Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress
Released: 2015-11-19T00:00:00

Letter

Background

U. S. critical infrastructure is made of systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on the nation’s security, national economic security, national public health or safety, or any combination of these matters. Critical infrastructure includes, among other things, banking and financing institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned and operated by the private sector. Sector-specific agencies (SSA) are federal departments or agencies with responsibility for providing institutional knowledge and specialized expertise as well as leading, facilitating, or supporting the security and resilience programs and associated activities of its designated critical infrastructure sector in the all-hazards environment.

The Nation Faces an Evolving Array of Cyber- Based Threats

Threats to systems supporting critical infrastructure are evolving and growing. Cyber threats can be unintentional or intentional. Unintentional or non-adversarial threats include equipment failures, software coding errors, and the actions of poorly trained employees. They also include natural disasters and failures of critical infrastructure on which the organization depends but are outside of its control. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. These threat adversaries vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage. Table 1 describes the sources of cyber-based threats in more detail.

Cyber threat adversaries make use of various techniques, tactics, and practices, or exploits, to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. These exploits are carried out through various conduits, including websites, e-mail, wireless and cellular communications, Internet protocols, portable media, and social media. Further, adversaries can leverage common computer software programs, such as Adobe Acrobat and Microsoft Office, to deliver a threat by embedding exploits within software files that can be activated when a user opens a file within its corresponding program. Table 2 provides descriptions of common exploits or techniques, tactics, and practices used by cyber adversaries.

Reports of cyber exploits illustrate the debilitating effects such attacks can have on the nation’s security, economy, and on public health and safety.

In May 2015, media sources reported that data belonging to 1.1 million health insurance customers in the Washington, D.C., area were stolen in a cyber attack on a private insurance company. Attackers accessed a database containing names, birth dates, e-mail addresses, and subscriber ID numbers of customers. In December 2014, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) issued an updated alert on a sophisticated malware campaign compromising numerous industrial control system environments. Their analysis indicated that this campaign had been ongoing since at least 2011. In the January 2014 to April 2014 release of its Monitor Report, ICS- CERT reported that a public utility had been compromised when a sophisticated threat actor gained unauthorized access to its control system network through a vulnerable remote access capability configured on the system. The incident highlighted the need to evaluate security controls employed at the perimeter and ensure that potential intrusion vectors are configured with appropriate security controls, monitoring, and detection capabilities.

Federal Guidance Establishes Specific Roles and Responsibilities for Protecting the Nation’s Critical Infrastructure

Federal policy and public-private plans establish roles and responsibilities for federal agencies working with the private sector and other entities to enhance the cyber and physical security of public and private critical infrastructures. These include PPD-21 and the NIPP.

PPD-21 shifted the nation’s focus from protecting critical infrastructure against terrorism toward protecting and securing critical infrastructure and increasing its resilience against all hazards, including natural disasters, terrorism, and cyber incidents. The directive identified 16 critical infrastructure sectors and designated associated federal SSAs. Table 3 shows the 16 critical infrastructure sectors and the SSA for each sector.

PPD-21 identified SSA roles and responsibilities to include collaborating with critical infrastructure owners and operators; independent regulatory agencies, where appropriate; and with state, local, tribal, and territorial entities as appropriate; serving as a day-to-day federal interface for the prioritization and coordination of sector-specific activities; carrying out incident management responsibilities consistent with statutory authority and other appropriate policies, directives, or regulations; and providing, supporting, or facilitating technical assistance and consultations for their respective sector to identify vulnerabilities and help mitigate incidents, as appropriate.

The NIPP is to provide the overarching approach for integrating the nation’s critical infrastructure protection and resilience activities into a single national effort. DHS developed the NIPP in collaboration with public and private sector owners and operators and federal and nonfederal government representatives, including sector-specific agencies, from the critical infrastructure community. It details DHS’s roles and responsibilities in protecting the nation’s critical infrastructures and how sector stakeholders should use risk management principles to prioritize protection activities within and across sectors. It emphasizes the importance of collaboration, partnering, and voluntary information sharing among DHS and industry owners and operators, and state, local, and tribal governments. The NIPP also stresses a partnership approach among the federal and state governments and industry stakeholders for developing, implementing, and maintaining a coordinated national effort to manage the risks to critical infrastructure and work toward enhancing physical and cyber resilience and security.

According to the NIPP, SSAs are to work with their private sector counterparts to understand cyber risk and develop sector-specific plans that address the security of the sector’s cyber and other assets and functions. The SSAs and their private sector partners are to update their sector-specific plans based on DHS guidance to the sectors. The currently available sector-specific plans were released in 2010 to support the 2009 version of the NIPP. In response to the most recent NIPP, released in December 2013, DHS issued guidance in August 2014 directing the SSAs, in coordination with their sector stakeholders, to update their sector-specific plans. The SSAs are also to review and modify existing and future sector efforts to ensure that cyber concerns are fully integrated into sector security activities.

In addition, the NIPP sets up a framework for sharing information across and between federal and nonfederal stakeholders within each sector that includes the establishment of sector coordinating councils and government coordinating councils. Sector coordinating councils are to serve as a voice for the sector and a principal entry point for the government to collaborate with the sector for critical infrastructure security and resilience activities. The government coordinating councils enable interagency, intergovernmental, and cross-jurisdictional coordination within and across sectors. Each government coordinating council is chaired by a representative from the designated SSA with responsibility for providing cross-sector coordination.

The NIPP also recommended several activities—referred to as Call to Action steps— to guide the efforts of the SSAs and their sector partners to advance security and resilience under three broad activity categories: building on partnership efforts; innovating in risk management; and focusing on outcomes. Table 4 shows the 10 Call to Action Steps determined to have a cybersecurity-related nexus.

The NIPP states that all of the identified steps, including these 10 actions with a greater relationship to enhancing cybersecurity, are not intended to be exhaustive or implemented in every sector. Rather, they are to provide strategic direction, allow for differing priorities in each sector, and enable continuous improvement of security and resilience efforts.

In addition, Executive Order 13636 was issued to, among other things, address the need to improve cybersecurity through information sharing and collaboratively developing and implementing risk-based standards. It called for the SSAs to, among other things, establish, in coordination with DHS, a voluntary program to support the adoption of the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) by owners and operators of critical infrastructure and any other interested entities; create incentives to encourage owners and operators of critical infrastructure to participate in the voluntary program; and, if necessary, develop implementation guidance or supplemental materials to address sector-specific risks and operating environments.

