Federal government contractors, including defense small businesses, face an evolving array of cyber-based threats. As we testified in April 2015, risks to cyber-based assets can originate from both unintentional and intentional threats. Unintentional threats can be caused by, among other things, defective computer or network equipment, and careless or poorly trained employees. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. Threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. For example, adversaries possessing sophisticated levels of expertise and significant resources to pursue their objectives--sometimes referred to as "advanced persistent threats"-- pose increasing risks. Table 1 presents various sources of cyber threats. Threat sources make use of various techniques--or exploits--that may adversely affect information computers, software, networks, and operations. Table 2 presents various types of cyber exploits. The number of information security incidents reported by federal agencies to the U.S. Computer Emergency Readiness Team increased from 5,503 in fiscal year 2006 to 67,168 in fiscal year 2014, an increase of 1,121 percent. DOD has tasked DOD OSBP with ensuring that small businesses receive a fair proportion of DOD purchases, contracts, and subcontracts for property and services. This office is responsible for providing small business policy advice to the Office of the Secretary of Defense and for providing policy oversight to DOD military department and DOD component small business offices. Those offices are responsible for ensuring that small businesses are afforded the maximum practicable opportunity to participate in DOD acquisitions and establishing challenging small business program goals. DOD Directive 4205.01 states that DOD OSBP should take part in outreach and education on small business issues within DOD. Specifically, the directive states that DOD OSBP should establish and support a small business training program for Small Business Specialists and other acquisition personnel within DOD. In addition, DOD OSBP provides resources on the DOD OSBP website, and according to DOD OSBP officials, DOD OSBP also supports small businesses by providing outreach and education by attending small business conferences. However, according to DOD OSBP officials, none of those responsibilities requires the office to integrate cybersecurity into current or new outreach and education efforts. While DOD OSBP is responsible for leading DOD's efforts to support small business initiatives, other DOD components support defense small businesses. For example, Military department small business office officials told us that their offices routinely provide outreach and education to small businesses on topics such as how to bid on DOD contracts; however, these efforts do not include outreach and education on cybersecurity issues. DOD Chief Information Officer manages the Defense Industrial Base Cyber Security/Information Assurance Program to address the pressing need to stem the risk posed by cyber attacks against defense industrial base businesses. According to DOD Instruction 5205.13, the program established a comprehensive approach for protecting unclassified DOD information transiting or residing on unclassified defense industrial base information systems and networks by incorporating the use of intelligence, operations, policies, standards, information sharing, expert advice and assistance, incident response, reporting procedures, and cyber intrusion damage assessment solutions to address a cyber advanced persistent threat. It was designed to establish a voluntary framework to prevent unauthorized access to DOD program information or the intellectual property of industry. This program is available only to a subset of small companies since participating companies must be approved to maintain classified information. The Defense Security Service manages the National Industrial Security Program for the Undersecretary of Defense for Intelligence, which governs cleared contractor companies and their cleared employees who support DOD and other federal agencies. The Defense Security Service has security oversight of these contractors, and provides them with related counterintelligence services and security education, awareness, and training; this includes the foreign threat to cleared contractors as an aspect of the counterintelligence mission. DOD has designated the Defense Security Service as its provider of security professional training and security awareness products for DOD personnel and for the cleared contractors. Under the National Industrial Security Program, the Defense Security Service receives, analyzes, and shares information on activity involving cleared contractor's networks, regardless of the classification that may reflect foreign intelligence interests and acts in close coordination with the Federal Bureau of Investigation and other federal law enforcement and counterintelligence community members. In November 2013, DOD updated its Defense Federal Acquisition Regulation Supplement to include a contract clause that requires defense contractors and subcontractors to safeguard unclassified controlled technical information on their unclassified information systems from unauthorized access and disclosure and to report certain cyber incidents to DOD. In addition, under the