Several federal laws and policies—predominantly the Federal Information Security Modernization Act of 2014 and its predecessor, the Federal Information Security Management Act of 2002 (both referred to as FISMA)—provide a framework for protecting federal information and IT assets. The purpose of both laws is to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. The laws establish responsibilities for implementing the framework and assign those responsibilities to specific officials and agencies: The Director of the Office of Management and Budget (OMB) is responsible for developing and overseeing implementation of policies, principles, standards, and guidelines on information security in federal agencies, except with regard to national security systems. Since 2003, OMB has issued policies and guidance to agencies on many information security issues, including providing annual instructions to agencies and inspectors general for reporting on the effectiveness of agency security programs. More recently, OMB issued the Cybersecurity Strategy and Implementation Plan for the Federal Civilian Government in October 2015, which aims to strengthen federal civilian cybersecurity by (1) identifying and protecting high- value information and assets, (2) detecting and responding to cyber incidents in a timely manner, (3) recovering rapidly from incidents when they occur and accelerating the adoption of lessons learned, (4) recruiting and retaining a highly qualified cybersecurity workforce, and (5) efficiently acquiring and deploying existing and emerging technology. OMB also recently updated its Circular A-130 on managing federal information resources to address protecting and managing federal information resources and on managing PII. The head of each federal agency has overall responsibility for providing appropriate information security protections for the agency’s information and information systems, including those collected, maintained, operated or used by others on the agency’s behalf. In addition, the head of each agency is required to ensure that senior agency officials provide information security for the information and systems supporting the operations and assets under their control, and the agency chief information officer (CIO) is delegated the authority to ensure compliance with the law’s requirements. The assignment of information security responsibilities to senior agency officials is noteworthy because it reinforces the concept that information security is a business function as well as an IT function. Each agency is also required to develop, document, and implement an agency-wide information security program that involves an ongoing cycle of activity including (1) assessing risks, (2) developing and implementing risk-based policies and procedures for cost-effectively reducing information security risk to an acceptable level, (3) providing awareness training to personnel and specialized training to those with significant security responsibilities, (4) testing and evaluating effectiveness of security controls, (5) remedying known weaknesses, and (6) detecting, reporting, and responding to security incidents. As discussed later, our work has shown that agencies have not fully or effectively implemented these programs and activities on a consistent basis. FISMA requires the National Institute of Standards and Technology (NIST) to develop information security standards and guidelines for agencies. To this end, NIST has developed and published federal information processing standards that require agencies to categorize their information and information systems according to the impact or magnitude of harm that could result if they are compromised and specify minimum security requirements for federal information and information systems. NIST has also issued numerous special publications that provide detailed guidelines to agencies for securing their information and information systems. In 2014, FISMA established the Department of Homeland Security’s (DHS) oversight responsibilities, including (1) assisting OMB with oversight and monitoring of agencies’ information security programs, (2) operating the federal information security incident center, and (3) providing agencies with operational and technical assistance. Other cybersecurity-related laws were recently enacted, which include the following: The National Cybersecurity Protection Act of 2014 codifies the role of DHS’s National Cybersecurity and Communications Integration Center as the federal civilian interface for sharing information about cybersecurity risks, incidents, analysis, and warnings for federal and non-federal entities, including owners and operators of systems supporting critical infrastructure. The Cybersecurity Enhancement Act of 2014, among other things, authorizes NIST to facilitate and support the development of voluntary standards to reduce cyber risks to critical infrastructure and, in coordination with OMB, to develop and encourage a strategy for the adoption of cloud computing services by the federal government. The Cybersecurity Act of 2015, among other things, sets forth authority for enhancing the sharing of cybersecurity-related information among federal and non-federal entities, gives DHS’s National Cybersecurity and Communications Integration Center responsibility for implementing these mechanisms, requires DHS to make intrusion and detection capabilities available to any federal agency, and calls for agencies to assess their cyber-related workforce. Our work has identified the need for improvements in the federal government’s approach to cybersecurity. While the administration and agencies have acted to improve the protections over their information and information systems, additional actions are needed. Federal agencies need to effectively implement risk-based entity- wide information security programs consistently over time. Since FISMA was enacted in 2002, agencies have been challenged to fully and effectively develop, document, and implement agency-wide programs to secure the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency or contractor. For example, in fiscal year 2015, 19 of the 24 major federal agencies covered by the Chief Financial Officers Act of 1990 reported that information security