Sector-Specific Agencies Determined That Cyber Risks Were Significant for Most Sectors

Sector-specific agencies determined the significance of cyber risk to the networks and industrial control systems for all 15 of the sectors in the scope of our review. Specifically, they determined that cyber risk was significant for 11 of 15 sectors. For the remaining 4 sectors, the SSAs had determined that cyber risks were not significant due to the lack of cyber dependence in the sector’s operations, among other reasons. These determinations were carried out in response to the 2009 NIPP, which directed the SSAs to consider how cyber would be prioritized among their sectors’ critical infrastructure and key resources as part of the sector- specific planning process. The SSAs and their sector stakeholders were to include an overview of current and emerging sector risks including those affecting cyber when preparing their 2010 plans. Table 5 shows the significance of cyber risk to each sector, as determined by the SSAs, as well as when these determinations were made.

Since most of these determinations were made for the 2010 sector- specific planning process, they may not reflect the current risk environment of the sectors. In particular, SSAs for the 4 sectors that had not determined cyber risks to be significant during their 2010 sector- specific planning process subsequently reconsidered the significance of cyber risks to their sectors. Also, in response to the 2013 NIPP, DHS issued guidance for developing updated sector-specific plans for 2015. According to this guidance and SSA officials, SSAs are to document how they have reconsidered the significance of cyber risks to their sectors. DHS officials stated that the SSAs have drafted their updated sector- specific plans and submitted them to DHS for review; however, the plans have not yet been finalized and released.

Based on the 2010 sector-specific plans and subsequent documents and activities, the SSAs’ determinations of the significance of cyber risk to their 15 respective sectors are summarized below.

Chemical Sector

DHS, in collaboration with chemical sector stakeholders, determined that cyber risk was a significant priority for the sector. In 2009, DHS and the chemical sector coordinating council issued the Roadmap to Secure Controls Systems in the Chemical Sector, which documented the cybersecurity concerns for chemical facilities’ industrial control systems and the need to develop cyber risk mitigation actions to be addressed over a 10-year period. In addition, the 2010 Chemical Sector-Specific Plan highlighted the importance of cyber systems to the sector and promoted the need for owners and operators of sector assets to apply risk assessment and management methodologies to identify cyber threats to their individual operations.

Commercial Facilities Sector

DHS did not consider cyber risks to be significant for the commercial facilities sector. The commercial facilities sector’s 2010 sector-specific plan does not identify cyber risks as significant to the sector. DHS officials stated that the decision was based on the sector’s diversity of components and the manner in which cyber-related technology is employed. According to these officials, a cyber event affecting one facility’s cyber systems (e.g., access control or environmental systems) would not be likely to affect the cyber assets of other facilities within the sector.

However, in July 2015, DHS officials stated that, as part of the updated sector planning process, they had recognized cyber risk as a high-priority concern for the sector. In particular, they noted that the sector uses Internet-connected systems for processes like ticketing and reservations, so a large-scale communications failure or cyber attack could disrupt the sector’s operations.

Communications Sector

DHS, in collaboration with communications sector stakeholders, completed a risk assessment in 2012 for the communications sector that identified cyber risk as a significant priority; however, the assessment noted that due to the sector’s diversity and level of resiliency, most of the threats would only result in local or regional communications disruptions or outages. The assessment evaluated cyber threats such as malicious and non-malicious actors committing alterations or intrusions that could pose local, regional, or national level risks to broadcasting, cable, satellite, wireless, and wireline communications networks. The risk assessment also concluded that malicious actors could use the communications sector to attack other sectors.

Critical Manufacturing Sector

DHS did not consider cyber risk to be significant for the critical manufacturing sector. The sector’s 2010 sector-specific plan stated that many critical manufacturing owners and operators from this diverse and dispersed sector had completed asset, system, or network-specific assessments on their own initiative. Also, the plan identified cyber elements that support the sector’s functional areas, including electronic systems for processing the information necessary for management and operation or for automatic control of physical processes in manufacturing. This applied primarily to the production of metals, machinery, electrical equipment, and heavy equipment. However, the critical manufacturing sector relies upon other sectors such as communications and information technology where addressing cyber risk is a priority.

DHS officials stated that, since 2010, they have identified sector critical cyber functions and services, and the sector’s draft 2015 sector-specific plan notes this as a step toward conducting a sector-wide cyber risk assessment.

Dams Sector

DHS officials considered cyber risks for the dams sector and acknowledged that cyber threats could have negative consequences; however, they determined cyber risks to not be significant for the sector. Specifically, the sector’s 2010 sector-specific plan concluded that the sector’s cyber environment and its legacy industrial control systems were designed to operate in a fairly isolated environment using proprietary software, hardware, and communications technology and, as a result, were designed with cybersecurity as a low priority. However, the officials stated that vulnerabilities in industrial control systems pose cyber-related risks to the sector’s operations. In the sector-specific plan, they acknowledged that the evolution of industrial control systems to incorporate network-based and Internet Protocol-addressable features and more commercially available technologies could introduce many of the same vulnerabilities that exist in current networked information systems.

DHS officials also stated that they are addressing cybersecurity for the sector with their update to the sector-specific plan and the sector’s roadmap for securing control systems, as well as with the development of a capability maturity model specifically for the dams sector. At the time of our review, the updated sector-specific plan was still in draft.

Defense Industrial Base Sector

The Department of Defense (DOD) determined that cyber threats to contractors’ unclassified information systems represented an unacceptable risk of compromise to DOD information and posed a significant risk to U.S. national security and economic security interests. In the sector’s 2010 sector-specific plan, DOD, in collaboration with its sector partners, listed cybersecurity and managing risk to information among its five goals for the sector’s protection and resilience. In addition, DOD has issued annual “for official use only” reports on its progress defending DOD and the defense industrial base against cyber events for fiscal years 2010 through 2014. The reports identify definitions and categories of cyber events, exploited vulnerabilities, and adversary intrusion methods based on data from several key DOD organizations with cybersecurity responsibilities and other intelligence sources. The reports are to provide an annual update of cyber threats, threat sources, and vulnerability trends affecting the defense industrial base.

Emergency Services Sector

DHS officials, in collaboration with sector stakeholders, concluded that cyber threats could have a significant impact on the emergency services sector’s operations. The risk assessment process brought together subject matter experts to perform an assessment of cyber risks across six emergency services sector disciplines: law enforcement, fire and emergency services, emergency medical services, emergency management, public works, and public safety communications and coordination/fusion. They developed cyber risk scenarios across multiple sector disciplines and applied DHS’s Cybersecurity Assessment and Risk Management Approach methodology to reach their conclusion. The results were reported in 2012 in the Emergency Services Sector Cyber Risk Assessment.