required clause, contractors are to implement minimum privacy and security controls such as risk assessments that were developed by the National Institute of Standards and Technology, among other requirements. The 2015 DOD Cyber Strategy states that DOD must work with the private sector to help secure defense industrial base trade data. Furthermore, to safeguard critical programs and technologies, the strategy states that DOD will work with companies to develop alert capabilities and build layered cyber defenses. DOD OSBP officials have explored some ways whereby the office could integrate cybersecurity into its existing outreach and education efforts; however, as of July 2015, the office had not identified and disseminated information about cybersecurity resources in its outreach and education efforts to defense small businesses. While DOD OSBP is not required to educate small businesses on cybersecurity, DOD OSBP officials acknowledged that cybersecurity is an important and timely issue for small businesses--and therefore the office is considering incorporating cybersecurity into its existing outreach and education efforts. In response to our review, DOD OSBP officials contacted DOD Chief Information Officer officials in April 2015 to discuss options for integrating cybersecurity into their existing outreach and education efforts. According to DOD OSBP officials, the DOD OSBP and DOD Chief Information Officer officials discussed the development of training materials, such as online videos and brochures that could be distributed at small business conferences. The purpose of such training materials would be to help defense small businesses in understanding cybersecurity best practices, and the cybersecurity requirements identified in the Defense Federal Acquisition Regulation Supplement. According to DOD OSBP officials, the office also invited a DOD Chief Information Officer official to join a DOD OSBP representative to speak with small businesses about cybersecurity and to distribute a handout on cybersecurity and cyber business opportunities at a small business conference held in April 2015. In addition, recognizing that DOD's small business offices may not be staffed by cybersecurity experts, DOD OSBP officials stated that they plan to add a cybersecurity component to a training curriculum that they are currently developing along with DOD Chief Information Officer for professionals who work in DOD small business offices. However, these efforts have not been completed and, as of July 2015, DOD OSBP had not identified or disseminated cybersecurity resources to defense small businesses that the businesses could use to understand cybersecurity and cyber threats. We identified 15 existing federal cybersecurity outreach and education resources that the office could leverage for defense small businesses. For example: DOD's Defense Security Service offers online cybersecurity training programs that are available to the public on topics such as cybersecurity awareness, the National Institute of Standards and Technology's Risk Management Framework, insider threats, and security controls through its public website. According to Defense Security Service officials, DOD small businesses could use the online training programs to improve their knowledge of cybersecurity. The U.S. Small Business Administration maintains a learning center that provides a 30-minute online program--available to small businesses--that covers cybersecurity concepts for small business. Topics include identifying and securing sensitive information, types of cyber threats, risk management, and best practices for guarding against cyber threats. The Department of Homeland Security, in coordination with the National Cyber Security Alliance and the Anti-Phishing Working Group, provides cyber awareness resources to the public--including cybersecurity awareness videos and tip sheets--on its Stop.Think.Connect website and facilitates cybersecurity awareness events targeted to various audiences, including businesses. This resource is available to defense small businesses. The Federal Communications Commission hosts a planning tool on its website, known as the FCC Small Biz Cyber Planner 2.0 that is targeted to small businesses and available to the public. This online planner provides guidance to small businesses on developing their cybersecurity plans and is available to defense small businesses. See appendix II for a listing of the 15 resources we identified. While DOD OSBP officials recognized the importance of identifying and disseminating cybersecurity resources through outreach and education efforts to defense small businesses, they also identified a number of factors that had, to date, limited their progress in doing so. Specifically, DOD OSBP officials were not aware of existing cybersecurity resources such as those we identified when we met with them in June 2015, there had been leadership turnover within the office, and the office had been focused on one of its key initiatives--developing the training curriculum for DOD professionals who work with small businesses. OSBP officials also stated that they had been focused on their statutory requirements such as training the DOD workforce that works with small businesses, advocating for small businesses within the government, and reaching out to small businesses in the private