control deficiencies were either a material weakness or significant deficiency in internal controls over financial reporting. In addition, inspectors general at 22 of the 24 agencies cited information security as a major management challenge for their agency. The following actions will assist agencies in implementing their information security programs. Enhance capabilities to effectively identify cyber threats to agency systems and information. A key activity for assessing cybersecurity risk and selecting appropriate mitigating controls is the identification of cyber threats to computer networks, systems, and information. In 2016, we reported on several factors that agencies identified as impairing their ability to identify these threats to a great or moderate extent. The impairments included an inability to recruit and retain personnel with the appropriate skills, rapidly changing threats, continuous changes in technology, and a lack of government-wide information-sharing mechanisms. Addressing these impairments will enhance the ability of agencies to identify the threats to their systems and information and be in a better position to select and implement appropriate countermeasures. Implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices. We routinely determine that agencies do not enable key information security capabilities of their operating systems, applications, workstations, servers, and network devices. Agencies were not always aware of the insecure settings that introduced risk to the computing environment. Establishing strong configuration standards and implementing sustainable processes for monitoring and enabling configuration settings will strengthen the security posture of federal agencies. Patch vulnerable systems and replace unsupported software. Federal agencies consistently fail to apply critical security patches in a timely manner on their systems, sometimes years after the patch is available. We also consistently identify instances where agencies use software that is no longer supported by their vendors. These shortcomings often place agency systems and information at significant risk of compromise since many successful cyberattacks exploit known vulnerabilities associated with software products. Using vendor-supported and patched software will help to reduce this risk. Develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis. The information security assessments performed for agency systems were sometimes based on interviews and document reviews, limited in scope, and did not identify many of the security vulnerabilities that our examinations identified. Conducting in-depth security evaluations that examine the effectiveness of security processes and technical controls is essential for effectively identifying system vulnerabilities that place agency systems and information at risk. Strengthen oversight of contractors providing IT services. As demonstrated by the Office of Personnel Management data breach of 2015, cyber attackers can sometimes gain entrée to agency systems and information through the agency’s contractors or business partners. Accordingly, agencies need to ensure that their contractors and partners are adequately protecting the agency’s information and systems. In August 2014, we reported that five of six selected agencies were inconsistent in overseeing the execution and review of security assessments that were intended to determine the effectiveness of contractor implementation of security controls, resulting in security lapses. In 2016, agency chief information security officers (CISO) we surveyed reported that they were challenged to a large or moderate extent in overseeing their IT contractors and receiving security data from the contractors, thereby diminishing the CISOs’ ability to assess how well agency information maintained by the contractors is protected. Effectively overseeing and reviewing the security controls implemented by contractors and other parties is essential to ensuring that the organization’s information is properly safeguarded. The federal government needs to improve its cyber incident detection, response, and mitigation capabilities. Even agencies or organizations with strong security can fall victim to information security incidents due to previously unknown vulnerabilities that are exploited by attackers to intrude into an agency’s information systems. Accordingly, agencies need to have effective mechanisms for detecting, responding to, and recovering from such incidents. The following actions will assist the federal government in building its capabilities for detecting, responding to, and recovering from security incidents. DHS needs to expand capabilities, improve planning, and support wider adoption of its government-wide intrusion detection and prevention system. In January 2016, we reported that DHS’s National Cybersecurity Protection System (NCPS) had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information. In addition, adoption of these capabilities at federal agencies was limited. Expanding NCPS’s capabilities for detecting and preventing malicious traffic, defining requirements for future capabilities, and developing network routing guidance would increase assurance of the system’s effectiveness in detecting and preventing computer intrusions and support wider adoption by agencies. Improve cyber incident response practices at federal agencies. In April 2014 we reported that 24 major federal agencies did not consistently demonstrate that they had effectively responded to cyber incidents. For example, agencies did not determine the impact of incidents or take actions to prevent their recurrence. By developing complete policies, plans, and procedures for responding to incidents and effectively overseeing response activities, agencies will have increased assurance that they will effectively respond to cyber incidents. Update federal guidance on reporting data breaches and develop consistent responses to breaches of personally identifiable information (PII). As we reported in December 2013, eight selected agencies did not consistently implement policies and procedures for responding to breaches of PII. For example, none of the agencies documented the evaluation of incidents and lessons learned. In