In a previous GAO review of cybersecurity in the emergency services sector, we reported that sector planning activities, including the cyber risk assessment, did not address the more interconnected, Internet-based emerging technologies becoming more prevalent in the emergency services sector. As a result, the sector could be vulnerable to cyber risks in the future without more comprehensive planning. We recommended that the Secretary of Homeland Security collaborate with emergency services sector stakeholders to address the cybersecurity implications of implementing technology initiatives in related plans. DHS agreed with our recommendation and stated that the updated sector-specific plan will include consideration of the sector’s emerging technology. At the time of our review, the updated sector-specific plan was still in draft.

Energy Sector

The Department of Energy (DOE) identified cyber risks as significant and a priority for the energy sector. Specifically, in the sector’s 2010 sector- specific plan, DOE, in collaboration with its sector stakeholders, included cybersecurity among the sector’s goals to enhance preparedness, security, and resilience. DOE officials stressed that their risk management approach focuses on resilience, especially in the context of ensuring the resilience of the electric grid. In addition, the 2011 Roadmap to Achieve Energy Delivery System Cybersecurity, developed by energy sector stakeholders, including responsible DOE officials, recognized the continually evolving cyber threats and vulnerabilities and provided a framework for energy sector stakeholders to survive a cyber incident while sustaining critical functions.

Financial Services Sector

Treasury, in collaboration with sector stakeholders, identified cyber risk as significant to the financial services sector. Specifically, the 2010 financial services sector-specific plan stated that all of the sector’s services rely on its cyber infrastructure, which necessitates that cybersecurity be factored into all of the sector’s critical infrastructure protection activities. In addition, as a highly regulated sector, the financial services sector has been required to undergo risk assessments by financial regulators to satisfy regulatory requirements.

In July 2015, Treasury officials stated that they leveraged the collective body of risk assessment data to determine the sector’s overall risk profile, which will be included in the 2015 sector-specific plan. At the time of our review, the updated sector-specific plan was still in draft.

Food and Agriculture Sector

The U.S. Department of Agriculture (USDA) and the Department of Health and Human Services’ Food and Drug Administration (FDA), in collaboration with their sector stakeholders, determined that the significance of cyber risk was low for the food and agriculture sector when the SSP was developed in 2010. As stated in the plan, the sector did not perceive itself as a target of cyber attack and concluded that, based on the nature of its operations, a cyber attack would pose the risk of only minimal economic disruption. However, the plan acknowledged the rapidly evolving cyber environment and the need to revisit the issue in the future.

In July 2015, USDA officials stated that they had reconsidered the significance of cyber risk and the role of cybersecurity in the sector and that it would be reflected in the yet-to-be-released 2015 sector-specific plan. In addition, according to USDA officials, they had completed a sector risk assessment effort with assistance from DHS.

Health Care and Public Health Sector

The Department of Health and Human Services (HHS), in collaboration with its sector partners, identified cyber risk as significant to the health care and public health sector. Specifically, the 2010 sector-specific plan identified cybersecurity and mitigating risks to the sector’s cyber assets as one of four service continuity goals for the sector. The plan’s cybersecurity risk assessment section identified and categorized common cyber threats, vulnerabilities, consequences, and mitigation strategies for the sector. Also, HHS and its partners added cyber infrastructure protection as a research and development priority in the sector-specific plan. In addition, health care entities, such as health plans and providers that maintain health data, must assess risks to cyber-based systems based on Health Insurance Portability and Accountability Act of 1996 security requirements.

Information Technology Sector

DHS, in collaboration with information technology sector stakeholders, identified cyber risk as a sector priority. DHS and its sector partners determined that the consequences of cyber incidents or events would be of great concern and would affect the sector’s ability to produce or provide critical products and services. DHS worked with public and private information technology stakeholders to complete the Information Technology Sector Baseline Risk Assessment in 2009. The risk assessment focused on risks to the processes involved in the creation of IT products and services and critical IT functions including research and development, manufacturing, distribution, upgrades, and maintenance— and not on specific organizations or assets.

Nuclear Sector

DHS and its nuclear sector stakeholders prioritized cyber risk as a significant risk for the nuclear sector. According to the 2011 Roadmap to Enhance Cyber Systems Security in the Nuclear Sector, they determined that the cyber systems supporting the nuclear sector are at risk due to the increasing volume, complexity, speed, and connectedness of the nuclear sector’s systems. Therefore, DHS and its sector partners included protecting against the exploitation of the sector’s cyber assets, systems, and networks among its sector goals and objectives for a comprehensive protective posture.

Transportation Systems Sector

Addressing cyber risk is a significant priority for the transportation systems sector. In the 2010 transportation systems sector-specific plan, DHS’s Transportation Security Administration (TSA) and U.S. Coast Guard acknowledged the importance of cyber assets to the sector’s operations across the various transportation modes and included an overview of the risk management framework, an all-hazards approach to be applied to the physical, human, and cyber components of the infrastructure. They also established goals and objectives to shape their sector partners’ approach for managing sector risk. As part of their objective to enhance the all-hazard preparedness and resilience of the transportation systems sector, they included the need to identify critical cyber assets, systems, and networks and implement measures to address strategic cybersecurity priorities.

For fiscal year 2014, TSA assessed risks to the transportation systems sector and reported the outcome to Congress. Although the assessment did not specifically quantify cyber risks for the sector, it considered cyber threats to transportation modes in hypothetical scenarios, such as the effect of a cyber attack disabling a public transit system. In addition, TSA’s Office of Intelligence and Analysis provides transportation mode- specific annual threat assessments that include malicious cyber activity as part of the analysis. For example, the pipeline modal threat assessment considered computer network attacks that could disrupt pipeline functions and computer network exploitations that could allow unauthorized network access and theft of information. In addition, we have previously reported that the Coast Guard needs to address cybersecurity in the maritime port environment by, among other things, including cyber risks in its biennial maritime risk assessment. Subsequently, the Coast Guard released its updated risk assessment for maritime operations, which identified the need to address cyber risk but did not identify vulnerabilities in relevant cyber assets.

Water and Wastewater Systems (Water) Sector

The Environmental Protection Agency (EPA), in collaboration with sector partners, determined that a cyber attack is a significant risk to the water sector. Cyber attacks on the industrial control systems are among the plausible hazards that threaten the water and wastewater systems sector, according to the risk assessment portion of the 2010 sector-specific plan. EPA concluded that attacks on the systems used to monitor and control water movement and treatment could disrupt operations at water and wastewater facilities, although the capability to employ manual overrides for critical systems could reduce the consequences of an attack. EPA recommended that water sector facilities regularly update or conduct an all-hazards risk assessment that includes cyber attacks as a priority threat. Further, the Roadmap to a Secure and Resilient Water Sector, developed in 2013 by EPA, DHS, and water sector partners, included advancing the development of sector-specific cybersecurity resources as a top priority for the sector.