sector. While we recognize that these factors could affect progress, federal government internal controls state that management should ensure that there are adequate means of communicating with, and obtaining information from, external stakeholders who may have a significant impact on the agency's achieving its goals. While they had not yet identified or disseminated information about existing cybersecurity resources to defense small businesses, officials agreed that doing so could help the businesses to become more aware of cybersecurity practices and cyber threats. In addition, by identifying and disseminating this information, DOD OSBP could help defense small businesses to protect their networks against cyber exploits, which would support the 2015 DOD Cyber Strategy goals of working with the private sector to help secure defense industrial base trade data and build layered cyber defenses. Furthermore, by identifying existing federal government resources, OSBP's efforts would be in line with DOD Instruction 5134.04, which states that the OSBP Director shall use the existing services and systems of DOD and other federal agencies, when practicable, to avoid duplication and to achieve maximum efficiency and economy. Finally, once OSBP has identified the resources, it can also share them with military department and component small business offices so that they can use them for their own outreach and education efforts with defense small businesses. DOD spends billions of dollars contracting with defense small businesses, and relies on these businesses to support its missions. However, defense small businesses face challenges in protecting their corporate networks and information from increasing cyber threats. While DOD OSBP officials have recognized the importance of educating defense small businesses about cybersecurity, they have not identified and disseminated cybersecurity resources through their outreach and education efforts to businesses because they have been focused on other priorities, such as developing a training curriculum for DOD professionals who work with small businesses. By identifying and disseminating information about existing cybersecurity resources to defense small businesses, these businesses may be made more aware of cybersecurity practices and cyber threats, thereby potentially assisting them in protecting their networks against cyber exploits. By leveraging resources that DOD components and other federal agencies have already developed, some of which have been identified in this report, DOD OSBP will be able to spend more time focusing on other priorities such as developing the training curriculum. To better position defense small businesses in protecting information and networks from cyber threats, we recommend that the Secretary of Defense direct the Director of the DOD OSBP, as part of its existing outreach efforts, to identify and disseminate cybersecurity resources to defense small businesses. We provided a draft of this report to DOD, the Federal Communications Commission, the Department of Homeland Security, the Department of Justice, the U.S. Small Business Administration, and the National Institute of Standards and Technology for review and comment. DOD's written comments are included in appendix III. DOD concurred with our recommendation that the Secretary of Defense direct the Director of the DOD OSBP, as part of its existing outreach efforts, to identify and disseminate cybersecurity resources to defense small businesses. DOD stated that understanding the essential need to protect DOD critical networks, information and infrastructure--including those within defense small businesses--DOD OSBP, with support from the DOD Chief Information Officer, is expanding its current cybersecurity awareness and outreach programs. DOD stated further that the resources we identified reflect a thorough assessment of available federal capabilities and are very helpful to any organization conducting cybersecurity education for its stakeholders. DOD noted that future outreach by the DOD OSBP will increase awareness of cybersecurity education and training resources to defense small businesses. Finally, DOD noted that OSBP will also increase awareness of the cybersecurity education resources among the DOD small business workforce through training events and education programs, and by issuing guidance to the military departments and defense agencies. DOD OSBP added in its technical comments that the office has new leadership and staff in place to expand cybersecurity education for small businesses. The office also noted that it is using a measured approach involving existing information resources and inclusion of cybersecurity information in the development of DOD workforce training and the ongoing creation of outreach materials and presentations. We believe that by identifying and disseminating cybersecurity information, DOD OSBP will help defense small businesses to become more aware of cybersecurity practices and cyber threats and help them protect their networks against cyber exploits. In technical comments on the report, the Federal Communications Commission identified the following additional federal cybersecurity resource--the Communications Security, Reliability and Interoperability Council - Cybersecurity Risk Management and Best Practices Working Group 4: Final Report. The