coordination regarding the framework. Our recommendation is not intended to be prescriptive, but rather, to provide suggestions for consideration. Thus, we have revised the wording of the recommendation to emphasize coordination with other entities, as appropriate.

The department also stated that the recommendation implies that improvements from the use of the framework could accurately be attributed to a single initiative, which may be misleading. We do not agree. Our report identifies the challenge of determining the direct impact from framework use and notes that NIST’s website provides the sector organizations with access to various framework resources, to include sector-specific implementation guidance and case studies, as well as insights from organizations using the framework. Hence, organizations can report on improvements from use of the framework using multiple initiatives.

Further, the department stated that suggesting government collection and reporting of information regarding adoption or improvements erodes the voluntary character of the framework. We do not agree with this statement. Our report recognizes the voluntary character of the framework but also notes that, without collecting and reporting such information, critical infrastructure sectors may not fully understand the benefits and value of the framework to better protect their critical infrastructures from cyber threats. The department’s comments are reprinted in appendix V.

In written comments, the Department of Health and Human Services concurred with the recommendation in our report and stated that it would work with the appropriate entities to refine and communicate best practices to the sector. The department’s comments are reprinted in appendix VI.

In written comments, the Department of Homeland Security concurred with the recommendation in our report. The department stated that, once it receives the results of the survey on framework adoption that it sent to small- and mid-sized IT sector partners, it will determine the feasibility of issuing similar surveys to other sectors. The department’s comments are reprinted in appendix VII.

In written comments, the Department of the Treasury neither agreed nor disagreed with the recommendation in our report. The department stated that it will assess using the identified initiatives and their viability for collecting and reporting sector-wide improvements from use of the framework with input from the SCC and financial regulators. The department added, however, that it does not have the authority to compel financial institutions to respond to inquiries regarding the sector’s use of the framework or resulting improvements. We acknowledge the lack of authority but believe that implementing the recommendation to gain a more comprehensive understanding of the framework’s use by the critical infrastructure sector is essential to the success of protection efforts. The department’s comments are reprinted in appendix VIII.

In written comments, the Environmental Protection Agency concurred with the recommendation in our report. The agency stated that it will coordinate with its SCC to investigate options to collect and report sector- wide improvements from use of the cybersecurity framework that are consistent with statutory requirements and the sector's willingness to participate. The agency’s comments are reprinted in appendix IX.

In written comments, the General Services Administration concurred with the recommendation in our report and stated that it is working with the Department of Homeland Security to develop a plan to address the recommendation. The agency’s comments are reprinted in appendix X.

In comments sent via e-mail, the Department of Transportation’s Director of Audit Relations and Program Improvement stated that the department concurred with the recommendation in our report.

In addition to the aforementioned comments, we received technical comments from officials of the Departments of Agriculture, Energy, Health and Human Services, Homeland Security, Transportation, and Treasury. We also received technical comments on the report from the Environmental Protection Agency and General Services Administration. We incorporated the technical comments in the report, where appropriate.

We are sending copies of this report to the appropriate congressional committees; the Secretaries of Agriculture, Commerce, Defense, Energy, Health and Human Services, Homeland Security, Transportation, and Treasury; the Administrators of the Environmental Protection Agency and General Services Administration; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-6240 or at dsouzav@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix XI.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) agencies with lead roles in critical infrastructure protection efforts, referred to as sector- specific agencies (SSAs), have determined the level and type of National Institute of Standards and Technology Cybersecurity Framework (framework) adoption and (2) implementation of the framework has led to improvements to the protection of critical infrastructure from cyber threats.

To address the first objective, we analyzed documentation and evidence, such as implementation guidance and survey instruments that discussed actions federal and nonfederal entities have taken since our report in 2018 to develop methods to determine the level and type of adoption across their sectors, as we previously recommended. These entities included nine SSAs,13 out of the 16 Sector Coordinating Councils (SCC) representing all 16 critical infrastructure sectors established in federal policy, the National Institute of Standards and Technology (NIST), and Information Sharing and Analysis Centers (ISAC). We also analyzed documentation from the SSAs and SCCs, such as the Department of Energy’s Cybersecurity Capability Maturity Model and the Department of the Treasury’s Financial Services Sector Cybersecurity Profile. We compared these to best practices, such as the National Infrastructure Protection Plan and the Standards for Internal Control in the Federal Government to determine efforts to facilitate framework adoption across the sectors. We supplemented our review by interviewing officials from these entities to determine any actions taken to determine framework adoption.

In addition, we selected six critical infrastructure sectors identified in the 2018 National Cyber Strategy of the United States of America as having critical infrastructure with the greatest risk of being compromised. The six sectors were (1) communications, (2) financial services, (3) energy, (4) healthcare and public health, (5) information technology, and (6) transportation systems. We asked SCCs, trade associations (e.g., the American Petroleum Institute), and ISACs to provide a list of organizations that were users of the framework. We divided up the list of identified organizations by sector, and we randomly selected one large and one small or medium organization from each sector, resulting in a final list of 12 organizations. We then conducted semi-structured interviews with officials from the selected organizations to understand the extent to which these organizations were using the framework.

To address the second objective, we collected and reviewed documentation from NIST and the federal and nonfederal entities, such as NIST’s framework and its April 2019 Roadmap for Improving Critical Infrastructure Cybersecurity, the Department of Homeland Security’s Information Technology Sector Small and Midsize Business Cybersecurity Survey and 2018 Cybersecurity Resources Road Map, and other SSA efforts to determine ongoing efforts to enable the identification and measurement of improvements as a result of using the framework. We compared these efforts to the 2014 Cybersecurity Act and best practices, such as NIST Special Publication 800-55 on performance- based measures to determine the measures the SSAs and SCCs had taken to determine improvements from using the framework.

In addition, we interviewed officials from the selected organizations to understand the extent to which they realized improvements as a result of framework adoption and the support the organizations received from federal and nonfederal entities. We also interviewed officials from other federal and nonfederal entities, to include NIST, nine SSAs, 13 of the 16 SCCs, and six ISACs on efforts to measure improvements from use of the framework, and any related challenges.

We conducted this performance audit from January 2019 to February 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Agriculture

Appendix III: Comments from the Department of Commerce

Appendix IV: Comments from the Department of Defense

Appendix V: Comments from the Department of Energy

Appendix VI: Comments from the Department of Health and Human Services

Appendix VII: Comments from the Department of Homeland Security

Appendix VIII: Comments from the Department of the Treasury

Appendix IX: Comments from the Environmental Protection Agency

Appendix X: Comments from the General Services Administration

Appendix XI: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Neelaxi Lakhmani (assistant director), Kendrick M. Johnson (analyst in charge), Christopher Businsky, Nancy Glover, Douglas Harris, Ceara Lance, Edward Malone, Gabriel Nelson, Harold Podell, and Dana Pon made key contributions to this report.