Sector-Specific Agencies Generally Performed Cyber Risk Mitigation Activities

Sector-specific agencies generally took actions to mitigate cyber risks and vulnerabilities for their respective sectors that address the Call to Action steps in the National Infrastructure Protection Plan. While the steps are not required of the SSAs, they are intended to guide national progress while allowing for differing priorities in different sectors. The SSAs had taken action to address most of the nine NIPP Call to Action steps. While SSAs for 12 of the 15 sectors had not identified incentives to promote cybersecurity in their sectors, as called for by one of the Call to Action steps, all the SSAs have participated in a working group to identify appropriate incentives to encourage cybersecurity improvements across their respective sectors. In addition, SSAs for 3 of 15 sectors had not yet made significant progress in advancing cyber-based research and development within their sectors because it had not been an area of focus for their sector. DHS guidance for updating the sector-specific plans directs the SSAs to incorporate the NIPP’s actions to guide their cyber risk mitigation activities including cybersecurity-related actions to identify incentives and promote research and development.

Figure 1 depicts NIPP Call to Action steps addressed by SSAs. (App. II provides further details on actions taken to address the Call to Action steps for each sector.)

Chemical Sector

DHS implemented activities to mitigate the cyber risks for the chemical sector for eight of nine of the NIPP’s Call to Action steps; however, it had not established incentives to encourage its sector partners to voluntarily invest in cybersecurity-enhancing measures. DHS has developed technical resources, cybersecurity awareness tools, and information- sharing mechanisms among its activities to enhance the sector’s cybersecurity. DHS officials described other cybersecurity activities in development including updates to sector cybersecurity guidance that could include incentives; however, they were unable to identify specific incentives to encourage cybersecurity across the sector.

Commercial Facilities Sector

DHS conducted cyber mitigation activities that aligned with eight of the nine NIPP Call to Action steps for the commercial facilities sector. DHS provided technical assistance and supported information-sharing efforts for the sector. For example, it developed a risk self-assessment tool in conjunction with sector partners to raise awareness of the importance of their cyber systems. DHS also promoted a number of information-sharing mechanisms available through its Office of Cybersecurity and Communications, including the dissemination of alerts through the U.S. Computer Emergency Readiness Team (US-CERT), ICS-CERT, and the Commercial Facilities Cyber Working Group, among others. However, DHS did not identify efforts to establish incentives to encourage commercial facilities sector partners to implement cybersecurity- enhancing measures.

Communications Sector

DHS worked to reduce risk to the communications sector through collaborative cyber risk mitigation activities that align with eight of nine NIPP Call to Action steps. However, DHS did not establish incentives to promote cybersecurity for the sector. As previously stated, DHS and its communications sector partners completed the 2012 National Sector Risk Assessment for Communications, which examined risks from cyber incidents or events that threaten the sector’s cyber assets, systems, and networks. According to DHS officials, it coordinated mitigation activities with its communications sector partners and addressed risks identified through the assessment process. In addition, officials explained that it implemented or facilitated sector-wide information-sharing mechanisms with such entities as the National Cybersecurity and Communications Integration Center, National Infrastructure Coordinating Center, and National Coordinating Center for Telecommunications and Communications Information Sharing and Analysis Center.

Although DHS had not implemented specific cyber-related incentives for the communications sector, DHS officials stated that National Security staff and the Office of Policy have been working on possible national incentives such as tax credits for future use.

Critical Manufacturing Sector

DHS focused cyber risk mitigation activities in seven of nine NIPP Call to Action steps for the critical manufacturing sector. However, cyber risk mitigation activities did not include efforts to incentivize cybersecurity or support cybersecurity-related research and development. Among its cyber risk mitigation activities, DHS participated in information sharing efforts through the sector coordinating council to enhance situational awareness; and led outreach efforts to encourage diverse (i.e., small, medium, and large companies) participation in the council as an activity to build national capacity.

Although specific incentives to encourage cybersecurity across the sector had not been put in place, DHS officials stated that they had been involved in a working group to study possible options such as cyber insurance. While the critical manufacturing sector-specific plan and associated annual report of sector activities indicated that goals and needs regarding sector research and development are areas for future development, DHS did not provide any examples of specific research and development activities addressing the sector’s cybersecurity.

Dams Sector

DHS developed cyber risk mitigation activities for the dams sector focused on eight of nine NIPP Call to Action steps. However, DHS did not identify activities leveraging incentives to advance security and resilience. DHS officials stated that their efforts had not focused on incentives. Among its cyber risk mitigation activities, DHS officials facilitated the development of the Dams Sector Roadmap to Secure Control Systems, developed in 2010, which focuses on the cybersecurity of industrial control systems where cyber risks maybe more significant for individual entities. DHS also supported information-sharing mechanisms by promoting sector-wide information sharing and organized a cybersecurity working group to discuss cyber-relevant topics during quarterly meetings. Further, the department disseminated cyber vulnerability information to sector partners through advisories and alerts from DHS’s ICS-CERT and US-CERT.

Defense Industrial Base Sector

DOD devised cyber risk mitigation activities that align with eight of nine NIPP Call to Action steps but had not established incentives to promote cybersecurity. Cyber risk mitigation activities included sharing threat information and mitigation strategies for enhanced situational awareness and participating in DOD-centric exercises, among others.

Although DOD did not identify specific incentives to encourage cybersecurity in the defense industrial base sector, DOD officials stated that they joined an interagency effort to explore various incentives that might be offered to industry to encourage use of the NIST Cybersecurity Framework.

In addition, DOD officials noted that they have worked with the General Services Administration to develop strategic guidelines to incorporate cybersecurity standards in requirements for DOD contractors; however, this effort would not be part of DOD’s voluntary sector cybersecurity program.

Emergency Services Sector

DHS established or facilitated cyber risk mitigation activities for eight of nine NIPP Call to Action steps; however, it had not instituted cybersecurity incentives. DHS officials stated that grants to state and local governments as incentives to encourage cybersecurity were not available, and no other types of incentives were identified. Among its activities, the department collaborated with emergency services sector partners in March 2014 to develop the Emergency Services Sector Roadmap to Secure Voice and Data Systems, which identified and discussed proposed risk mitigation activities and included justification for the response, sector context, barriers to implementation, and suggestions for implementation. DHS officials also noted various information-sharing mechanisms that disseminate cyber threat and vulnerability information to sector partners and allow reporting back to DHS.