report's appendix provides cybersecurity risk management and best practice recommendations for small and medium business interests, includes potential challenges and barriers to best practice implementation, and includes a compilation of cybersecurity resources available to small businesses. Although the report appendix is intended for small and medium businesses in the communications industry, it is also publicly available online to defense small business contractors. DOD provided additional technical comments that we incorporated as appropriate. The Department of Homeland Security and the National Institute of Standards and Technology also provided technical comments that we incorporated as appropriate. The U.S. Small Business Administration and the Department of Justice did not comment on the report. We are sending copies of this report to appropriate congressional committees; the Secretary of Defense; the Secretary of Homeland Security; the U.S. Attorney General; the Chairman of the Federal Communications Commission; the Director of the National Institute of Standards and Technology; and the Administrator of the U.S. Small Business Administration. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-9971 or KirschbaumJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. We focused our review on the Department of Defense (DOD) Office of Small Business Programs (OSBP) because this office is responsible for providing small business policy advice to the Office of the Secretary of Defense and for providing policy oversight to DOD military department and DOD component small business offices, per DOD Directive 4205.01. While other DOD components such as the DOD Chief Information Officer and military department small business program offices may interact with small businesses, we found these other components either do not exclusively focus their efforts on small businesses or they rely on DOD OSBP policy and guidance with regard to working with small businesses. To address the extent to which the DOD OSBP has integrated cybersecurity into its existing outreach and education efforts for defense small businesses, we analyzed documentation and interviewed officials from the DOD OSBP about its existing cybersecurity outreach and education efforts to small businesses. We also discussed with DOD OSBP officials any challenges or limitations to their ability to conduct cybersecurity outreach and education. As part of this review, we evaluated the office's efforts by comparing information on their activities with Standards for Internal Control in the Federal Government. By reviewing agency websites, interviewing agency officials, and searching literature on cybersecurity resources, we determined that there was no central repository of federal cybersecurity resources that could be leveraged by the DOD OSBP to share with defense small businesses. In the absence of such a central repository, we reviewed documentation and interviewed officials from the following organizations with cybersecurity expertise: DOD Chief Information Officer, Defense Security Service, Defense Information Systems Agency, Department of Homeland Security National Protection and Programs Directorate, Federal Bureau of Investigation Cyber Division, National Institute of Standards and Technology, U.S. Small Business Administration, Federal Communications Commission, and the National Cyber Security Alliance in order to identify examples of existing cybersecurity outreach and education programs potentially available to defense small businesses that could be leveraged by the DOD OSBP. We limited the scope of our research to cybersecurity outreach and education programs that were managed or funded by federal agencies. To confirm that these resources were accessible to defense small businesses, we visited the websites where these resources were publicly available during May 2015 or interviewed agency officials. To validate that the resources were relevant to cybersecurity, we reviewed information on the resource websites to confirm that each resource contained some level of cybersecurity information. We may not have identified all of the resources available or interviewed all knowledgeable parties, and we did not assess the quality of the selected resources. To describe the approximate size of DOD's current small business community, we aggregated obligations data for DOD's prime contractors coded as small in the Federal Procurement Data System-Next Generation database for fiscal year 2014. This database does not collect data on subcontractors to defense businesses, so the reported data likely underestimate the size of the DOD small business community. We compared this data to the U.S. Small Business Administration Fiscal Year 2014 Small Business Goaling Report and found the data to be sufficiently reliable to provide an overview of DOD's spending on prime contracts with small businesses. We define the terms "cybersecurity" and "threat" in the introduction of the report using definitions from the National Institute of Standards and Technology and we define "small business" in the introduction of the report using DOD's methodology. We conducted this performance audit from February 2015 to September 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, GAO staff who made significant contributions to this report include Tommy Baril (Assistant