addition, OMB’s guidance to agencies to report each PII-related incident—even those with inherently low risk to the individuals affected—within 1 hour of discovery may cause agencies to expend resources to meet reporting requirements that provide little value and divert time and attention from responding to breaches. Updating guidance and consistently implementing breach response practices will improve the effectiveness of government-wide and agency-level data breach response programs. The federal government needs to expand its cyber workforce planning and training efforts. Ensuring that the government has a sufficient number of cybersecurity professionals with the right skills and that its overall workforce is aware of information security responsibilities remains an ongoing challenge. These actions can help meet this challenge: Enhance efforts for recruiting and retaining a qualified cybersecurity workforce. This has been a long-standing dilemma for the federal government. In 2012, agency chief information officers and experts we surveyed cited weaknesses in education, awareness, and workforce planning as a root cause in hindering improvements in the nation’s cybersecurity posture. Several experts also noted that the cybersecurity workforce was inadequate, both in numbers and training. They cited challenges such as the lack of role-based qualification standards and difficulties in retaining cyber professionals. In 2016, agency CISOs we surveyed reported that difficulties related to having sufficient staff; recruiting, hiring, and retaining security personnel; and ensuring security personnel have appropriate skills and expertise pose challenges to their abilities to carry out their responsibilities effectively. Improve cybersecurity workforce planning activities at federal agencies. In November 2011, we reported that only five of eight selected agencies had developed workforce plans that addressed cybersecurity. Further, agencies reported challenges with filling cybersecurity positions, and only three of the eight had a department- wide training program for their cybersecurity workforce. In summary, federal law and policy set forth a framework for addressing cybersecurity risks to federal systems. However, implementation of this framework has been inconsistent, and additional action is needed to address ongoing challenges. Specifically, agencies need to address control deficiencies and fully implement organization-wide information security programs, cyber incident response and mitigation efforts need to be improved across the government, and establishing and maintaining a qualified cybersecurity workforce needs to be a priority. Chairman Donilon, Vice Chair Palmisano, and distinguished members of the Commission, this concludes my prepared statement. I would be happy to answer any questions you have. If you have any questions about this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other staff members who contributed to this statement include Larry Crosland and Michael Gilmore (assistant directors), Chris Businsky, Franklin Jackson, Kenneth A. Johnson, Lee McCracken, Scott Pettis, and Adam Vodraska. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The dependence of federal agencies on computerized information systems and electronic data makes them potentially vulnerable to a wide and evolving array of cyber-based threats. Securing these systems and data is vital to the nation's safety, prosperity, and well-being. Because of the significance of these risks and long-standing challenges in effectively implementing information security protections, GAO has designated federal information security as a government-wide high-risk area since 1997. In 2003 this area was expanded to include computerized systems supporting the nation's critical infrastructure, and again in February 2015 to include protecting the privacy of personally identifiable information collected, maintained, and shared by both federal and nonfederal entities. GAO was asked to provide a statement on laws and policies shaping the federal IT security landscape and actions needed for addressing long-standing challenges to improving the nation's cybersecurity posture. In preparing this statement, GAO relied on previously published work. Over the past several years, GAO has made about 2,500 recommendations to federal agencies to enhance their information security programs and controls. As of September 16, 2016, about 1,000 have not been implemented. Cyber incidents affecting federal agencies have continued to grow, increasing about 1,300 percent from fiscal year 2006 to fiscal year 2015. Several laws and policies establish a framework for the federal government's information security and assign implementation and oversight responsibilities to key federal entities, including the Office of Management and Budget, executive branch agencies, and the Department of Homeland Security (DHS). However, implementation of this framework has been inconsistent, and additional actions are needed: Effectively implement risk-based information security programs. Agencies have been challenged to fully and effectively establish and implement information security programs. They need to enhance capabilities to identify cyber threats, implement sustainable processes for securely configuring their computer assets, patch vulnerable systems and replace unsupported software, ensure comprehensive testing and evaluation of their security on a regular basis, and strengthen oversight of IT contractors. Improve capabilities for detecting, responding to, and mitigating cyber incidents. Even with strong security, organizations can continue to be victimized by attacks exploiting previously unknown vulnerabilities. To address this, DHS needs to expand the capabilities and adoption of its intrusion detection and prevention system, and agencies need to improve their practices for responding to cyber incidents and data breaches. Expand cyber workforce and training efforts. Ensuring that the government has a sufficient cybersecurity workforce with the right skills and training remains an ongoing challenge. Government-wide efforts are needed to better recruit and retain a qualified cybersecurity workforce and to improve workforce planning activities at agencies.