Energy Sector

DOE instituted or supported cyber risk mitigation activities that correspond to all nine of the NIPP Call to Action steps. For example, DOE provided grants to share the costs of sector partners’ cybersecurity innovation efforts as an incentive for advancing cybersecurity and to support research and development of solutions to improve critical infrastructure security and resilience. Other activities to encourage cybersecurity in the sector included the development of cybersecurity guidance to promote the use of NIST’s Cybersecurity Framework and establishing or supporting cyber threat information sharing mechanisms. DOE also developed and implemented the Cybersecurity Risk Information Sharing Program, a public-private partnership to facilitate the timely sharing of cyber threat information and develop situational awareness tools to enhance electric utility companies’ ability to identify, prioritize, and coordinate the protection of their critical infrastructure.

Financial Services Sector

The Department of the Treasury implemented or facilitated activities that served to mitigate cyber risk for the financial services sector. These activities correspond to eight of the nine NIPP Call to Action steps. However, Treasury had not developed incentives to encourage cybersecurity in the sector through its voluntary critical infrastructure protection program. Treasury officials noted that they foresee developing incentives as a result of a report to the President pursuant to an Executive Order 13636 requirement that outlined an approach for policymakers to evaluate the benefits and relative effectiveness of government incentives in promoting adoption of NIST’s Cybersecurity Framework. Using the results of the updated sector planning process to inform its efforts could assist Treasury in developing any such incentives, as appropriate.

We have previously reported on additional efforts to address cyber risk in this sector. In July 2015, we reported on cyber attacks against depository institutions, banking regulators’ oversight of cyber risk mitigation activities, and the process for sharing cyber threat information. Specifically, we found that smaller depository institutions were greater targets for cyber attacks. Also, we noted that although financial regulators devoted considerable resources to overseeing information security at larger institutions, their limited IT staff resources generally meant that examiners with little or no IT expertise were performing IT examinations at smaller institutions. As a result, we recommended that these regulators collect and analyze additional trend information that could further increase their ability to identify patterns in problems across institutions and better target their reviews. Finally, with cyber threat information coming from multiple sources, including from Treasury and other federal entities, recipients contacted in the review found federal information repetitive, not always timely, and not always readily usable. To help address these needs, Treasury had various efforts under way to obtain such information and confidentially share it with other institutions, including participating in groups that monitor and provide threat information on cyber incidents.

Food and Agriculture Sector

USDA and FDA, as co-SSAs for the food and agriculture sector, had cyber risk mitigation activities addressing six of the nine NIPP Call to Action steps. For example, the SSAs had encouraged sector-wide participation in DHS’s program to promote NIST’s Cybersecurity Framework, participated in the process to identify any cyber-dependent critical functions and services, and supported threat briefings to enhance situational awareness across the sector. According to food and agriculture SSA officials, they had other activities in progress including facilitated sessions with their sector stakeholders as part of assessing risks to the sector and considering the development of food and agriculture sector-specific NIST Cybersecurity Framework implementation guidance to make the framework more relatable to food and agriculture stakeholders.

However, other areas, including incentives to promote cybersecurity, research and development of security and resilience solutions, and lessons learned from exercises and incidents, have yet to be developed. As stated earlier, during the 2010 sector-specific planning process, cybersecurity risk was not considered significant for the sector, but USDA and FDA officials stated that they had incorporated cyber risk into their updated sector-specific plan and they continue to develop cybersecurity- related activities for the sector.

Health Care and Public Health Sector

HHS developed or supported activities addressing eight of the nine NIPP Call to Action steps. For example, HHS leveraged the private sector clearance program and access to classified information as incentives for sector stakeholders to participate in cybersecurity-enhancing activities. However, HHS had not performed any activities related to cybersecurity research and development. HHS officials stated that promoting research and development efforts to enhance the sector’s cybersecurity was not a focus of their cyber risk mitigation activities during fiscal years 2014 and 2015.

Information Technology Sector

DHS, in collaboration with its information technology sector partners, implemented risk mitigation activities to enhance the sector’s cybersecurity environment. We identified activities that addressed eight of nine NIPP Call to Action steps. DHS’s IT sector cyber risk mitigation activities included the promotion of incident response and recovery capabilities, support for various cyber-related information sharing mechanisms, and capabilities for technical assistance to sector entities. However, DHS had not specifically identified and analyzed incentives to improve cybersecurity within the IT sector. DHS officials stated that they have collaborated with other federal agencies to develop options for cybersecurity enhancement incentives for the sector.

Nuclear Reactors, Materials, and Waste (Nuclear) Sector

DHS carried out risk mitigation activities that addressed eight of the nine NIPP Call to Action steps. These activities included collaborative efforts through established working groups and councils to share information about cybersecurity-related alerts, advisories, and strategies. DHS officials responsible for nuclear SSA efforts referred to the Roadmap to Enhance Cyber Systems Security in the Nuclear Sector as guidance they developed in June 2011 and disseminated to sector partners for determining cyber risk and a vision for mitigating it over a 15-year period. However, DHS’s cyber risk mitigation activities did not include incentives for nuclear sector partners to enhance cybersecurity.

Transportation Systems Sector

The Department of Transportation and DHS’s TSA and U.S. Coast Guard put in place cyber risk mitigation activities in line with all nine NIPP Call to Action steps. For example, TSA shared cyber threat intelligence and information from the National Cybersecurity and Communications Integration Center to multiple transportation modes through its threat dissemination channels. In addition, classified information had been “tearlined” or downgraded based on a request from TSA so that information could be shared without sharing sensitive and restricted information to sector officials without security clearances. Further, the U.S. Coast Guard used its Port Security Grant Program as an incentive for cybersecurity efforts through its Port Security Grants Program for the maritime subsector. This DHS grants program provides funding for maritime transportation security measures including cybersecurity. However, as we have previously reported, this program did not always make use of cybersecurity-related expertise and other information in allocating grants. Accordingly, we recommended that the program take steps to make better-informed funding decisions. In addition, TSA officials stated that they have participated in working groups to identify other cybersecurity-related incentives across the various transportation modes.