Director), Tracy Barnes, David Beardwood, Kevin Copping, and Patricia Farrell Donahue. Information Security: Cyber Threats and Data Breaches Illustrate Need for Stronger Controls across Federal Agencies. GAO-15-758T. Washington, D.C.: July 8, 2015. Insider Threats: DOD Should Strengthen Management and Guidance to Protect Classified Information and Systems. GAO-15-544. Washington, D.C.: June 2, 2015. Cybersecurity: Actions Needed to Address Challenges Facing Federal Systems. GAO-15-573T. Washington, D.C.: April 22, 2015. Information Security: Agencies Need to Improve Oversight of Contractor Controls. GAO-14-612. Washington, D.C.: August 8, 2014. Information Security: Agencies Need to Improve Cyber Incident Response Practices. GAO-14-354. Washington, D.C.: April 30, 2014. Information Security: Federal Agencies Need to Enhance Responses to Data Breaches. GAO-14-487T. Washington, D.C.: April 2, 2014. Federal Information Security: Mixed Progress in Implementing Program Components; Improved Metrics Needed to Measure Effectiveness. GAO-13-776. Washington, D.C.: September 26, 2013. Government Contracting: Federal Efforts to Assist Small Minority Owned Businesses. GAO-12-873. Washington, D.C.: September 28, 2012. Defense Cyber Efforts: Management Improvements Needed to Enhance Programs Protecting the Defense Industrial Base from Cyber Threats. GAO-12-762SU. Washington, D.C.: August 3, 2012. This report is restricted to official use only and is not publicly available. Information Security: Cyber Threats Facilitate Ability to Commit Economic Espionage. GAO-12-876T. Washington, D.C.: June 28, 2012. Cybersecurity: Threats Impacting the Nation. GAO-12-666T. Washington, D.C.: April 24, 2012. IT Supply Chain: National Security-Related Agencies Need to Better Address Risks. GAO-12-361. Washington, D.C.: March 23, 2012.

Summary:
Small businesses, including those that conduct business with DOD, are vulnerable to cyber threats and may have fewer resources, such as robust cybersecurity systems, than larger businesses to counter cyber threats. The Joint Explanatory Statement accompanying the National Defense Authorization Act for Fiscal Year 2015 included a provision that GAO assess DOD OSBP's outreach and education efforts to small businesses on cyber threats. This report addresses the extent to which DOD OSBP has integrated cybersecurity into its outreach and education efforts to defense small businesses. DOD OSBP's mission includes providing small business policy advice to the Office of the Secretary of Defense, and policy oversight to DOD military department and component small business offices. To conduct this review, GAO analyzed documentation and interviewed officials from DOD OSBP about its cybersecurity outreach and education efforts. GAO also analyzed documentation and interviewed officials from nine organizations selected for their cybersecurity expertise to identify examples of cybersecurity outreach and education programs potentially available to defense small businesses. The Department of Defense (DOD) Office of Small Business Programs (OSBP) has explored some options, such as online training videos, to integrate cybersecurity into its existing efforts; however, as of July 2015, the office had not identified and disseminated cybersecurity resources in its outreach and education efforts to defense small businesses. While DOD OSBP is not required to educate small businesses on cybersecurity, DOD OSBP officials acknowledged that cybersecurity is an important and timely issue for small businesses--and therefore the office is considering incorporating cybersecurity into its existing outreach and education efforts. During the review, GAO identified 15 existing federal cybersecurity resources that DOD OSBP could disseminate to defense small businesses. Source: GAO analysis of information from listed agencies. | GAO-15-777 While DOD OSBP officials recognized the importance of identifying and disseminating cybersecurity resources through outreach and education efforts to small businesses, they identified factors that had limited their progress in doing so. Specifically, they were not aware of existing cybersecurity resources, they had leadership turnover in the office, and the office was focused on developing a training curriculum for professionals who work with small businesses. While GAO recognizes that these factors could affect progress, federal government internal controls state that management should ensure there are adequate means of communicating with, and obtaining information from, external stakeholders who may have a significant impact on the agency's achieving its goals. DOD OSBP officials agreed that identifying and disseminating information about existing cybersecurity resources to defense small businesses could help small businesses be more aware of cybersecurity practices and cyber threats. In addition, by identifying and disseminating this information, DOD OSBP could help small businesses to protect their networks, thereby supporting the 2015 DOD Cyber Strategy goals of working with the private sector to help secure defense industrial base trade data and build layered cyber defenses. GAO recommends that DOD identify and disseminate cybersecurity resources to defense small businesses. DOD concurred with the recommendation and agreed to implement training events and education programs.