Water Sector

EPA incorporated cyber risk mitigation activities that aligned with eight of the nine NIPP Call to Action steps. Specifically, EPA had not established incentives to encourage sector partners to enhance their security and resiliency. EPA officials stated providing funds to support cybersecurity enhancements would be an incentive for their sector partners; however, they lacked the resources to offer grants to implement security measures. EPA officials also stated that they are working on implementing recommendations from Critical Infrastructure Partnership Advisory Council Water Sector Cybersecurity Strategy Workgroup which include exploring ways to demonstrate how the benefits of implementing cybersecurity enhancements outweigh the costs of cyber incidents as an incentive to encourage investment in cybersecurity improvements.

Sector-Specific Agencies Collaborated across Sectors to Improve Cybersecurity Efforts

Sector-specific agencies use various collaborative mechanisms to share cybersecurity related information across all of the sectors. Presidential Policy Directive 21 (PPD-21) states that sector-specific agencies are to coordinate with DHS and other relevant federal departments and agencies and collaborate with critical infrastructure owners and operators to strengthen the security and resiliency of the nation’s critical infrastructure.

SSAs share information and collaborate across sectors primarily through a number of councils, working groups, and information-sharing centers established by federal entities. The mechanisms identified during our review for SSAs to collaborate across the sectors are summarized, along with the number of sectors represented in each council or group by their respective SSA, in table 6.

The mechanisms provide SSAs opportunities to interact, collaborate, and coordinate with one another. For example, each of the sectors we reviewed used working groups created under the Critical Infrastructure Partnership Advisory Council. According to the CIPAC 2013 annual report, in 2012 there were 60 working groups that held approximately 200 meetings with objectives such as information sharing, training and exercises, and risk management.

In addition, SSAs used their respective government coordinating councils to coordinate with other SSAs about interdependencies and to gain access to needed expertise about the operations of other sectors. For example, DHS officials stated that the communications sector’s government coordinating council membership provides the expertise necessary to fulfill the council’s mission. They stated that its current membership includes representatives from the DOD, DOE and Treasury, among others, and from multiple DHS components.

Further, SSAs continually referred to the Cross-Sector Cyber Security Working Group and the Industrial Control System Joint Working Group as two of the main cybersecurity-related collaborative opportunities for federal agencies. Both of these working groups facilitate government sharing of information among officials representing different sectors. The Cross-Sector Cyber Security Working Group operates under DHS’s Office of Cybersecurity and Communications. It provides the SSAs the opportunity to establish and maintain cross-sector partnerships; work on cross-cutting issues, such as incentives to encourage cybersecurity actions; and identify cyber dependencies and interdependencies that allow them to share information on cybersecurity trends that can affect their respective sectors. According to DHS, more than 100 members attend monthly meetings to share information and activities about their respective sectors. Of the SSAs representing the 15 sectors we reviewed, SSAs for 14 sectors indicated in their documentation or statements that they were active participants in this working group.

The Industrial Control System Joint Working Group was established by DHS’s Industrial Control Systems Cyber Emergency Response Team to facilitate information sharing and reduce the risk to the nation’s industrial control systems. According to DHS, the goal of this working group is to continue and enhance the collaborative efforts of the industrial control systems stakeholder community by accelerating the design, development, and deployment of secure industrial control systems. SSAs for 12 of the 15 sectors within the scope of our review were active participants in the working group. For example, HHS officials stated that they attend the Industrial Control System Joint Working Group meetings as a way to analyze relationships and identify overlapping actions with other sectors.

Table 7 provides examples of cross-sector collaboration in relation to the sectors.

In addition to the mechanisms identified above, further collaboration occurred through the co-location of sectors’ SSAs within one department. DHS, as the SSA for eight critical infrastructure sectors, has six of the sectors assigned to officials under the Infrastructure Protection group, and two under the Cybersecurity and Communications group. DHS’s Office of Infrastructure Protection officials representing several SSAs stated that they leverage DHS’s Office of Cybersecurity and Communications capabilities and resources for their sectors. Further, housing these responsibilities within the same organization provided efficiencies for their respective critical infrastructure sectors. For example, according to documentation for the critical manufacturing sector SSA, officials are leveraging training curricula produced by other Office of Infrastructure Protection SSA officials. Additionally, DHS had co-located both the National Cybersecurity and Communications Integration Center and National Infrastructure Coordinating Center, which brings two 24x7 watch centers together as they share physical and cyber information related to critical infrastructure.

Finally, SSAs used the Homeland Information Sharing Network (HSIN) sector pages to collaborate across sectors. The HSIN is a network for homeland security mission operations to share sensitive but unclassified information, including with the critical infrastructure community. It is to provide real-time collaboration tools including a virtual meeting space, document sharing, alerts, and instant messaging. Officials from SSAs associated with 14 of the 15 sectors stated that they used HSIN to share information with stakeholders within their respective sectors. For example, within the dams HSIN portal, the sector implemented a Suspicious Activity Report online tool to provide users with the capability to report and retrieve information pertaining to suspicious activities that could compromise the facility or system in a manner that would cause an incident jeopardizing life or property. Additionally, officials from the chemical sector stated that they use HSIN for the coordination of cybersecurity incidents within the sector and officials from the critical manufacturing SSA stated that when entities from their sector reach out to them for more information on threats or alerts, they direct them to subscribe to the critical manufacturing HSIN page.

Most SSAs Have Not Developed Performance Measures to Monitor Sectors’ Progress toward Improving Cybersecurity

The NIPP includes guidance to SSAs to focus on the outcomes of their security and resilience activities. Specifically, as noted earlier, one of the NIPP Call to Action steps directs SSAs and their sector partners to identify high-level outcomes to facilitate evaluation of progress toward national goals and priorities, including securing critical infrastructure against cyber threats. In addition, the NIPP risk management framework, used as a basis for the sector-specific plans, includes measuring the effectiveness of the SSAs’ risk mitigation activities as a method of monitoring sector progress.

Among the SSAs, DOD, DOE, and HHS had established performance metrics to monitor cybersecurity-related activities, incidents, and progress in their sectors.

DOD monitored cybersecurity for the defense industrial base sector through reports of cyber incidents and cyber incidents that were blocked; reports from owners and operators regarding efforts to execute the sector-specific plan’s implementation actions; and the number of cyber threat products disseminated by DOD to cleared companies and the timeliness of shared threat information. DOD also prepared annual reports for Congress for fiscal years 2010 through 2014 that provided information on sector performance metrics.

DOE developed the ieRoadmap, an interactive tool designed to enable energy sector stakeholders to map their energy delivery system cybersecurity efforts to specific milestones identified in the Roadmap to Achieve Energy Delivery Systems Cybersecurity. DOE also established the Cybersecurity Capability Maturity Model program to support ongoing development and measurement of cybersecurity capabilities. The voluntary program provides a mechanism for measuring cybersecurity capabilities from a management and program perspective.

HHS monitored cybersecurity metrics such as the number of subscribers to receive its security alerts and incidents of health information security breaches. The Health Information Technology for Economic and Clinical Health (HITECH) Act requires that health care data breaches be reported to the affected individuals and HHS, compiled in an annual HHS report to Congress, and for breaches affecting 500 or more individuals, shared with the media. HHS officials stated that they use the information on data breaches as an indicator of cybersecurity-related trends for the sector.

However, SSAs for the other 12 sectors had not developed or reported performance metrics, although some had efforts under way to do so. For selected sectors, including financial services and water and wastewater systems, SSAs emphasized that they rely on their private sector partners to voluntarily share information and so are challenged in gathering the information needed to measure efforts. Sector stakeholders are not necessarily willing to openly share potentially sensitive cybersecurity- related information. Also, the DHS guidance to the SSAs for updating their sector-specific plans includes directions to create new metrics to evaluate the sectors’ security and resilience progress; however, the plans have not been finalized and released.

DHS had not developed performance metrics to monitor the cybersecurity progress for its 8 sectors, although according to agency officials, such efforts are under way. For example, DHS lacked metrics for the chemical sector; however, officials stated that multiple industry working groups were working on cyber performance metrics to measure progress at a very high level. In addition, in 2011, a nuclear cybersecurity roadmap document was released that outlined milestones and specific cybersecurity goals for the sector over a 15-year period, including the need for metrics to measure and assess the sector’s cybersecurity posture. The nuclear sector roadmap provides near-, mid-, and long-term goals but not specific measures or criteria to assess the sector’s cybersecurity posture.

Further, according to DHS officials, a number of initiatives were begun to gather performance-related information, including the following:

DHS’s Programmatic Planning and Metrics Initiative was established in October 2014 to gather data from the department’s sectors and monitor their cybersecurity process. However, as of the time of our review, the initiative had only limited historical data.

DHS’s Sector Outreach and Programs Division plans to implement program metrics to measure and analyze adoption of cybersecurity practices and NIST’s Cybersecurity Framework across the sectors.

DHS officials for the information technology and communications sectors stated that they had proposed performance metrics to be implemented through 2018. In a review of cybersecurity related to the nation’s communications networks, we reported that DHS and its partners had not developed outcome-based metrics related to the cyber-protection activities for the communications sector. We recommended that DHS and its sector partners develop, implement, and track sector outcome-oriented performance measures for cyber protection activities related to the nation’s communications networks.

Regarding the financial services sector, Treasury officials stated that the department does not have performance metrics to chart the sector’s cybersecurity-related progress. However, according to Treasury officials, the sector coordinating council is working with the Financial and Banking Information Infrastructure Committee to identify metrics to evaluate progress in the sector. According to the officials, identifying actionable metrics based on cyber risk mitigation programs is a challenge. Treasury officials emphasized that the information needed is privately owned and may or may not be voluntarily shared with government partners.

The food and agriculture 2010 sector-specific plan stated that the sector did not have metrics to measure the effectiveness of risk mitigation efforts, although it acknowledged the need to establish tracking and monitoring mechanisms. The plan also noted that sector partners, including state agencies and private industry, may view reporting programmatic data as a burden and question the security of the data once reported. In December 2014, USDA officials noted that they do not have formal mechanisms to measure sector progress, although survey results collected through food safety inspection activities have some security elements. The ongoing process to update the sector-specific plan provides USDA and HHS an opportunity to consider possible performance metrics for monitoring the sector’s cybersecurity progress.

The transportations systems sector SSAs had also not instituted mechanisms to evaluate the progress of sector entities in achieving a more secure sector. For example, TSA officials stated that they are developing cyber metrics in line with the 2014 Sector-Specific Plan Guidance; however, the officials noted that their industry partners are reluctant to share information needed to monitor improvement in the sector because they fear regulation.

Finally, EPA does not collect performance information to provide metrics on the effectiveness of its cybersecurity programs for the water sector. Agency officials noted that the lack of statutory authority is a major challenge to collecting performance metrics data. In the absence of statutory authority or agency policy, EPA must work with water sector associations to collect the information across the sector. However, water utilities may be reluctant to voluntarily report security information to EPA. EPA is also working with the Water Sector Coordinating Council to identify performance metrics for implementation of NIST’s Cybersecurity Framework in the water sector, according to agency officials.

Until SSAs develop performance metrics and collect data to report on the progress of the sector-specific agencies’ efforts to enhance the sectors’ cybersecurity posture, they may be unable to adequately monitor the effectiveness of their cyber risk mitigation activities and document the resulting sector-wide cybersecurity progress.

Conclusions

Overall, SSAs are acting to address sector cyber risk, but additional monitoring actions could enhance their respective sectors’ cybersecurity posture. Most SSAs had identified the significance of cyber risk to their respective sectors as part of the 2010 sector-specific planning process with four sectors concluding that cyber risk was not significant at that time, but subsequently reconsidering the significance of cyber risks to their sectors. However, to prepare the 2015 updates to their sector- specific plans, the planning guidance directed the SSAs to address their current and emerging sector risks including the cyber risk landscape and key trends shaping their approach to managing risk. Toward this end, all of the SSAs had generally performed cyber risk mitigation activities that address the NIPP’s Call to Actions steps and regarding incentives— one area not addressed by most of the SSAS— efforts had begun to determine appropriate ways to encourage additional cybersecurity-related efforts across the nation’s critical infrastructures.

To their credit, SSAs are engaged in multiple public-private and cross sector collaboration mechanisms that facilitate the sharing of information, including cybersecurity-related information. However, most SSAs have not developed metrics to measure and improve the effectiveness of all their cyber risk mitigation activities and their sectors’ cybersecurity posture. As a result, SSAs may not be able to adequately monitor and document the benefits of their activities in improving the sectors’ cybersecurity posture or determine how those efforts could be improved.

Recommendations for Executive Action

To better monitor and provide a basis for improving the effectiveness of cybersecurity risk mitigation activities, we recommend that, informed by the sectors’ updated plans and in collaboration with sector stakeholders, the

Secretary of Homeland Security direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the chemical, commercial facilities, communications, critical manufacturing, dams, emergency services, information technology, and nuclear sectors’ cybersecurity progress;

Secretary of the Treasury direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the financial services sector’s cybersecurity progress;

Secretaries of Agriculture and Health and Human Services (as co- SSAs) direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the food and agriculture sector’s cybersecurity progress;

Secretaries of Homeland Security and Transportation (as co-SSAs) direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the transportation systems sector’s cybersecurity progress; and

Administrator of the Environmental Protection Agency direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the water and wastewater systems sector’s cybersecurity progress.

Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of Agriculture, Defense, Energy, Health and Human Services, Homeland Security, Transportation, and the Treasury and to EPA. In written comments signed by the Director, Departmental GAO-OIG Liaison Office (reprinted in app. III), DHS concurred with our two recommendations. DHS also provided details about efforts to address cybersecurity in the sectors for which DHS has responsibility as the SSA. DHS also stated that it supports the intent of the recommendation to improve cybersecurity, including efforts to develop performance metrics. Further, in regard to the transportation sector specifically, DHS stated that the Transportation Security Administration and the United States Coast Guard would work in collaboration with the Department of Transportation to ensure that cybersecurity is at the forefront of their voluntary partnership.

In written comments signed by the Department of the Treasury’s Acting Assistant Secretary for Financial Institutions (reprinted in app. IV), the department stated that monitoring the sector’s cybersecurity progress is a critical component of the sector’s efforts to reduce cybersecurity risk and discussed efforts with the department’s partners to improve the sector’s ability to assess progress and develop metrics.

In written comments signed by EPA’s Deputy Assistant Administrator (reprinted in app. V), EPA generally agreed with our recommendation and discussed efforts to develop cybersecurity performance metrics for the water and wastewater systems sector.

The Department of Transportation’s Director of Program Management and Improvement stated in an e-mail that the department concurred with our findings and our recommendation directed to the Secretary of Transportation and stated that it would continue to work with DHS to improve cyber risk mitigation activities and strengthen the transportation sector’s cybersecurity posture.

If effectively implemented, the actions identified by these departments should help address the need to better measure cybersecurity progress in the sectors.

The Departments of Agriculture and Health and Human Services did not comment on the recommendations made to them.

In addition, officials from the Departments of Agriculture, Defense, Energy, Health and Human Services, Homeland Security, and the Treasury and EPA also provided technical comments via e-mail that have been addressed in this report as appropriate. The Department of Transportation did not have technical comments for the report.

We are sending copies of this report to the appropriate congressional committees; the Secretaries of Agriculture, Defense, Energy, Health and Human Services, Homeland Security, Transportation, and the Treasury; the Administrator of the Environmental Protection Agency; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which sector-specific agencies (SSA) have (1) identified the significance of cyber risks to their respective sectors’ networks and industrial control systems, (2) taken actions to mitigate cyber risks within their respective sectors, (3) collaborated across sectors to improve cybersecurity, and (4) established performance metrics to monitor improvements in their respective sectors.

To conduct our evaluation, we analyzed relevant critical infrastructure protection policies and guidance for improving the cybersecurity posture of the nation’s critical infrastructure. Based on these analyses, we identified nine federal agencies designated as the sector-specific agencies for the critical infrastructure sectors. For this review, we focused on eight of the nine sector-specific agencies responsible for 15 of the 16 critical infrastructure sectors. We included the 15 sectors that involve private sector stakeholders in their efforts to implement activities to address sector security and resiliency goals. We excluded the General Services Administration, the sector-specific agency for the government facilities sector, as the sector is uniquely governmental with facilities either owned or leased by government entities. See Table 8 for the sectors and sector-specific agencies included in our review.

To determine how sector-specific agencies prioritized cyber risks, we analyzed their efforts to identify and document cyber risks. We reviewed the risk assessment methodologies employed as documented in the 2010 sector-specific plans and other supplementary documentation such as formal risk assessments, strategy documents, and annual reports. We also interviewed officials responsible for carrying out the sector-specific agency roles and responsibilities to further understand their determination of the significance of cyber-related risks to their respective sectors.

To identify SSAs’ activities to mitigate cyber risks, we compared sector- specific planning documents and actions to fulfill roles and responsibilities as identified in federal policy and the 2013 National Infrastructure Protection Plan (NIPP) Call to Action steps related to cyber risks. The NIPP steps are suggested practices to guide sector-specific agencies’ actions. The NIPP presented a total of 12 steps; however, we excluded 2 steps that we determined did not have a cybersecurity-related nexus. We analyzed the latest sector-specific plans, which were released in 2010, and other sector-specific planning documents including risk assessments and strategies for each of the sectors. We also interviewed officials from the SSAs and obtained related documentation to identify cyber risk mitigation activities. Additionally, we interviewed private sector stakeholders representing the sector coordinating councils to corroborate the sector-specific agencies cyber risk mitigation activities. We used all of this information to determine the extent to which each of the sector- specific agencies conducted activities for the 9 of the NIPP Call to Action steps.

To determine the extent of the sector-specific agencies’ collaborative efforts to enhance their sectors’ cybersecurity environment, we reviewed documentation related to the collaboration mechanisms utilized by the sector-specific agencies. We also identified the collaborative groups, councils, and working groups that were utilized most frequently by SSAs to share cybersecurity-related information across the sectors. We analyzed documentation of cross-sector collaboration from the sector, government, and cross-sector coordinating councils. Additionally, we interviewed SSA officials and private sector stakeholders representing the sector coordinating councils.

To identify performance measures used by SSAs to monitor cybersecurity in their respective sectors, we analyzed the sector-specific plans and cybersecurity-related performance reporting documents and interviewed SSA officials. We reviewed performance evaluation guidance related to national security and resiliency goals provided to the SSAs for past and future planning efforts. Additionally, we reviewed past sector annual reports, which tracked actions of the sector against goals established in the 2010 sector-specific plans, as well as strategic documents or roadmaps used to track sector performance. We reviewed reports of cyber incidents and data breaches provided as examples of indicators for SSAs to monitor sector cybersecurity. We also interviewed private sector partners to identify sources of cybersecurity-related data being reported to the sector-specific agencies.

We conducted this performance audit from June 2014 to November 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Sector-Specific Agencies’ Cyber Risk Mitigation Activities by Sector

This appendix provides further details on cyber risk mitigation activities sector-specific agencies (SSA) developed for the 15 sectors in our review based on analysis of documentation and statements from SSA officials. Tables 9 through 23 below show, for each sector, SSA actions that aligned with the 2013 National Infrastructure Protection Plan (NIPP) Call to Action Steps.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: Comments from the Department of the Treasury

Appendix V: Comments from the Environmental Protection Agency

Appendix VI: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Michael W. Gilmore, Assistant Director; Kenneth A. Johnson; Lee McCracken; David Plocher; Di’Mond Spencer; Jonathan Wall; and Jeffrey Woodward made key contributions to this report.